Skip to content

Show the AI notice. Keep the record.

Two web components show the AI-interaction notice and visible AI labels in the wording and at the moment each jurisdiction's rule describes. Every time one is shown, applied or acknowledged, an event lands in your account's tamper-evident log.

Get an API keyBook a demo
<op-ai-notice jurisdiction="EU">Draft text · legal review

You are chatting with an AI system.

Rule eu.art50.1.ai-interaction · shown at the first interaction

POST /v1/disclosures/events · 201 receipt

{
  "event_id": "dse_q4r7m2k9x3b5n8tw",
  "sequence": 1842,
  "prev_hash": "sha256:9c1e…7a40",
  "hash": "sha256:4b02…e19d",
  "received_at": "2026-10-19T09:20:00.000000Z"
}

Each event carries the hash of the one before it, so the log is tamper-evident (hash-chained). It is not signed.

Four parts. One policy behind them.

Drop in the components. The events log themselves.

The components need a publishable key: an ordinary API key whose only permission is to append disclosure events, so it is safe in a web page. Your server reads and exports the log with a full key.

Coming soon · Not published yet: use the REST API today.

<!-- Import once in your site's bundle:
     import "@originalpictures/disclosure";        -->

<!-- A chatbot: the first-interaction notice for the visitor's jurisdiction -->
<op-ai-notice jurisdiction="EU"></op-ai-notice>

<!-- A generated image: offer a visible label -->
<op-ai-label badge="ai-generated" variant="brand-dark"></op-ai-label>

Jurisdictions in the policy

The policy document (op.disclosure-policy.2026-10.v1) covers these rules. Every rule text in it is a draft for owner and legal review, marked needs_legal_review, and the citations are being checked against the statute text.

JurisdictionInstruments in the policy (draft citations)
European UnionAI Act (Regulation (EU) 2024/1689) Art. 50(1), (2), (4) and (5)
CaliforniaSB 942 AI Transparency Act as amended by AB 853 (visible-label option); SB 1001 bot disclosure
MaineLD 1727 (2025), AI chatbot disclosure
New HampshireHB 1596 (2024), synthetic media in political advertising
New YorkGBL Art. 47 (2025), AI companion models; synthetic-performer advertising disclosure (2025)
UtahSB 149 (2024) AI Policy Act; SB 226 (2025)
IndiaIT (Intermediary Guidelines) Rules, synthetically generated information
ChinaMeasures for Labeling AI-Generated Synthetic Content (2025); GB 45438-2025
Republic of KoreaFramework Act on AI (2025), Art. 31

What the log records, and what it does not

Each event records its kind (notice shown, label offered, label applied, acknowledged), the jurisdiction, the policy version and rule, a reference to the person and the content, the client's time and the server's time. The references are pseudonymous: use your own visitor or session id, never an email address or a name.

The log is tamper-evident because each event carries the hash of the one before it. It is not signed: the record shows that nothing in the chain was changed after the fact, not who wrote it.

What it does not do

Showing a notice or a label does not by itself satisfy any law. Whether a rule applies to you, and whether your notice is clear and timely enough, depends on your product and your counsel's reading of the rule.

Original Pictures shows where content came from and whether it has changed since it was signed. It does not prove that a depicted event is true. Using it supports your work on the EU AI Act, the California AI Transparency Act and other AI labeling rules, and it is not by itself legal compliance with any of them. Nothing on this site is legal advice.

AI disclosure questions

Is the evidence log signed?

No. It is tamper-evident (hash-chained): every event includes the hash of the previous one, so a changed or removed event breaks the chain when you check an export. It is not a digital signature.

Does showing the notice satisfy the EU AI Act?

Not by itself. The components show draft rule text in the form and at the time the policy describes, and record that they did. Whether that is enough for your system is a legal question for your counsel. Nothing on this site is legal advice.

Is the publishable key safe to put in a web page?

It can do one thing: append disclosure events to your log. It cannot sign, read files or read the log. Set a rate limit on it in the console.

Does the log hold personal data?

Only what you put in the references. They accept letters, digits and a few separators, and are meant for pseudonymous ids such as a session or visitor id. Never send an email address or a name.

Can I use it without the components?

Yes. POST /v1/disclosures/events takes the same event from your server, and GET /v1/disclosures/policies returns the rule text to render yourself.

Show the notice and keep the record

Create an API key, issue a publishable key for your site and add the components. Book a demo to walk through the rules you track with your team.

Get an API keyBook a demo