· ReadyStack
Worked example
Real numbers from this tool, line by line.
Five scripts nobody authorised sit on one ordinary checkout page - e-commerce developers in the US and the EU, on markup that already renders and takes money.
checkout.html
5 error The CSP is in a <meta> tag - meta ignores report-uri and report-to, so 11.6.1 can never alert you.
5 error script-src allows bare https: - every host on the internet is an authorised script source.
7 error googletagmanager.com/gtag/js - a container can add a script after the inventory was signed.
9 error jquery@latest - a moving version, so no integrity hash stays true until the next audit.
10 error static.hotjar.com - a session recorder on a page that has a card field.That is the audit output, not a summary. Twenty findings come back from that page in total; those five are the top of the list. Not one is a bug - the page renders and payments go through. They are a requirement mandatory since 2025-03-31 that nobody put on the sprint board.
PCI DSS 4.0.1 requirement 6.4.3 says every script executed in the customer's browser on a payment page needs three things: a method confirming it is authorised, a method assuring its integrity, and an inventory entry with a written justification. Requirement 11.6.1 adds that you must be alerted when that page's scripts or security headers change.
The markup behind them:
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' https:">
<script src="https://www.googletagmanager.com/gtag/js?id=G-8QK2M1RS"></script>
<script src="https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js"></script>
<script src="https://static.hotjar.com/c/hotjar-2914455.js?sv=6"></script>
<script src="https://js.stripe.com/v3/"></script>The last line is fine, and naive tooling flags it anyway: js.stripe.com must load with no Subresource Integrity hash, because Stripe rotates that file. It still needs an inventory row - justification: renders the hosted card fields.
What changed this year
Merchants with a fully outsourced checkout used to have a way out: if the processor delivered the whole payment page, a QSA could agree that 6.4.3 and 11.6.1 were not applicable, and that was enough for the report.
On 2026-08-04 the PCI Security Standards Council published a revised FAQ 1331: QSA agreement alone is no longer sufficient, and merchants must consult their Compliance Accepting Entity - the acquirer or payment brand. The requirements did not change; the escape route narrowed, inside an assessment cycle many teams are in.
Why your existing tools miss it
A CSP evaluator grades the policy string and never opens your page, so it misses a script injected at runtime by document.createElement('script'). ESLint reads JavaScript, not <script> attributes, so integrity= with no crossorigin= - which browsers ignore, leaving you unprotected while the markup claims otherwise - goes straight past it. And an assistant trained before this year will tell you Subresource Integrity is sufficient for 6.4.3. It is the most common wrong answer here: SRI inventories nothing, skips dynamically injected scripts, and never notices an authorised script behaving differently.
The audit reads the page as markup, line by line, against 26 rules written for payment pages: each finding names the line, the requirement it fails and the fix. The free version audits the page you have open, completely - all 26 rules, no key, no watermark, nothing locked.
What a licence adds is not more rules - it is the artifact. An assessor does not accept a findings panel; they accept a dated inventory. The full version exports it as CSV, JSON or HTML across every payment page in the repository, and fails a CI build when an unauthorised script appears. A PCI consultant bills about $76 an hour in the US in 2026, and a QSA-assisted self-assessment runs $5,000 to $20,000. Building this inventory by hand is billed inside that, and it has to be rebuilt every time marketing adds a tag.
Questions people ask
What does the AI Act Article 50 Audit actually do?
It reads your source files and prints every line that triggers an EU AI Act transparency duty: LLM and chatbot call sites under Article 50(1), image, audio and video generation that needs a machine-readable mark under Article 50(2), emotion and biometric categorisation under 50(3), deepfakes under 50(4), and practices banned outright by Article 5. Twenty-eight rules, each printed with its paragraph and line number.
Who is this for?
Engineering teams that ship an LLM, image, voice, deepfake or emotion feature to users in the European Union, and the person on that team who has been asked to produce the Article 50 register. It is written for developers, not lawyers: it runs in VS Code, prints file and line numbers, and exports a file your compliance colleague can actually read.
Why can't I just ask ChatGPT or run ESLint?
ESLint has no Article 50 rule; the duties are not style problems. A chat assistant can summarise the Act, but it cannot list which of your four thousand files hold the call sites, and its sense of the timeline is usually wrong: the Digital Omnibus delayed the Annex III high-risk rules to December 2027 and left Article 50 in force from 2 August 2026.
What is free and what needs a licence?
Free finishes one file completely, in the editor or in the browser: all twenty-eight rules, every line number, no watermark, no blocked result and no time limit. A licence changes the scope, not the quality. It audits the whole repository in one pass and exports the register as CSV, JSON or HTML, plus a JSON report a CI pipeline can gate on.
What would this cost if a person did it?
Specialist firms price an AI-system classification round at roughly EUR 3,000 to 15,000 depending on how many systems you have, and a Chapter III gap analysis considerably more. This does the code-side inventory step of that work for forty-nine dollars, once. It is an inventory tool, not legal advice, and it does not replace the assessment itself.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. AI Act Transparency Audit - Article 50 (chatbots, deepfakes, checks the file you open against 28 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.