Description
n8n-nodes-aiact
Check AI workflows against the EU AI Act and record auditable evidence, without
leaving n8n.
This is an n8n community node for
VerifactAI. The VerifactAI API classifies a declared AI
system, returns the obligations that apply to it today, and appends a
tamper-evident evidence record for every check.
Installation · Operations ·
Credentials · Usage · Video walkthrough ·
Resources
Video walkthrough
▶ Watch the node in action on YouTube
— installing the node, creating the credential, declaring a system and
running a compliance check before an AI call.
Installation
Follow the
community nodes installation guide
and install n8n-nodes-aiact.
Operations
Compliance Check
- Run Check — evaluate a declared system and append an evidence record.
- Create — declare a system once: role, EU scope, what it does, who it
- Get, Get Many, Update — read and maintain the register, including
- Get Many — retrieve the evidence chain of a system together with its
- Get — retrieve a single record.
Returns the decision (allow, warn, review, block), the risk level, the
obligations that apply today, the missing controls, and the evidence ID.
System
affects.
the controls you have implemented, their attestations, the strict mode
setting, and the rule pack version the system is pinned to.
Evidence
integrity verification.
Credentials
Create an account on VerifactAI. Your API key is
emailed to you as soon as the account is created. It is shown only once: store it
in your password manager.
In n8n, create a VerifactAI API credential and paste the key. Leave
Base URL on its default, https://api.verifactai.app, unless you run a
self-hosted or regional instance.
Usage
1. Declare the system once
Use System → Create, or the VerifactAI register. A minimal declaration for a support
chatbot:
{
"role": "provider",
"eu_nexus": true,
"interactswithhumans": true,
"generates_content": true
}
You get a system ID such as sys_8f2a. The rule pack version is pinned at this
point, so a decision taken today stays reproducible after the law changes.
2. Check on every run
Put Compliance Check → Run Check before your LLM or agent node, select the
system, and branch on decision with an IF node. example-workflow.json in this
package is a ready-made version of that pattern.
A typical response:
{
"decision": "warn",
"risk_level": "transparency",
"obligations": [
{ "id": "ART501_DISCLOSURE", "article": "Article 50(1)" }
],
"controlsmissing": ["discloseai_interaction"],
"wouldblockinstrict": ["discloseai_interaction"],
"evidenceid": "evtm2k9x1c"
}
3. Move to strict mode when you are ready
Set Strict Mode to dry_run first. Nothing is blocked, but
wouldblockin_strict tells you exactly what would stop once you switch it on.
Close those gaps, then set it to on.
Note that only runtime controls can block a call. Organisational controls, such
as AI literacy training, are reported as missing but never stop a workflow: no
node can implement a training programme.
4. High-risk systems: attest your controls
A system in an Annex III area (recruitment, credit scoring, education,
biometrics, essential services…) carries the provider or deployer obligations
of Articles 8 to 27, applicable from 2 December 2027. The rule pack lists them
article by article, with one control each.
Ticking a control says it is in place. Control Attestations say who vouches
for it, on which document, and until when:
{
"qualitymanagementsystem": {
"owner": "Head of Quality",
"document_ref": "QMS-001 v3",
"verified_at": "2027-11-15",
"verified_by": "Internal audit",
"valid_until": "2028-11-15",
"standardid": "en18286_2026",
"clause": "7.2"
}
}
Past valid_until, the control counts as missing again and the dossier says
why. standard_id refers to a recognised standard listed by
GET /v1/packs/:ref/schema — today EN 18286:2026 (harmonised standard for the
Article 17 quality management system, presumption of conformity limited to
that requirement) and the Code of Practice on marking and labelling
AI-generated content (voluntary). An attestation documents how a control was
implemented; it never certifies the system.
Enabling Fail on Block
By default a blocked decision flows through as data, so you can branch on it.
Turn on Fail on Block if you would rather have the node raise an error and
route the item to the error output.
Data sent
The node sends the system ID and optional metadata: model name, purpose, actor.
Prompts, responses and message content are never transmitted.
Rule pack versions
Each system is pinned to the version of the rules it was declared with, so a
decision taken in March is reproducible with the law of March. When a new
version is published (for example after the Digital Omnibus or a new
harmonised standard), move a system to it with **System → Update → Rule Pack
Version**. The declaration is re-validated against the new version; evidence
already recorded keeps the version it was produced with.
Compatibility
Tested with n8n 1.60 and later. Requires Node.js 20.15 or later.
Resources
Disclaimer
This node reports the obligations identified for a declared system and the
controls applied to it. It does not constitute legal advice and does not
guarantee compliance.
