EU AI Act Compliance for Teams Using LLM APIs | TrustedRouter
The EU AI Act reaches full applicability August 2, 2026. What deployers building on LLM APIs need from their vendor: attestation, retention proof, EU routing.
Your EU AI Act compliance file depends on facts from your LLM API vendor, and attestation makes those facts checkable.
Full applicability of the EU AI Act arrives on August 2, 2026. Companies building on third-party LLM APIs mostly carry deployer obligations, while provider obligations sit upstream with the model makers, and the questions a reviewer asks a deployer start with facts only the API layer can supply: which model served each request, where the traffic ran, and what happened to the prompt afterward.
TrustedRouter is a routing layer in front of 220+ model routes across 30+ providers. It does not build the models, and it claims no AI Act certification. What it does is make the vendor-side facts verifiable: the prompt path runs inside a hardware-attested confidential-compute gateway, the source is open, the image digest is published, and the attestation is bound to the live TLS session. Verify, don't trust.
NONCE=$(openssl rand -hex 16)
curl "https://api.trustedrouter.com/attestation?nonce=$NONCE"
# Returns a JWT signed by the CPU vendor's root key.
# image_digest matches the published build. See /security.Know exactly what you deployed
Every route in the model catalog is listed with its provider and privacy tier: Open, Zero-Data-Retention, or TEE. Pin a specific model id per workload so your records show which model handled which task, at a transparent per-model price.
No stored content by default
TrustedRouter does not store prompt or output content by default. Privacy you can check beats privacy you're promised: the enforcement point is an attested gateway, and Zero-Data-Retention routes add contractual no-retention from the serving provider.
Keep inference in Europe
An EU gateway with EU-focused routing is available for European workloads. Its scope is stated plainly: EU-focused routing, with no data-residency guarantees beyond that. Reaching it is a base_url change on an OpenAI-compatible API.
No certification claimed. Documentation you can assess.
There is no "AI Act certified" status for an API vendor, and TrustedRouter does not claim one. What your compliance team gets is verifiable architecture plus readiness documentation it can assess: a DPA, a BAA, a subprocessors list, and SOC 2 and HIPAA readiness pages that say clearly what they are and are not. This page is informational, and none of it is legal advice.
Adopting the gateway is not a rebuild. Change base_url, keep your SDK, model ids, and code. One document-processing company scaled from zero to over a billion tokens per week through the attested gateway within three weeks of onboarding. Before the deadline or after it, the work is the same: collect evidence you can check. Start in the playground or read the security model.
Questions
Is TrustedRouter a provider or a deployer under the EU AI Act?
TrustedRouter is a routing layer in front of 220+ model routes across 30+ providers; it does not build the underlying models. How obligations split between model providers and your company as deployer depends on your use case, and this page is informational rather than legal advice. What TrustedRouter contributes is documentation: which route served each request, its privacy tier, live attestation of the gateway, a DPA, and a subprocessors list.
What evidence can I get from TrustedRouter for an AI Act compliance file?
Four things you can check rather than take on faith: an open-source gateway with a published image digest; live hardware attestation bound to the TLS session, returned as a JWT signed by the CPU vendor's root key; per-route privacy tiers (Open, Zero-Data-Retention, TEE) in the model catalog; and legal documentation including a DPA, subprocessors list, and SOC 2 and HIPAA readiness pages your compliance team can assess.
Does TrustedRouter store my prompts or outputs?
TrustedRouter does not store prompt or output content by default. The prompt path runs inside a hardware-attested confidential-compute gateway whose source is open and whose image digest is published, so you can verify the running code instead of trusting a policy page. Zero-Data-Retention routes add contractual no-retention from the serving provider, and TEE routes keep prompts unreadable even to the provider.
Can I keep LLM traffic in the EU?
TrustedRouter operates an EU gateway with EU-focused routing, described at /eu. Its scope is stated plainly: EU-focused routing exists, and there are no data-residency guarantees beyond that. Migration is a base_url change on an OpenAI-compatible API, so pointing a workload at the EU gateway does not require new SDKs or code rewrites.