EU AI Act transparency

Current role assessment

A general gateway is not high-risk merely because it can route to an AI model. Every production design lead must be screened against prohibited practices, Article 50 transparency, Annex I and Annex III use cases, and any fundamental-rights impact requirements.

Application timeline

The 2027 and 2028 dates reflect Regulation (EU) 2026/1744. They do not postpone already-applicable prohibitions, AI literacy measures, transparency duties, GPAI rules, or other EU law.

Accountability controls

• System and model inventory. Components, upstream providers, model versions, intended purposes, operator roles, risk conclusions and evidence must be registered and reviewed.
• Design-lead admission gate. Every production pilot is screened for prohibited practices, high-risk categories, affected people, transparency, human oversight and fundamental-rights impact.
• Access and stop controls. Organization and project permissions, API keys, model restrictions, routing policy and budgets can constrain or stop use without changing client applications.
• Human oversight support. Customers retain control of purpose, provider and final decisions; pilot terms must identify the competent reviewer, override route and stop conditions.
• Change and monitoring evidence. Model/provider changes, audit events, incidents, complaints and corrective actions require owned records and reassessment triggers.
• Privacy-preserving operations. Prompt and response capture remains disabled by default. AI Act evidence should use bounded metadata and configuration where possible rather than copying customer content into logs.

Article 50 transparency

Where an AI system directly interacts with a natural person, the responsible provider must ensure an appropriate first-interaction notice unless the interaction is objectively obvious. Providers of systems generating synthetic content may also have machine-readable marking duties. Deployers have separate disclosure duties for deepfakes, certain public-interest text, emotion recognition and biometric categorisation.

For Aixy, the responsible party depends on the integrated system and use case. The customer normally controls the end-user interface, while upstream providers control model-output capabilities. Aixy must document that allocation, preserve required provenance where available, and avoid claiming marking support until it has been verified model by model.

Information available to design leads

What the badge does not mean

The badge does not mean that Aixy, every upstream model, or every customer deployment is automatically compliant. It does not state that Aixy is a GPAI model provider, that a high-risk conformity assessment has been completed, or that an authority has approved the service.

Customers remain responsible for their own intended purposes, deployer duties, notices, human oversight, impact assessments and sector-specific law. Aixy's role and obligations must be reassessed when a feature, provider, model, use case or contractual presentation changes.