Skip to main content
Audact
See the offer

API · Article 50 Attestation

The disclosure, and where in the call it happened.

Public API host: In development

POST https://api.audact.ai/v1/attestation

The public API host. The code examples document the intended interface and the endpoints used within the current product.

No public API is served on this host yet, apart from the published Merkle roots at /v1/metachain. The endpoints used inside the product are not the same thing as a public API.

Why this status
Claim
In development · By application
Scope
The public API host. The code examples document the intended interface and the endpoints used within the current product.
Ground
No public API is served on this host yet, apart from the published Merkle roots at /v1/metachain. The endpoints used inside the product are not the same thing as a public API.
What it does not establish
That any individual endpoint works today. That is confirmed per endpoint, and the confirmation is open.
What you can get today
Production access sits inside an applicable paid agreement. Endpoints are not priced separately.
Last checked
5 October 2026
Where to check it
/apis

Article 50 Attestation: In controlled testing

One call records that the person was told they are speaking to an AI: which wording, in which jurisdiction, at which point in the conversation. You get back a receipt with the hash of the disclosure, its Merkle inclusion path, and the link to the receipt before it. The duty is to disclose; this endpoint is about being able to show that you did.

POST /v1/attestation

curl -X POST https://api.audact.ai/v1/attestation \
  -H "Authorization: Bearer $AUDACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "interaction_id": "call_8h2k9d7",
    "modality": "voice",
    "article_50_clause": "1",
    "disclosure_method": "spoken_intro",
    "agent_identity": "ai_agent_v3",
    "jurisdiction": "DE",
    "subject_hash": "sha256:e3b0c44..."
  }'

Digest only — no readable content

200 OK · compliance receipt

{
  "event_id": "550e8400-e29b-41d4-a716-446655440000",
  "receipts": [
    {
      "event_id": "c8e04f3a-2b71-4d9e-8a6c-1234567890ab",
      "sequence": 1,
      "turn": 1,
      "verdict": "MODIFY",
      "input_hash": "9b1d…e04a",
      "output_hash": "a3f7…c12b",
      "auth_mechanism": "hmac-sha256",
      "signature": "ba7816…",
      "receipt_format_version": "1.0.0",
      "verifiability": "verifiable"
    }
  ],
  "evidence_chain": {
    "head_hash": "0b8e…7a13"
  },
  "merkle_proof": {
    "status": "pending",
    "merkle_root": "0x4a7d1ed414..."
  },
  "tsa_timestamp": {
    "status": "included",
    "timestamp_token": "MIIE…(base64 DER, truncated)",
    "tsa_url": "https://freetsa.org/tsr",
    "covers": "merkle_root"
  },
  "auth_mechanism": "hmac-sha256",
  "signature": "ba7816bf8f01cfea..."
}

receipts[] carries the full ReceiptRef: event_id, sequence, turn, verdict, input_hash and output_hash (recomputable without a key), auth_mechanism, signature, receipt_format_version and verifiability. merkle_proof carries the inclusion proof (`event_inclusion_proof`, `cross_tenant_proof`, `merkle_root`); `POST /v1/verify-inclusion` checks a branch proof without a key, and the published root is at api.audact.ai/v1/metachain. auth_mechanism is hmac-sha256 under a symmetric key held by Audact — not a digital signature and there is no public verification key. tsa_timestamp carries an RFC 3161 token from freeTSA.org, a free public service and not an eIDAS-qualified trust service. Public verifier not available yet.

What the law requires

A person interacting with an AI system must be informed of that, unless it is obvious from the circumstances and the context of use.
Regulation (EU) 2024/1689, Art. 50(1), applicable since 2 August 2026
The information must be given at the latest at the first interaction or exposure, clearly and distinguishably.
Regulation (EU) 2024/1689, Art. 50(5)
Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format, detectable as artificially generated.
Regulation (EU) 2024/1689, Art. 50(2)
A full provenance chain is not mandatory. The Commission guidelines say so explicitly.
Commission guidelines C(2026)5054 of 20 July 2026, point (73)
Systems placed on the market before 2 August 2026 only have to satisfy Art. 50(2) from 2 December 2026.
Digital Omnibus (EU) 2026/1744, in force 27 July 2026, inserting Art. 111(4)

What this endpoint does

Records the disclosure with its wording hash and its position in the call.
In controlled testing
Merkle inclusion path and chain link returned in the same response.
In controlled testing
Per-jurisdiction wording, because the national layer on top of Article 50 differs.
Germany: national policy layer active. Netherlands: in development. Belgium and Austria: planned.
Machine-readable marking of synthetic audio under Art. 50(2). It would be part of a later release; no date has been established and it is not in the product today.
Planned
A public receipt verifier.
Not available yet

Where to call it

Once at the start, and again wherever the conversation turns.

The minimum is one attestation at first interaction, which is what Art. 50(5) asks for. In practice a second one earns its keep at each turn that changes the nature of the call: a hand-off, a new topic, a moment where a caller could reasonably have forgotten. The receipts chain, so a later reader sees the sequence and not just the first entry.

  • Voice agents: inbound and outbound, at session start and per significant turn.
  • Chat widgets: every AI-generated message carries its own receipt.
  • Synthetic-voice walkthroughs: the disclosure is covered here; the Art. 50(2) marking is not in the product today.

Honest about the mechanism

What a third party can recompute, and what they cannot.

Three fields on the receipt are recomputable by anyone today, without a key and without an account: the hash of what went in, the hash of what came out, and the link to the previous receipt. The fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report. Recomputing the three makes any later change or reordering detectable, against the stored commitment.

The authentication code is HMAC-SHA256 under a symmetric key held by Audact. It is real cryptographic authentication and it is not a signature: whoever can verify it can also produce it. That is why this page describes what the chain shows rather than what a signature would prove.

Questions

Does Article 50 require evidence that the disclosure happened?
No. The Article requires the disclosure. Whether you can show that it happened becomes relevant only when someone asks: a client, a regulator, a court. That is what a compliance receipt is for: one per governed interaction, three fields of which anyone can recompute without a key — no account, no access to our database. See a receipt field by field at /proof.
Does the timestamp come from a qualified trust service?
No. It is an RFC 3161 timestamp from freeTSA.org, a free public service. It fixes an ordering against our own chain; freeTSA.org is not an eIDAS-qualified trust service, so this is not a qualified timestamp and we do not present it as one.
What about the machine-readable marking under Art. 50(2)?
It is not in the product today and no date has been established. This endpoint covers the Art. 50(1) disclosure and records it; the marking obligation under 50(2) sits on the provider of the generating system.

Article 50 in the call, not in a document

The compliance page carries the full text of the duty, the guidance points that soften it, and the provider-versus-deployer question that decides which side of it an agency falls on.

Read the Article 50 page

Related