Purpose and positioning ComplyEdge's core purpose is to intercept improper AI requests and responses, stopping them before they are implemented. It primarily targets prompt injection, leakage of personal data and API keys, and practices prohibited by Article 5 of the EU AI Act. Unlike conventional logging or security scoring, it provides legal clause citations when rules are triggered and records every decision. Officially, it is positioned as an enforcement layer between the application and the model: rules on the request path cannot be ignored by the model the way system prompts can.
Main capabilities First, bidirectional inspection of requests and responses: prompts are inspected before the AI sees them, and responses are inspected before the user sees them; intercepted prompts do not reach the model. Second, sensitive information interception: in European inspections, email addresses, phone numbers, IBANs, card numbers, national ID numbers of certain countries (Germany, France, Spain, the Netherlands, Italy), API keys, and private keys are intercepted before reaching the AI, and are also intercepted before responses containing such information reach the user; matching is based on format and checksums, so personal names and street addresses are not within the scope of interception. Third, evidence recording: every call produces a decision record containing the rule, timestamp, and text hash, with legal citations attached when a rule is triggered; records are stored outside the AI system and are available for export. Records store only the SHA-256 text hash, not the original prompt text. Fourth, audit export: CSV/JSON records can be exported and retained for 180 days; enterprise edition exports include a hash chain and proof of integrity.
How to use Officially described as adding one line above the function and setting the jurisdiction (such as EU), and the loaded rule corpus takes effect. It provides one package, requires no infrastructure, no containers, and is compatible with any Python AI framework; it provides Python and TypeScript SDKs, a CLI, and an MCP server (Apache 2.0). Example output shows intercepted messages accompanied by a rule identifier (such as rego-art5-1c-001) and a regulatory citation (Regulation (EU) 2024/1689, Article 5(1)(c)).
Applicable scenarios Suitable for companies using AI in the EU, and for teams that need to record rule application and present evidence to customers or auditors. Officially emphasizes that governance and GRC platforms handle system inventories and framework mapping, while ComplyEdge runs on the request path, can block prohibited requests, and writes records as a byproduct of decisions; most teams use both. The three parts of the EU AI Act that are already in effect (prohibited practices, GPAI obligations, transparency obligations) all have corresponding rules.
Limitations and gaps The official website does not provide specific performance benchmarks, a complete list of supported AI frameworks, record storage locations, legal validity guarantees, pricing details beyond free and paid plans, or the specific coverage of the rule corpus and custom rule capabilities; these facts are not currently provided. In terms of classification, it is officially defined as a runtime enforcement layer for AI agents and falls within the AI agent category.
