=== Legalithm – EU AI Act Compliance ===
Contributors: legalithmteam, pedrammadani
Tags: eu ai act, ai transparency, ai disclosure, article 50, ai compliance
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.3.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

EU AI Act Article 50 for WordPress: disclose AI chatbots, label AI text, mark AI images, AI literacy, AI-tool detection. Free, local, no account.

== Description ==

The EU AI Act's transparency rules apply from 2 August 2026. If your website uses an AI chatbot, AI-generated content, or an AI assistant, Article 50 requires you to tell visitors clearly. This plugin adds that transparency to WordPress in minutes: disclose your chatbot, mark the AI images you publish, and record your AI literacy effort.

= What it does =

* **AI disclosure (Article 50).** Show a clear, accessible notice that visitors are interacting with AI or viewing AI-generated content. Four styles (banner, inline, badge, modal), with default copy in English, German, Italian, French, Dutch, and Spanish. Shortcode: `[legalithm_ai_act_disclosure]`.
* **AI literacy (Article 4).** A built-in staff AI-literacy checklist that records a dated completion, so you can show you have addressed the literacy obligation. Optional shortcode: `[legalithm_ai_act_literacy]`.
* **Mark AI-generated images (Article 50(2)).** A "Mark as AI-generated" action in your Media Library embeds an invisible watermark in the image itself, and in every generated size. Because it lives in the pixels rather than the metadata, the marking survives re-encoding, resizing and format conversion, the everyday redistribution that strips ordinary metadata and content credentials. An "AI marking" column shows at a glance which images carry it.
* **Label AI-generated text (Article 50(4)).** Declare, per post or page, whether content was AI-generated or AI-drafted and then reviewed by a human. The plugin renders a clear visitor-facing label and a machine-readable declaration, using the same IPTC provenance vocabulary as content credentials. Where you rely on the human-review exemption, it records **who** reviewed the content and **when**, so you can show the review actually happened. Works on posts, pages and any public post type, including WooCommerce products.
* **Automatic AI-tool detection.** Scan your site for known AI tools (chatbots, AI content plugins, AI assistants) and get a one-click suggestion to switch on the matching disclosure. You review and confirm; nothing visitor-facing is ever enabled behind your back.

= Why this plugin =

* **Runs entirely on your site.** No account, no signup, and no data is sent anywhere. Your content and visitor data never leave your server.
* **Fast and lightweight.** Detection runs on demand (or on an optional schedule) and caches the result. Nothing scans on every page load.
* **Free.** Disclosure, literacy, and detection are free and fully functional on their own.
* **Coexists cleanly.** Uses its own settings option (`legalithm_ai_act_settings`), so it will not clash with other tools.
* **You decide what is AI.** Marking and labelling are always explicit actions, never automatic. The plugin does not try to detect AI-written text, because detectors are unreliable and a false positive would be a false declaration. Only you know how your content was produced.

The AI-tools registry is a curated starter set (dozens of common chatbots and content tools), not an exhaustive catalog. Matches show why they fired, so you can sanity-check before enabling a notice.

= What it does not do =

This plugin covers the Article 50 and Article 4 transparency obligations. It does not determine your risk tier or cover high-risk duties such as technical documentation, a fundamental-rights impact assessment (FRIA), or EU database registration. To see which obligations apply to your AI, run the free assessment at https://www.legalithm.com/en/ai-act-assessment .

On image marking specifically, be clear about what the watermark is and is not. It gives you resilience against ordinary redistribution: it survives lossy re-encoding, up- and down-scaling, greyscale conversion, and format changes. It is defeated by heavy cropping and by rotation, and it is **not** proof against a determined attacker, since generative regeneration can remove pixel-level watermarks. It is a transparency measure, not a provenance guarantee. The plugin also cannot sign C2PA content credentials, which need native libraries that typical WordPress hosting does not provide; if you need that layer too, the free Legalithm command-line tool adds it and reads the same watermark this plugin writes.

On text labelling, two things are yours to judge, not the plugin's. Whether your content is "on a matter of public interest" (which is what Article 50(4) turns on) is your call. And the review record shows that a review was recorded, not that it was thorough; the exemption depends on the review being meaningful and on someone holding editorial responsibility.

**Important:** This plugin helps you implement common AI Act transparency measures. It is a technical tool, not legal advice, and it does not guarantee compliance. For your specific obligations, consult a qualified professional.

== External services ==

This plugin does not use, connect to, or send any data to external or third-party services. Everything runs locally on your WordPress site:

* The AI disclosure notice and AI literacy checklist render from bundled, local settings and copy.
* AI detection compares a local, bundled list of known AI-tool "fingerprints" (plugin slugs and script hostnames) against your site's own installed plugins and already-enqueued scripts. Hostnames such as `generativelanguage.googleapis.com`, `widget.intercom.io`, or `embed.tawk.to` appear only as text to match against; the plugin never contacts them, makes no HTTP requests, and loads no remote files.

The only outbound link in the plugin is an optional, clearly labelled link in the admin screens that opens the free assessment at https://www.legalithm.com/en/ai-act-assessment in a new browser tab. It is a plain link (no data is sent, no API is called) that the site owner may choose to click.

== Installation ==

1. Install via Plugins → Add New → Upload Plugin, or upload the `legalithm-ai-act` folder to `/wp-content/plugins/`.
2. Activate the plugin through the Plugins screen.
3. Open **AI Act → AI Detection** and run a scan, or **AI Act → AI Disclosure** to configure the notice manually.
4. Choose a style and language, then enable the visitor notice.

== Frequently Asked Questions ==

= Do I need this? =

If your site shows an AI chatbot, AI-generated text or images, or an AI assistant to visitors in the EU, Article 50 of the EU AI Act requires you to disclose it. This plugin adds that disclosure.

= Does it send any of my data to a third party? =

No. Everything runs locally on your WordPress site. There is no account, no external API call, and no data leaves your server.

= Will it slow down my site? =

No. The AI-tool scan runs only when you trigger it (or on an optional schedule) and the result is cached. Nothing scans on every page load.

= Is it really free? =

Yes. The Article 50 disclosure, the Article 4 literacy checklist, and AI detection are free and work on their own.

= How do I mark an AI-generated image? =

Open the Media Library in list view, find the image, and choose "Mark as AI-generated". The plugin watermarks the original and every generated size, so whichever one your theme serves carries the mark. The "AI marking" column shows which images are already done. There is no bulk "mark everything" option on purpose: only you know which images are AI-generated.

= Will marking change how my image looks? =

Barely. The watermark shifts each pixel by about 1.6% of the brightness range, which is imperceptible on photographs and AI artwork. On very large, smooth gradients you may be able to see faint blocking if you look for it. That small shift is what lets the mark survive compression.

= Does the marking survive if someone re-saves or resizes my image? =

Yes, that is the point of it. The mark lives in the pixels, not the metadata, so it survives lossy re-encoding, resizing, greyscale conversion and format changes, all of which strip normal metadata. Heavy cropping and rotation do defeat it, and it is not designed to withstand a deliberate attack.

= Can I mark the same image twice? =

You can run the action again safely; the plugin detects an existing mark and leaves the image alone rather than stacking a second watermark on top of it.

= How do I label an AI-written post? =

Edit the post and use the "AI Act transparency" panel in the sidebar. Choose "AI-generated", or "AI-drafted, reviewed by a human" and name the reviewer. The label then appears for visitors and a machine-readable declaration is added to the page. An "AI" column in the posts list shows which content is declared.

= Do I have to label every AI-written page? =

No. Article 50(4) is about AI-generated text on matters of public interest, which is narrower than everything a model helped write. A product description is unlikely to qualify; an article on health, money or politics probably does. The plugin leaves that judgement to you rather than guessing.

= What if a human edited the AI draft? =

Then the disclosure duty generally falls away, provided the review was meaningful and someone holds editorial responsibility. Choose "AI-drafted, reviewed by a human" and the plugin records who reviewed it and when. That record is the point: months later you can show the review happened. By default the plugin still shows a label in this case, which is not required but reads as confident; you can turn that off in the settings.

= Does the plugin detect AI-written text automatically? =

No, deliberately. AI-text detectors are unreliable, and a false positive would make you declare something untrue. You declare it; the plugin renders and records it.

= Does detection turn on the visitor notice automatically? =

No. Detection only suggests settings. Enabling the Article 50 notice always requires an explicit admin action.

= Does installing this make me compliant with the EU AI Act? =

No plugin can do that. This helps you implement the transparency measures Article 50 asks for. It is not legal advice and does not guarantee compliance.

== Screenshots ==

1. Your Transparency Readiness score: what to fix, and what lies beyond this plugin.
2. The AI disclosure notice as visitors see it (badge style).
3. Choosing a disclosure style and language in the admin.
4. AI detection results, showing which tools were found and why.
5. The Article 4 AI literacy checklist with a dated completion record.

== Changelog ==

= 1.3.0 =
* New: label AI-generated text (Article 50(4)). Declare per post, page or custom post type whether content was AI-generated, or AI-drafted and reviewed by a human.
* New: where you rely on the human-review exemption, the plugin records who reviewed the content and when, so the exemption is something you can evidence rather than just assert.
* New: machine-readable provenance in JSON-LD, using the same IPTC digital source type vocabulary as C2PA content credentials, so your text and your images describe provenance consistently.
* Labels render on singular views and in feeds, in the same six languages as the disclosure notice.
* The plugin does not attempt to detect AI-written text. Detectors are unreliable and a false positive would be a false declaration.

= 1.2.0 =
* New: mark AI-generated images (Article 50(2)). A "Mark as AI-generated" action in the Media Library embeds an invisible watermark in the image itself, and in every generated size, so the marking survives re-encoding, resizing and format conversion that strip ordinary metadata.
* New: an "AI marking" column in the Media Library showing which images carry the mark.
* Marking is always explicit, never automatic. Only you know which images are AI-generated, and marking a human photograph as AI-generated would be a false declaration.
* The watermark is cross-readable with the free Legalithm CLI, so the same mark can be verified outside WordPress.
* Honest limit: this is resilience against ordinary redistribution, not proof against a determined attacker. Heavy cropping and rotation defeat it.

= 1.1.0 =
* New: Transparency Readiness score. One local, private score for the Article 50 and Article 4 duties this plugin covers, with the gaps you can fix and a clear note on what lies beyond transparency.

= 1.0.0 =
* Initial standalone release: Article 50 AI disclosure (4 styles, 6 languages), Article 4 AI literacy checklist, and local AI-tool detection.

== Upgrade Notice ==

= 1.3.0 =
Adds Article 50(4) labelling for AI-written posts and pages, with a dated record of who reviewed the content.

= 1.2.0 =
Adds Article 50(2) marking for AI-generated images, with an invisible watermark that survives redistribution.

= 1.1.0 =
Adds a Transparency Readiness score for your Article 50 and Article 4 duties.

= 1.0.0 =
First public release.
