Automatically attach cryptographically signed provenance certificates to every AI-generated email. Machine-readable disclosure, verifiable by anyone, backed by formal proofs.
EU AI Act Article 50 becomes enforceable on August 2, 2026, requiring providers of AI systems that generate text to mark that content in a machine-readable format. Penalties reach up to €15M or 3% of global annual turnover. For AI agents that send email, no email-specific RFC exists yet, and only 8 of 27 EU member states have published enforcement contacts. Most teams have no mechanism to mark outbound AI-generated email as such — let alone in a format that is cryptographically verifiable and tamper-evident. Waiting for a standard to emerge means scrambling to retrofit compliance after enforcement begins.
MultiMail attaches an X-MultiMail-Identity header to every AI-generated email — an ECDSA P-256 signed provenance certificate that satisfies the EU Code of Practice recommendation for digitally signed manifests. The header contains a machine-readable payload including the ai_generated boolean, operator identity, oversight mode, and agent capabilities. Recipients verify signatures against the public key published at /.well-known/multimail-signing-key. Tamper evidence is formally proven in Lean 4. Early adoption gives your organization a compliance advantage while enforcement infrastructure is still forming.
Configure the ai_disclosure setting on your mailbox. This tells MultiMail to attach a signed provenance certificate to every outbound message from this mailbox.
Your AI agent sends email through the MultiMail API or MCP tools as usual. No changes to your sending code are required — disclosure headers are attached automatically.
MultiMail signs the identity payload (ai_generated, operator, oversight mode, capabilities) with ECDSA P-256 and attaches it as the X-MultiMail-Identity header. The signature covers the payload to prevent modification in transit.
Any recipient or regulator can verify the provenance certificate by fetching the public key from /.well-known/multimail-signing-key and checking the signature. A verification page at multimail.dev/verify provides a human-friendly interface.
MultiMail's audit log records every disclosure header attached, creating evidence of systematic Article 50 compliance that you can present during regulatory examinations.
import requests
API = "https://api.multimail.dev/v1"
HEADERS = {"Authorization": "Bearer mm_live_xxx"}
"cm"># Enable AI disclosure for a mailbox
response = requests.patch(
f"{API}/mailboxes/mb_abc123",
headers=HEADERS,
json={
"ai_disclosure": {
"enabled": True,
"operator": "YourCompany GmbH",
"capabilities": ["compose", "reply", "summarize"]
}
}
)
print(response.json())
"cm"># {
"cm"># "id": "mb_abc123",
"cm"># "ai_disclosure": {
"cm"># "enabled": true,
"cm"># "operator": "YourCompany GmbH",
"cm"># "capabilities": ["compose", "reply", "summarize"]
"cm"># }
"cm"># }Enable Article 50 disclosure headers for a mailbox. Once enabled, all outbound emails include the signed provenance certificate.
import requests
API = "https://api.multimail.dev/v1"
HEADERS = {"Authorization": "Bearer mm_live_xxx"}
response = requests.post(
f"{API}/send",
headers=HEADERS,
json={
"from": "[email protected]",
"to": "[email protected]",
"subject": "Q3 Report Summary",
"text_body": "Please find the Q3 summary attached..."
}
)
result = response.json()
print(f"Message ID: {result[&"cm">#039;message_id']}")
print(f"Disclosure attached: {result.get(&"cm">#039;ai_disclosure_attached', False)}")
"cm"># Message ID: msg_xyz789
"cm"># Disclosure attached: TrueSend email normally — the provenance certificate is attached automatically when ai_disclosure is enabled on the mailbox.
"cm"># Extract the X-MultiMail-Identity header from a received email
IDENTITY_HEADER=$(grep -i &"cm">#039;X-MultiMail-Identity:' email.eml | cut -d' ' -f2-)
"cm"># Decode the base64 payload (before the signature delimiter)
PAYLOAD=$(echo "$IDENTITY_HEADER" | cut -d&"cm">#039;.' -f1 | base64 -d)
echo "$PAYLOAD" | jq .
"cm"># {
"cm"># "ai_generated": true,
"cm"># "operator": "YourCompany GmbH",
"cm"># "oversight_mode": "gated_send",
"cm"># "capabilities": ["compose", "reply", "summarize"],
"cm"># "timestamp": "2026-08-02T10:30:00Z"
"cm"># }
"cm"># Fetch the public key and verify the signature
curl -s https://api.multimail.dev/.well-known/multimail-signing-key \
-o /tmp/multimail-pub.pem
"cm"># Verify ECDSA P-256 signature
echo -n "$(echo "$IDENTITY_HEADER" | cut -d&"cm">#039;.' -f1)" \
| openssl dgst -sha256 -verify /tmp/multimail-pub.pem \
-signature <(echo "$IDENTITY_HEADER" | cut -d&"cm">#039;.' -f2 | base64 -d)
"cm"># Verified OKDecode and verify the X-MultiMail-Identity header to confirm AI-generated content is properly disclosed.
"cm">// Check disclosure status across all mailboxes
async function auditDisclosureCompliance() {
const mailboxes = await mcp.list_mailboxes({});
const results = mailboxes.map((mb: any) => ({
address: mb.address,
disclosure_enabled: mb.ai_disclosure?.enabled ?? false,
operator: mb.ai_disclosure?.operator ?? "NOT SET",
oversight_mode: mb.oversight_mode
}));
const noncompliant = results.filter(
(r: any) => !r.disclosure_enabled
);
if (noncompliant.length > 0) {
console.log(
`WARNING: ${noncompliant.length} mailbox(es) lack ` +
`AI disclosure headers — non-compliant with Art. 50`
);
for (const mb of noncompliant) {
console.log(` - ${mb.address}`);
}
} else {
console.log("All mailboxes have AI disclosure enabled.");
}
return results;
}Use MultiMail MCP tools to audit which mailboxes have AI disclosure enabled — useful for compliance dashboards.
import requests
API = "https://api.multimail.dev/v1"
HEADERS = {"Authorization": "Bearer mm_live_xxx"}
"cm"># List all mailboxes
mailboxes = requests.get(
f"{API}/mailboxes", headers=HEADERS
).json()["mailboxes"]
"cm"># Enable disclosure on any mailbox that lacks it
for mb in mailboxes:
if not mb.get("ai_disclosure", {}).get("enabled"):
requests.patch(
f"{API}/mailboxes/{mb[&"cm">#039;id']}",
headers=HEADERS,
json={
"ai_disclosure": {
"enabled": True,
"operator": "YourCompany GmbH",
"capabilities": ["compose", "reply"]
}
}
)
print(f"Enabled disclosure: {mb[&"cm">#039;address']}")
print(f"Audit complete: {len(mailboxes)} mailboxes checked.")Ensure every mailbox in your account has Article 50 disclosure enabled before the enforcement date.
Every AI-generated email includes a machine-readable provenance certificate with the ai_generated flag, operator identity, and oversight mode — satisfying the Article 50 requirement to mark AI-generated content in a machine-readable format.
The X-MultiMail-Identity header is signed with ECDSA P-256. Any modification to the disclosure payload invalidates the signature. Tamper evidence properties are formally proven in Lean 4, not just tested.
Only 8 of 27 EU member states have published enforcement contacts. Organizations that implement disclosure now establish compliance history before regulators begin auditing — demonstrating good faith that matters in enforcement discretion.
Enable ai_disclosure on your mailbox configuration and every outbound email is automatically tagged. Your AI agent's sending code stays the same — no header manipulation, no payload construction, no key management.
Anyone can verify the provenance certificate using the public key at /.well-known/multimail-signing-key or the human-friendly verification page at multimail.dev/verify. This transparency builds trust with recipients and regulators.
Email infrastructure built for AI agents. Verifiable identity, graduated oversight, and a 38-tool MCP server. Formally verified in Lean 4.