# AI Compliance Package — EU Article 50 plus US module

Article 50 has been in force since 2 August 2026.

Three weeks: the transparency and marking controls the regulation asks for, running in production, plus the optional US state module.

3 weeks · $15K-25K

The EU module is the base. The US state module (Texas, Colorado, California) is scoped separately depending on where you operate.

## Who this is for

- You operate a system that interacts with people or generates synthetic content, and you sell into the EU.
- Counsel has told you what the obligation is and nobody has translated it into controls that run.
- You need the evidence to exist before a regulator, a customer, or an auditor asks for it.

## Who this is not for

- You need a legal opinion on whether an obligation applies. That sits with counsel, and the engagement is built to run alongside them — the technical work maps to their position, and introductions to specialist counsel are part of the package.
- You are a frontier developer above the compute thresholds. Those obligations are a different regime, with specialist advisors built for it.

## What you get

- A classification pass: which of your systems fall under which obligation, and on what date.
- Transparency controls: disclosure at the interaction boundary, implemented in the product rather than the terms of service.
- Content marking and provenance mechanics for synthetic output, including the legacy-system path.
- Record-keeping and audit trails sized to what the obligation actually requires.
- A roadmap to the Annex III deadline for anything that will land in the high-risk category.
- Optional US module: Texas TRAIGA disclosure and NIST AI RMF alignment, Colorado preparation, California marking obligations.

## How it runs

### Week 1: Classification

Which systems, which obligations, which dates. Done with your counsel, not instead of them, so the technical work maps to a legal position someone will stand behind.

### Week 2: Controls

Disclosure, marking mechanics, and record-keeping built into the product path and verified against real output.

### Week 3: Evidence and roadmap

The evidence pack assembled, and the route to the December 2027 obligations laid out for whatever will land in Annex III.

## Reported experience

- 2 Aug 2026: Article 50 transparency obligations applicable
- 2 Dec 2026: End of the marking grace period for legacy systems
- 2 Dec 2027: Annex III high-risk obligations

## Evidence and limits

Drako deterministic controls (author-reported, reviewed 2026-09-22): The README distinguishes 80 Python rules and 17 additional TypeScript/JavaScript rules. Timings depend on the benchmark and are not a latency guarantee for an entire agent request. Repository code is not evidence of insurer acceptance.

[Source](https://github.com/drakolabs/drako/blob/23c9b64318043a09543c32c4e46070caf3ee530a/README.md)

[Agent controls: sample evidence dossier](https://nickcerutti.com/evidence/agent-controls-sample.md) — Synthetic scenario: inventory, permissions, test results and unresolved gaps.

## Questions

### Are you giving legal advice?

No — technical readiness only: the controls, the mechanics, and the evidence. The interpretation sits with counsel, and the work is built to slot straight into their legal position.

### The high-risk deadline moved. Does that mean we can wait?

The Annex III date moved to December 2027. Article 50 transparency did not — it has been applicable since 2 August 2026, and the marking grace period for legacy systems ends 2 December 2026. The deferred deadline is the one people talk about; the live one is the one that applies today.

### We are a US company. Does any of this matter?

If you sell into the EU, yes. Separately, the US state layer is live in its own right — Texas has been in force since January 2026, California's marking obligation landed in August 2026, and Colorado arrives January 2027. The deadline tracker on this site lists them with sources.

### How do we verify the dates you quote?

Every date on the tracker links to primary source — EUR-Lex, the state legislature, or the statute itself — and the tracker is re-checked monthly. Verify anything you plan around; the sources are one click away.

Technical readiness, not legal advice. Counsel determines which obligations apply.

## Contact

[Discuss this engagement](mailto:n@nickcerutti.com) · [Pricing and terms](https://nickcerutti.com/pricing)

Canonical page: https://nickcerutti.com/services/ai-act-article-50