Check whether the images and audio leaving your pipeline actually carry provenance marking — and keep dated, tamper-evident proof that you checked.
Open source, MIT. No account, no sign-up, no dependencies.
One command against your own files. Below is the real output of the command, copied from a terminal — not a mockup, not a rendering.
$ npx ai-act-verify sample-with-manifest.png sample-without-manifest.png sample-with-manifest.png (PNG, 418.1 KB) C2PA manifest PRESENT — PNG 'caBX' chunk manifest size 18.0 KB XMP present validation NOT PERFORMED — presence is not validity sample-without-manifest.png (PNG, 287.1 KB) C2PA manifest ABSENT XMP absent Summary 1 with a manifest · 1 without This tool detects whether a manifest is present, not whether it is valid: signature, trust chain and integrity are not verified. A manifest present does not prove compliance with Article 50 of the EU AI Act, and its absence does not prove a breach: the Commission Guidelines place several kinds of output outside the marking obligation. Technical tool, not legal advice.
Verbatim terminal output, including the disclaimer the tool prints itself. Everything in this section exists and runs today.
npx github:lucapersichini/ai-act-verify ./your-image.png
Publishing to npm shortly — until then this runs it straight from the source repository.
JPEG, PNG, WebP, WAV, MP4/MOV/HEIC/AVIF, MP3, SVG. Anything else returns UNSUPPORTED rather than a guess.
--json for scripts, --strict to fail a build when an asset ships unmarked.
There is no VALID status, and a test enforces that. Presence is never reported as validity.
The checker answers a question once. The product below keeps the answer — dated, ordered and hard to alter. It does not exist yet.
Scroll sideways to see the full illustration →
This is an illustration, not a screenshot. Nothing above is clickable, nothing is connected to anything, and no such dashboard exists today. It shows where we intend to go: an append-only evidence log of every check, a policy engine that evaluates each output on its own — including telling you when no obligation applies — and a record you can still read a year from now.
Append-only, hash-chained records of what was checked and when. Hashes only — never your prompts or outputs.
Per-output evaluation, versioned against the Commission Guidelines, so a rule change does not mean a code change.
SDK wrapper and HTTP middleware, so the check happens where you already ship — not in a separate console.
The checker stays free and open source. The evidence layer is what we intend to charge for.
Not billable yet — nothing is charged today, and no payment details are collected anywhere on this site.
Register your interest and we'll come back to you personally when early access opens.
Six questions. The free-text one is the one we read first.