AI transparency

Every answer from a model served by zdr.sh is written by an AI model, and the API says so in the answer itself. This page describes the marker, the answers that carry it, and the duties the AI Act places on each side.

The marker#

An answer a model generated carries two response headers:

and two fields in the envelope of the answer:

The envelope is the top-level object of an assembled answer and the object of the first event of a stream: the chunk that opens a chat answer, the message of message_start in the Messages format, the response of response.created in the Responses format. The marker rides once, on that envelope, and sits next to the model field.

{  "id": "chatcmpl-...",  "object": "chat.completion",  "model": "glm-5.3-flash",  "ai_generated": true,  "ai_notice": "[AI-generated content]"}

What carries the marker#

The three generation routes, streamed or assembled, whatever model is behind them:

• POST /v1/chat/completions
• POST /v1/messages
• POST /v1/responses

An answer the response cache serves again carries the marker too: it is the same answer.

A route that serves no model output does not carry it: GET /v1/models, GET /v1/usage, the token counters, an error of a generation route, and the web tools, whose text is a page's and carries the untrusted-content notice instead.

Who the AI Act asks for what#

Article 50 of Regulation (EU) 2024/1689 puts the transparency duties of an AI system on the provider and on the deployer of that system, not on a model in the abstract:

• A system that interacts with people tells them they are interacting with an AI (Article 50(1)).
• The provider of a system that generates synthetic content marks its output in a machine-readable way (Article 50(2)).
• A deployer that publishes generated or manipulated content discloses it where the Act requires it (Article 50(4)).

On zdr.sh that reads as two sides:

• Yours. The systems you build on the API are yours, so those duties are yours for them: your application tells its users that they are talking to an AI, marks what it generates, and discloses what it publishes. The acceptable use policy makes that an obligation of the contract, and the terms state the split in section 8.
• Ours. zdr.sh is the provider of the systems it runs itself, and the marking above is what it does on every answer it serves. The third-party models behind some routes are their own providers' systems, and the duties that fall on those providers stay with them.

The models we run ourselves#

Some answers do not come from a third-party model at all: deepseek-dgx is served on our own hardware, under the same zero-retention agreement as every other model. For those systems zdr.sh is the provider, and the marking is ours to make. The answer carries exactly the same headers and fields as any other.

What is not marked yet#

• Images and audio. No route generates images or audio today: the service serves text, and images in a request are input. No content credential is issued, passed through or claimed. Should an image or audio output ever be proxied, the marking to add is a content credential next to the fields above, and this page will say so before such a route ships.
• Detection. zdr.sh does not offer a detection service: the presence of the marker is what a caller can check today.

The law behind this page#

• Article 50 of the AI Act has applied since 2 August 2026.
• Regulation (EU) 2026/1744 moved other AI Act deadlines and left Article 50 as it was.
• The relief that runs to 2 December 2026 covers generative systems placed on the market before 2 August 2026. This service does not rely on it: every answer is marked from the first one.
• The Commission's Code of Practice on Transparency of AI-Generated Content is the voluntary code the Act asks for. It is a way to show compliance with Article 50, not a duty beside it.

What this page says about the Act is a description, not legal advice: which duty falls on which party for a given system is a question for that party's lawyer.