Legalithm – EU AI Act Compliance

The EU AI Act’s transparency rules apply from 2 August 2026. If your website uses an AI chatbot, AI-generated content, or an AI assistant, Article 50 requires you to tell visitors clearly. This plugin adds that transparency to WordPress in minutes: disclose your chatbot, mark the AI images you publish, and record your AI literacy effort.

What it does

• AI disclosure (Article 50). Show a clear, accessible notice that visitors are interacting with AI or viewing AI-generated content. Four styles (banner, inline, badge, modal), with default copy in English, German, Italian, French, Dutch, and Spanish. Shortcode: [legalithm_ai_act_disclosure].
• AI literacy (Article 4). A built-in staff AI-literacy checklist that records a dated completion, so you can show you have addressed the literacy obligation. Optional shortcode: [legalithm_ai_act_literacy].
• Mark AI-generated images (Article 50(2)). A “Mark as AI-generated” action in your Media Library embeds an invisible watermark in the image itself, and in every generated size. Because it lives in the pixels rather than the metadata, the marking survives re-encoding, resizing and format conversion, the everyday redistribution that strips ordinary metadata and content credentials. An “AI marking” column shows at a glance which images carry it.
• Label AI-generated text (Article 50(4)). Declare, per post or page, whether content was AI-generated or AI-drafted and then reviewed by a human. The plugin renders a clear visitor-facing label and a machine-readable declaration, using the same IPTC provenance vocabulary as content credentials. Where you rely on the human-review exemption, it records who reviewed the content and when, so you can show the review actually happened. Works on posts, pages and any public post type, including WooCommerce products.
• Automatic AI-tool detection. Scan your site for known AI tools (chatbots, AI content plugins, AI assistants) and get a one-click suggestion to switch on the matching disclosure. You review and confirm; nothing visitor-facing is ever enabled behind your back.

Why this plugin

• Runs entirely on your site. No account, no signup, and no data is sent anywhere. Your content and visitor data never leave your server.
• Fast and lightweight. Detection runs on demand (or on an optional schedule) and caches the result. Nothing scans on every page load.
• Free. Disclosure, literacy, and detection are free and fully functional on their own.
• Coexists cleanly. Uses its own settings option (legalithm_ai_act_settings), so it will not clash with other tools.
• You decide what is AI. Marking and labelling are always explicit actions, never automatic. The plugin does not try to detect AI-written text, because detectors are unreliable and a false positive would be a false declaration. Only you know how your content was produced.

The AI-tools registry is a curated starter set (dozens of common chatbots and content tools), not an exhaustive catalog. Matches show why they fired, so you can sanity-check before enabling a notice.

What it does not do

This plugin covers the Article 50 and Article 4 transparency obligations. It does not determine your risk tier or cover high-risk duties such as technical documentation, a fundamental-rights impact assessment (FRIA), or EU database registration. To see which obligations apply to your AI, run the free assessment at https://www.legalithm.com/en/ai-act-assessment .

On image marking specifically, be clear about what the watermark is and is not. It gives you resilience against ordinary redistribution: it survives lossy re-encoding, up- and down-scaling, greyscale conversion, and format changes. It is defeated by heavy cropping and by rotation, and it is not proof against a determined attacker, since generative regeneration can remove pixel-level watermarks. It is a transparency measure, not a provenance guarantee. The plugin also cannot sign C2PA content credentials, which need native libraries that typical WordPress hosting does not provide; if you need that layer too, the free Legalithm command-line tool adds it and reads the same watermark this plugin writes.

On text labelling, two things are yours to judge, not the plugin’s. Whether your content is “on a matter of public interest” (which is what Article 50(4) turns on) is your call. And the review record shows that a review was recorded, not that it was thorough; the exemption depends on the review being meaningful and on someone holding editorial responsibility.

Important: This plugin helps you implement common AI Act transparency measures. It is a technical tool, not legal advice, and it does not guarantee compliance. For your specific obligations, consult a qualified professional.

External services

This plugin does not use, connect to, or send any data to external or third-party services. Everything runs locally on your WordPress site:

• The AI disclosure notice and AI literacy checklist render from bundled, local settings and copy.
• AI detection compares a local, bundled list of known AI-tool “fingerprints” (plugin slugs and script hostnames) against your site’s own installed plugins and already-enqueued scripts. Hostnames such as generativelanguage.googleapis.com, widget.intercom.io, or embed.tawk.to appear only as text to match against; the plugin never contacts them, makes no HTTP requests, and loads no remote files.

The only outbound link in the plugin is an optional, clearly labelled link in the admin screens that opens the free assessment at https://www.legalithm.com/en/ai-act-assessment in a new browser tab. It is a plain link (no data is sent, no API is called) that the site owner may choose to click.