GPAI Transparency Obligations

What Art 50 + Art 52 Require

Articles 50 and 52 of the EU AI Act establish two overlapping but distinct transparency regimes:

• Article 50 — Providers and Deployers of Certain AI Systems require transparency obligations: AI systems intended to interact directly with natural persons must disclose that they are AI; emotion-recognition or biometric-categorisation must inform exposed persons; deepfake content must be marked; AI-generated content must be marked in a machine-readable way; and providers must design for detectability.
• Article 52 — Provider Obligations for General-Purpose AI (GPAI) requires the technical documentation needed for downstream providers to comply; public summary of training content per template; copyright-compliance policy; and for "systemic-risk" GPAI models: model evaluation, adversarial testing, serious-incident reporting, and cybersecurity protection.

DEFONEOS is a sovereign AI substrate that includes GPAI capabilities (the MEOK brain, the SOV3 BFT council, the SIGIL chain, and various MCPs that wrap open-source general-purpose LLMs). The substrate therefore has both kinds of obligations: as a deployer of AI systems that interact with persons, and as a provider of a GPAI model/scaffold to downstream providers.

This page documents the 8 transparency pillars, 10 disclosure categories, 7 content-marking modes, and the EU database registration process that DEFONEOS implements to comply with both articles.

Mode 1 — Text Watermark (Stat. model + structural)

DEFONEOS text outputs carry a two-layer watermark: a statistical-model watermark (token distribution signature trained with low false-positive rate) and a structural fingerprint (sentence-turn-taking patterns + paragraph cadence that is detectable). Watermark is robust to paraphrase and translation.

Mode 2 — Image Watermark (C2PA + pixel-level)

Image outputs include a C2PA cryptographic manifest embedded in the file metadata + a pixel-level watermark in the visual band (resilient to compression, crop, and re-encoding). The manifest references the producer (CSOAI LTD), the substrate version, the SIGIL hash, and the policy URL.

Mode 3 — Audio Watermark (acoustic + metadata)

Audio outputs include a C2PA manifest + an inaudible acoustic watermark in the 17-19 kHz band (detectable by automated systems, inaudible to humans). The watermark survives MP3 compression, sample-rate downsampling, and ambient recording.

Mode 4 — Video Watermark (per-frame + manifest)

Video outputs include a C2PA manifest + a per-frame hash signature + an embedded visible label ("AI-generated" overlay) per Article 50(4) for synthetic-likeness content. The per-frame hash chain is verifiable against the SIGIL chain.

Mode 5 — Code Watermark (file-level + SIGIL)

Generated code includes a header comment block with the producer, version, SIGIL hash, and a per-line structural fingerprint. This allows detected downstream usage to be auditable.

Mode 6 — Structured Data Watermark (SIGIL + manifest)

Structured outputs (JSON, CSV, databases) include a SIGIL manifest in a defined schema field + a hash-of-the-data field. The manifest references the producer, version, timestamp, and downstream license terms.

Mode 7 — Decision/Action Watermark (SIGIL log + audit trail)

Decisions and actions (target nomination, policy change, BFT vote, kill-switch) include the entire SIGIL chain entry. Downstream audit can verify the decision was sovereign-actuated, who approved it, and what the red-line check produced.

Registration Process

Per Article 71 of the EU AI Act, all GPAI providers must register in the EU database before placing the model on the market. DEFONEOS registers:

• Provider identification — CSOAI LTD UK 16939677, full legal address, contact for compliance
• GPAI model identification — name (DEFONEOS Substrate v4.x), version, intended purpose, capabilities, limitations
• Systemic-risk classification (if applicable) — per Article 51, GPAI models above 10^25 FLOPs of training compute are presumed systemic-risk; DEFONEOS publishes whether the substrate falls above or below this threshold, the training-compute accounting, and the downstream systemic-risk evaluation results
• Public summary of training data — per Article 53(1)(b), linked to the publicly-hosted summary
• Copyright-compliance policy — per Article 53(1)(c), linked to the publicly-hosted policy
• Provider contact for compliance — designated responsible person, with redacted contact in public view

Registration SLA

The registration is submitted within 14 days of placing the model on the market (the formal SLA from EU Implementing Regulation 2024/...). Subsequent updates (material change in training data, capabilities, or version) trigger update submissions. Each submission is SIGIL-signed and the registration record carries the SIGIL hash for tamper-evidence.

What Downstream Providers Receive

Downstream providers integrating DEFONEOS capabilities receive:

• Integration pack — comprehensive technical documentation covering all capabilities, intended uses, integration patterns, and contra-indications
• Signed SDK release notes — Ed25519-signed version-by-version changelog with capability deltas and risk-impact notes
• Capability & limitations matrix — public matrix listing what the substrate can and cannot do (with evidence)
• Risk & evaluation summary — high-level summary of evaluation results, red-team findings, residual risks
• Stop-deployment triggers — explicit triggers under which downstream providers should suspend use (serious incident, red-line trigger, regulatory direction)
• Joint compliance pathway — for downstream providers building high-risk AI systems on top of DEFONEOS, a structured pathway showing what DEFONEOS covers and what the downstream provider must add