The EU AI Act applies to your local build. You don’t like watermarks. Try Sentinel.
SentinelFor local models · an alternative to watermarks · Regulation (EU) 2024/1689
Built for the person running a model on their own machine.
Labs with a legal department will use this or they won’t. That is not the market. If you are in Europe with a local build, a laptop, and no OneTrust budget — this is the record you can actually keep. Sign a sidecar. Hash the prompt. Don’t stain the work.
A public-interest project from @Nefarious_Trey. Open source for local builders. Not an xAI product, not an EU seal.
How to use this
Four steps. Then you have a record.
1
Open the workspace
A demo file loads so you are not staring at a blank page. Or start empty from Systems.
2
Hash a prompt
Ingest → paste the prompt → add hashed receipt. The words never stay. Only sha256.
3
Sign an output
Attest → pick the duty → paste the output → Sign. Download the JSON sidecar.
4
Verify it
Open Verify. Drop the file. Tamper the text. Watch a fake fail. That is the whole trick.
Public notice
“This is AI.” Not which model.
Art. 50 needs people to know they are talking to a system, or that content is synthetic. The model name stays in the operator’s ledger. Users are told the truth without a brand stamp.
Signature
A fake file fails
Each attestation is signed with the operator’s key (Ed25519, or P-256 if the browser has no Ed25519). Edit a field, or hash your own JSON, and Verify rejects it. A hash-only file is not a signature.
Private ledger
The prompt never has to leave the box
Art. 12 logs are hash-chained receipts: system, version, hashes of input and output, whether a human was in the loop. A laptop in a flat and a frontier API can emit the same shape. The laptop is who this was built for.
Who this is for
Local first. Big companies optional.
If you run Ollama, llama.cpp, a fine-tune in the spare room, or a small studio model — you are the user. Ingest a hashed receipt. Issue a notice that does not name the weights. Keep the file on the same machine. That is the product.
Building a SaaS agent, a support bot, or a startup on a local model or an API? Same door. Your users are talking to a system. Art. 50 wants them told. You do not have to watermark their tickets, their docs, or their chat. Sign the turn. Hash the prompt. Keep the model name in your ledger.
A large lab can read the spec and rebuild it inside their API. They do not need this website. People without a compliance team do — including agent startups. Watermark vendors sell to the first group. Sentinel is for the second.
Not a certificate. Not “buy this and you are legal.” A working record, open, so a local builder in the Union has something to do besides ignore the Act or stain their users’ files.
Honest answer
Yes — this respects sovereignty better than a watermark. With limits.
A watermark writes into the user’s artifact. It treats remix as laundering. It degrades the work, fails on text, and still does not name who attested it. When it is stripped, the file looks human. That is the worst of both worlds: invasive when present, lying when gone.
Sentinel does not touch the bytes of the work. The claim sits next to it — sidecar, header, or a sentence the person can read. The user can delete the sidecar. Then the content is unlabeled, not secretly marked. That is their choice, not a stain they cannot wash. The model does not have to upload the prompt. The operator holds the key, not a watermark vendor.
A Google-only watermark — or any mark only the vendor can see or “prove” — is not Article 50. The Act asks for a machine-readable mark others can detect, not a private decoder. Sentinel is an alternative: public key, public hash, public time, on a file anyone can check. If they do not attach it, that is their lack of use. Tamper is tamper. Sentinel does not fail because someone skipped it.
What it does not do: it cannot force a platform to check signatures. Crypto is not a law. A valid signature proves “this key attested these bytes.” It does not prove the content is true, or the only copy. Keys in this browser are not an HSM — export them. Art. 50 is still a duty to mark; Sentinel is one way to mark, not a waiver.
So: better for user sovereignty, better for local and lab sovereignty, honest about the remaining social contract. Platforms that care can require a valid Sentinel signature the way they require HTTPS. That is policy. The file itself stays clean.
What Verify actually checks
A hash is not a signature. Here is what each attack does.
| Attack | Result |
|---|---|
| Edit a signed file | Fails. Signature no longer matches. |
| Mint a hash-only “integrity” JSON | Fails. Unsigned is unlabeled, not valid. |
| Drop the sidecar (“wash”) | Content has no attestation. That is a signal only if someone checks. |
| Sign a lie with your own key | Succeeds as a signature — it is your lie. Identity, not truth. |
| Rewrite your private ledger after the fact | The hash chain tip breaks in the operator workspace. |
The rest of the Act is still here
Marking is one article. Companies are also scrambling for inventories, risk files, and logs. The workspace ships those too, mapped to the public text of the regulation.
Classify against Arts. 5, 6, 50, 51
Prohibited practices, Annex III, the Art. 6(3) exceptions, GPAI compute. Every result cites the article.
Art. 12 ledger
Hash-chained events. Six-month floor. Inputs stored as hashes. Import receipts from local nodes.
Annex IV and Art. 9
Technical documentation, risk register, human-oversight notes, incident file, auditor brief.
GPAI desk
Copyright policy, training summary, downstream pack, systemic-risk extras. Open weights below 10²⁵ FLOPs sit here.