The regulatory record
Ten obligations across the European Union and California. Each one carries the instrument, the article that fixes the date, the penalty tier where the text sets one, and a link to the law itself. If you cannot reach our conclusion from the source we link, that is a defect and we want to hear about it.
Reading the register…
The bytes your browser received are the bytes Lunara signed.
Verifying the Ed25519 signature on corpus/obligations.json in your browser.
The record
Absence from this table is not a statement that nothing applies to you. It is a short list that is right rather than a long one that is mostly right.
Showing all 10 obligations.
Unacceptable-risk systems banned outright. Staff operating AI must be demonstrably competent to do so. Two further prohibitions were added later and do not run from this date — see eu-prohibitions-synthetic, which applies from 2 December 2026.
Model documentation, training-data summaries and copyright policy. The penalty regime becomes enforceable.
Generative systems with over one million monthly users must embed latent disclosure in what they generate, offer a manifest disclosure, and publish a free detection tool.
AI systems must disclose that they are AI. Synthetic content must be marked machine-readable.
Generative systems placed on the market before 2 August 2026 were given four months of relief from the machine-readable marking duty. That relief expires and marking becomes mandatory. Systems placed on the market on or after 2 August 2026 never had it.
Placing on the market, putting into service or using an AI system that generates or manipulates intimate imagery of an identifiable person without their explicit consent, or child sexual abuse material, is prohibited outright. A general-purpose generator is caught where such output is a reasonably foreseeable and reproducible outcome without significant modification and adequate safeguards are absent; a deployer is caught where they use the system for that purpose.
Platforms hosting generative systems, and large online platforms distributing their output, take on their own disclosure and provenance duties.
Models already on the market before August 2025 lose their grace period and must comply in full.
Risk management, data governance, logging, human oversight and conformity assessment for listed high-risk uses. Deferred, not cancelled.
AI acting as a safety component of a regulated product falls under the full high-risk regime.
corpus/obligations.json · version 1.0.0 · 10 entries · generated from the signed corpus
How to read it
For machines
Everything above is a rendering of one signed JSON file. Nothing here is behind an account, a key or a rate limit, and it never will be. The reading is free, the certifying is what costs money.
One file, signed detached. The assertion beside it carries the digest and the Ed25519 signature over RFC 8785 canonical JSON.
curl -s https://lunarasociety.com/corpus/obligations.json curl -s https://lunarasociety.com/corpus/obligations.assertion.json curl -s https://lunarasociety.com/.well-known/keys.json
An MCP server answers questions against this corpus directly, so a model can cite the article rather than recall it.
lunara_effective_date when does this bind? lunara_article which article says so? lunara_check does it apply to me? lunara_source show me the instrument lunara_integrity prove this is unaltered
The record of being wrong
One of them is an obligation we missed for three days, a prohibition arriving on 2 December 2026 that carries the heaviest penalty in the Act. It is in the table above now because we went back and read the amending regulation end to end instead of trusting the founding one.
A compliance authority that has never issued a correction is either very lucky or not looking.