EU AI Act
MEOK-EUAIAC-MAIN
Art 4, 6, 9, 10, 14, 26(9), 43, 50, 72
9 in-scope Articles, all signed, all auditor-verifiable.
verify →
CSOAI
Initializing...
Free forever · No credit card
CSOAI
Initializing...
MEOK Attestations
MEOK signs its own compliance certificates with the same HMAC API customers buy. Every certificate has a verify_url any auditor can curl independently. We give you the public key. We give you the canonical message. We give you the signature. You decide whether to trust it.
All 8 frameworks below are signed and live. Click verify to audit the claim with curl. No login, no SDK, no API key.
9 in-scope Articles, all signed, all auditor-verifiable.
verify →Operational resilience for financial entities + ICT third-party risk.
verify →Aligned to 9 member-state transpositions (DE BSIG §8a, UK NIS Regs, NL Wbni, BE, FR, IE, IT, ES, DK).
verify →DPIA-ready evidence pack with FRIA bridge for high-risk AI.
verify →AI Management System controls mapped to EU AI Act + ISO 42005 impact assessment.
verify →Construction information management with NRSWA + CHAS + CPCS bridges.
verify →Cyber Resilience Act for products with digital elements.
verify →Trust service criteria with AI-specific control additions.
verify →HMAC-SHA256 is fast, online, and recoverable. It uses a shared secret (the customer's API key), so an auditor can recompute the signature in real time.
Ed25519 is asymmetric and offline-verifiable. The signing key never leaves MEOK; the verifying key is published at /publickey. An auditor can take the signed cert, the public key, and any offline Ed25519 lib (libsodium, age, tweetnacl) and verify the cert in 2 lines of Python — no MEOK infrastructure required.
Both signatures are over the same canonical JSON. If either fails, the cert is invalid. We do not ship signatures that depend on a single algorithm.
Every attestation carries a verify_url. curl it, e.g. curl -sS 'https://meok.ai/verify?cert=MEOK-EUAIAC-MAIN', and you get JSON with the signature, issued_at, issuer, and the Ed25519 public-key fingerprint. No login, no SDK, no API key required.
HMAC-SHA256 is fast, online, and recoverable — it uses the shared secret (the customer's API key) so an auditor can recompute it in real time. Ed25519 is asymmetric and offline-verifiable: the signing key never leaves MEOK and the verifying key is published at /publickey. Both signatures are over the same canonical JSON; if either fails, the cert is invalid.
Eight frameworks are signed and live: EU AI Act (9 in-scope Articles), DORA, NIS2 (aligned to 9 member-state transpositions), GDPR (DPIA-ready with FRIA bridge), ISO 42001 (AIMS), ISO 19650 (BIM), CRA, and SOC 2 with an AI overlay.
Yes. The response includes a base64 Ed25519 signature over the canonical JSON. Take the signed cert, the public key from /publickey, and any offline Ed25519 lib (libsodium, age, tweetnacl) and verify in two lines of Python — no MEOK infrastructure required. Signing keys rotate quarterly and rotation events are signed by the previous key, so you can verify continuity.
Read the full MEOK methodology (what we count, what we don't, our fail rules) or jump to the public key to start verifying offline.