How Strise marks AI-generated textCopy Anchor Link

Strise records who wrote each free-text field its AI features can fill, and marks AI-written text wherever it leaves Strise. People reading the text can see that AI wrote it, and software can detect it. Article 50(2) of the EU AI Act requires AI-generated text to be marked in a machine-readable format, and this article describes how Strise does it. AI-generated text is marked and verifiable.

Who wrote a textCopy Anchor Link

Strise records the text origin of five fields: the review self-assessment, the recommended actions, the assessment summary, the team's risk context, and the comment on a PEP, sanctions, or screening list disposition. Each field has one of four text origins:

The adverse media event summary and the reasoning in assisted PEP, sanctions, and adverse media verification are always written by AI, and are marked as AI-generated. When you insert the assistant's summary into a PEP or sanctions disposition comment, its text origin is AI-generated. If you then add to it or edit it, the text origin becomes AI-generated and edited by a user. In adverse media verification, the disposition comment holds only your own words; the assistant's reasoning is kept apart from it and marked as AI-generated.

The AI markerCopy Anchor Link

AI-written text carries one of two markers:

• [AI-generated by Strise]
• [AI-generated by Strise, edited by a user]

Strise never saves the marker as part of the text. It adds it at each point where the text leaves Strise:

Human and unknown text carries no marker.

Text origin in the Connect APICopy Anchor Link

The Strise Connect API returns the self-assessment of a review in Review.selfAssessment, unchanged. Its text origin is in Review.selfAssessmentOrigin:

query {
  review(where: { id: "<review id>" }) {
    selfAssessment
    selfAssessmentOrigin {
      kind
      model
      generatedAt
      editedAt
      signedRecord
    }
  }
}

The comment on a disposition works the same way: Disposition.comment holds the text, and Disposition.commentOrigin its text origin.

For HUMAN and UNKNOWN, Strise returns no signed origin record and makes no claim that AI was involved.

Verify a signed origin recordCopy Anchor Link

signedRecord is a compact JSON Web Signature (JWS). Its header holds alg: ES256, typ: strise-ai-origin+jwt, and the kid of the signing key. Its payload holds:

To check a record yourself:

1. Fetch Strise's public keys from https://app.strise.ai/.well-known/ai-provenance/jwks.json.
2. Verify the JWS signature with the key whose kid matches the header, and check that typ is strise-ai-origin+jwt.
3. Normalise the text you hold. Convert it to Unicode NFC, remove both AI markers, replace every run of whitespace with one space, and trim both ends.
4. Compare the SHA-256 of the normalised text, encoded as UTF-8, with the sha256 claim.

The key file from step 1 lists every key Strise has signed with, including retired ones. Each key stays listed for at least 10 years after the last record it signed. A matching fingerprint shows that the text is the one Strise recorded. You can also paste the record into the AI text verifier instead.

The AI text verifierCopy Anchor Link

If you're logged in to Strise, you can check a text or a signed origin record at app.strise.ai/verify. The page is also linked from Settings → AI generation log. Authorities, researchers, media, and civil society organisations without a Strise account can request free access at ai-transparency@strise.ai. Without the verifier, you can check a signed origin record against Strise's published keys at https://app.strise.ai/.well-known/ai-provenance/jwks.json. To check a Review PDF, open its signature panel in a PDF reader.

• Text: paste a text, for example one copied from a report. Your browser computes the text's fingerprint and sends only the fingerprint. Strise looks it up in the AI generation log and shows the feature, model, and time of each match. It never shows which team the text was generated for.
• Signed record: paste the signedRecord value from the Connect API. Strise checks the signature against its published keys and shows the text origin, model, and times in the record.

Each result states what it is based on, and you can download it as a signed file to show others. Strise keeps neither the text nor its fingerprint. The verifier does not accept PDF files; the page explains how to check a Review PDF's signature in a PDF reader. The page also lists the address for questions about AI-generated text from Strise.

A text check only finds texts that are in the generation log. When it finds nothing, the result reads "No match in the log (entries kept for up to 10 years)". Each team chooses its own retention period, and the verifier never knows which team a text belongs to, so it names the longest one.

No match does not mean a person wrote the text. Common reasons for no match:

• The team had logging turned off.
• The entry passed its retention period.
• The text changed after Strise wrote it.
• Strise wrote the text before logging began.

Logging settingsCopy Anchor Link

Each team decides whether Strise logs fingerprints of its AI-generated text, and for how long. The log is on by default, with 5 years' retention; the options are 13 months, 5 years, and 10 years. When your contract with Strise ends, Strise deletes your team's log entries with the rest of your team's data. Users with the Manager role change it under Settings → AI generation log. See AI generation log for what is logged and every option.