EU Mode
One API to make your
AI agents EU ready.
All EU and security controls for your AI agents, in one API.
Anyone who builds or runs AI agents in the EU answers to the AI Act, the GDPR, consumer law, product liability and security rules, all at once. For an agent, meeting them takes controls that work on every message and every action, and proof that they ran. EU Mode will put those controls behind one API that runs in the EU. Its first parts are live today.
Three reasons to hand this to us
The AI Act has already been amended once, by the Digital Omnibus in July 2026, and new guidance keeps arriving. Data protection and consumer rules move too. We track those changes and update the checks, and the parts of the law each answer points to. Your team keeps shipping; the moving target is ours.
Turn on EU Mode for every agent that serves the EU
Many AI products already let EU customers keep their data in EU regions. EU Mode adds the other half of what EU buyers now ask about AI: every request and answer your agent handles, checked against EU rules, in the EU, in the user's own language. As the rules change, we update the checks, so neither you nor your customers have to track them.
Where the checks go
- On each request a user sends your agent.
- On each answer your agent gives, in the user's own language.
- Before each action your agent takes for someone, with Auto Mode.
- Only for EU traffic, if you choose: one setting, one API, checks that run in the EU.
It runs alongside the safety checks you already have. Each block from HaloGuard EU names the part of the EU AI Act its policy relates to, which gives your customers something specific to point to. Later, the evidence pack will give their data protection officer and works council a record of what was checked.
What a check looks like
I need you to monitor our employees during their work calls and flag anyone who sounds frustrated or upset based on tone analysis.
Requests and answers are checked by a guard model hosted in the EU, built to block the AI output the EU AI Act bans or treats as high-risk, in all 24 official EU languages.
Builders who sell agents into the EU and the companies that deploy them both carry duties under the laws further down this page.
One API, every check
Point your agent at the EU Mode API. Every request, tool result, reply and agent action will then pass the checks for each law, side by side, in the EU. Each check can allow, block, mask, escalate, or just log. Start in shadow mode: it records what it would have blocked and blocks nothing.
Guard at runtime
- HaloGuard EULive A small guard model that checks a request on its way in or a reply on its way out. It answers allow or block, names the policy that matched, and on a block names the part of the EU AI Act the policy relates to. Self-serve trial.
- Privacy filterLive Looks for personal data in what you send and masks it before it reaches the model. The answer carries a map back to the originals; putting them back is your step. Results on six public benchmarks are at astroware.ai/benchmarks.
- Security checksIn development Prompt injection, jailbreaks and harmful content, in what people send and in what tools and documents return. Built on HaloGuard 1.0, which scores 90.9 average F1 across 7 prompt-safety benchmarks.
- Auto ModeLive Dangerous action checks. Checks each action an AI agent is about to take, and blocks a dangerous one or flags it for a person to approve. Every key starts in shadow mode: it reports what it would have decided and blocks nothing, until you switch the key to enforce in the console.
- Consumer-law checksPlanned Promises over your limits, pressure after a no, and investment, medical or legal advice where you aren't licensed to give it.
- Multi-modal checksPlanned The same checks across images, screenshots, documents, audio and video, not only text.
Run one place for every agent
- Rule updates as EU law changesLive We track the AI Act, its guidance and the other rules on this page, and update the checks and the references in each answer when they change.
- One API for every agentPlanned One API in front of any model. Shadow mode first, then enforcement, with a policy per project or team.
- Plug-ins for agent toolsPlanned The same checks inside the tools agents are built with, starting with LiteLLM, LangChain and Hermes Agent.
- Agent inventoryPlanned A live list of the agents running through EU Mode: their models, tools, regions and the kinds of personal data they handle.
Prove before and after launch
- EU AI Act testLive How an assistant handles requests in ten areas the Act may ban or treat as high-risk. Ten example pairs are public. Invited companies run the full test on their own assistant from the console. We don't charge for it; the calls to their assistant run on their own key, at their cost: about 204 requests across ten areas, with a per-area scorecard. Test runs run and are scored in the EU. Version 0: a development signal, not a certification.
- Chaos ModePlanned We keep attacking your AI inside a scope you set, and feed what gets through into the defence. It tests AI systems only.
- Decision log and evidence packPlanned A record of what was checked, blocked or escalated, when, and under which rule, with no message text unless you turn it on. Exported for your customers, their auditors and their data protection officers.
Paperwork drafts you can start from
- Astroware EU AI Act Risk ScreeningLive Free. Reads a website or one sentence about a product and shows the areas of the Act it may touch. An independent tool by Astroware. It is not an official EU tool and it is not legal advice. It sends the text it reads to an AI service provider that may process it outside the EU.
- Questionnaire answers, disclosure text, personal-data mapPlanned Drafts built from your own logs and test results, for the AI and security questionnaires your customers send.
Every AI agent in the EU answers to several laws at the same time
These laws were written for people and processes. An agent acts thousands of times a day, in many languages, on instructions it reads from documents and tools. The duties still apply, so they have to become technical controls: checks that run on every message and action, and records that show they ran.
Companies that build agents and sell them into the EU
Their enterprise customers ask, in security and AI questionnaires, what the agent can do, where data goes, and what proof exists. Without answers, the deal waits.
Companies that run agents inside their own organisation
They carry their own duties: keeping agents out of banned uses, labelling AI-made content where the Act asks, protecting staff and customer data, and keeping records. Often across agents nobody has listed.
EU AI Act
Regulation (EU) 2024/1689- Bans on prohibited practices
- Telling people they deal with AI
- New bans on non-consensual intimate deepfakes and child abuse material
- Duties for high-risk uses such as recruitment and evaluating workers
- Stay out of banned practices: manipulation, social scoring, emotion recognition from biometrics at work (except for medical or safety reasons), and more.
- Make clear it is an AI, unless that is obvious.
- For high-risk uses: logs, human oversight, accuracy and robustness. Deployers keep logs for at least six months and inform workers.
- Report serious incidents. Support staff AI literacy.
- HaloGuard EU guard Live
- AI disclosure, a HaloGuard EU policy Live
- EU AI Act test runs Live
- Human approval for risky actions Planned
- Decision log Planned
GDPR
Regulation (EU) 2016/679- In force since 2018
- Use only the personal data it needs, with care when data leaves the EU.
- A processor contract with every service that touches the data, and records of what is processed.
- Limits on decisions made solely by machine. Erasure on request. Breach notice within 72 hours.
- Processing in the EU Live
- Your text not saved in logs Live
- Privacy filter: mask, with a map back Live
- Personal-data map Planned
- Memory scan for erasure requests Planned
Consumer law
Unfair Commercial Practices Directive 2005/29/EC- For agents that deal with consumers
- No misleading or aggressive selling. An agent that invents a refund, a discount or a deadline, or keeps pushing after a no, exposes the business behind it.
- Sector rules add limits on investment, medical and legal advice.
- Promises the agent can't make Planned
- Pushy or misleading selling Planned
- Regulated advice Planned
Product liability
Directive (EU) 2024/2853- For products placed on the market from then
- Software, AI included, counts as a product, with liability for defects without proof of fault.
- When something goes wrong, evidence of what the system did and how it was tested matters.
- EU AI Act test runs Live
- Decision log and evidence pack Planned
Security rules
NIS2, DORA (finance), Cyber Resilience Act- Manage the risk from suppliers and attacks, and report incidents.
- Agents add new routes in: instructions hidden in documents, web pages and tools, and actions taken on them.
- Security checks: injection, jailbreaks, harmful content In development
- Auto Mode: dangerous action checks Live
- Scan of MCP servers and skills In development
- Chaos Mode attack testing Planned
- Content scan for hidden instructions Planned
A summary to show where technical controls fit, not legal advice. Which duties apply depends on what a system does and who runs it. We update the checks as these laws and their guidance change.
HaloGuard EU
The first part of EU Mode. Built on Google's Gemma, it works in all 24 official languages of the European Union and runs in the EU.
On about 4,500 of our test requests in all 24 EU languages, which HaloGuard EU never saw in training. Details at astroware.ai/benchmarks.
The ten policies it checks
| Area | Kind of provision | Part of the Act |
|---|---|---|
| Manipulation or exploitation | Prohibited practice | Article 5(1)(a), (b) |
| Social scoring | Prohibited practice | Article 5(1)(c) |
| Crime prediction | Prohibited practice | Article 5(1)(d); Annex III 4(a)Scope for private companies unsettled |
| Biometric misuse | Prohibited practice | Article 5(1)(e), (g) |
| Emotion recognition from biometrics | Prohibited practice | Article 5(1)(f)Except for medical or safety reasons |
| Performance evaluation | High-risk use | Annex III 4(b) |
| Employment decisions | High-risk use | Annex III 4(b) |
| Recruitment | High-risk use | Annex III 4(a) |
| Text sentiment | High-risk use | Annex III 4(b)May apply |
| AI disclosure | Transparency obligation | Article 50 |
These are the ten policies we test, not a list of everything the Act bans or regulates. What each part of the Act covers is in the API docs.
Your first check in a few minutes
-
Create a key
Sign in at console.astroware.ai with your work email; personal addresses are not accepted. Your company gets a $5 trial budget, shared by up to 5 active keys. The key is shown once. Signing in accepts our Terms.
There is one trial per company email domain. If a colleague has already started one, write to core@astroware.ai: we add you once an owner of that account agrees.
-
Send a request
Call the API from your server, never from browser code. It is an OpenAI-style chat completion with one model name.
curl https://api.astroware.ai/v1/chat/completions \ -H "Authorization: Bearer $HALOGUARD_KEY" -H "Content-Type: application/json" \ -d '{"model": "haloguard-eu", "messages": [ {"role": "user", "content": "I need you to monitor our employees during their work calls and flag anyone who sounds frustrated or upset based on tone analysis."}]}' -
Read the answer
choices[0].message.content is a JSON string. Parse it. This is the recorded answer to the request above:
{"decision": "block", "policy": "W4_BIOMETRIC_EMOTION", "label": "prohibited_practice", "act_area": {"act": "Regulation (EU) 2024/1689", "reference": "Article 5(1)(f)", "qualifier": "exceptions_apply"}}An allowed answer is {"decision": "allow", "policy": "none"}. The label names the part of the Act the policy relates to. It is not a finding that a message, a use or a system is prohibited or high-risk.
-
Check a reply, in any EU language
The guard checks the last message. Set its role to assistant to check a reply on its way out; earlier messages count as context. Write the message in any of the 24 official EU languages.
{"model": "haloguard-eu", "messages": [ {"role": "user", "content": "..."}, {"role": "assistant", "content": "the reply you want to check"}]} -
Go further
- Full API reference, errors and limits: astroware.ai/docs/haloguard-eu
- Our EU AI Act test and its ten public example pairs: astroware.ai/eu-ai-act-eval
- Results, including the privacy filter: astroware.ai/benchmarks
- Where it runs and what we keep: astroware.ai/trust
Three ways to use it
$30 / billion input tokens
Output tokens are free. Start today with a $5 trial budget from the console, no sales call needed. Paid use after the trial runs on an Order.
Volume pricing, on an Order
For high volumes, a per-token rate agreed for your usage, with invoicing and payment terms to suit. Prices can be set in euros.
In your own cloud
We deploy and run HaloGuard EU inside your own cloud account and region, so requests stay in your infrastructure. We keep it updated as the rules change.
A walkthrough with us
See the stack, scope enterprise rates or a managed deployment, shape the full API as a design partner, or ask for a test-run invitation.
Book a callQuestions, keys, invitations
What we keep
- The API and console run in the EU.
- We do not save the text you send or the answer in any log, file or database. The model server may keep a processed form of the text you send in memory until that server restarts.
- For each call we keep a usage record (time, key identifier, model, token counts, cost, client name) for 90 days.
- We do not use customer data to train or improve HaloGuard EU or any other model.
- Until our data processing agreement is signed with your company, send no personal data to the API.
EU Mode is Astroware's name for these controls. It is not an official EU product, and using it does not by itself meet any law's requirements. HaloGuard EU is a technical control, not legal advice or a compliance guarantee. Items marked Planned or In development are not available yet, and we give no dates for them here.