EU AI Act — Our Transparency Report
How our compliance AI is trained, what data it sees, how it protects your confidential documentation, and where we stand on the EU AI Act compliance roadmap.
How the EU AI Act classifies our AI
The EU AI Act (Regulation (EU) 2024/1689) sets rules by use and risk: prohibited practices (Article 5), high-risk AI systems (Article 6), transparency obligations for certain AI systems (Article 50), obligations for general-purpose AI models (Chapter V) and, for every provider and deployer, AI literacy (Article 4). Understanding where we sit is the first question every CTO and legal team asks.
Social scoring, real-time biometric surveillance, manipulation. We are not in this category.
Critical infrastructure, employment, essential services, law enforcement. We are not in this category.
AI systems that interact with users or generate content. Our AI extracts structured data from documents and interacts with compliance professionals. Transparency obligations apply.
Spam filters, AI in video games, basic automation. No obligations specific to their risk level, although the AI literacy duty in Article 4 applies to all providers and deployers.
Our obligations under Limited Risk
Article 50 requires providers of AI systems that interact directly with people to tell them they are interacting with an AI system, and providers of systems that generate synthetic text, images, audio or video to mark those outputs as artificially generated, unless an exception applies. Article 4 requires providers and deployers to support the AI literacy of their staff. Registration in the EU database (Article 49) applies to high-risk AI systems, not to these obligations.
How our AI works — no black boxes
Every AI extraction in Traceable is traceable. Here is exactly what happens when you upload a document.
You upload a document
Zero cross-contaminationYour PDF, specification sheet, test report, or certificate is uploaded to your isolated EU-hosted workspace. Traceable never shares it with other customers and never uses it to train any model.
AI extracts structured data
Powered by Anthropic ClaudeOur AI reads the document and proposes values for the regulatory fields (for example Annex XIII for batteries, and the fields of our textile apparel template). It uses Claude models from Anthropic as its reasoning engine.
Every extraction is source-linked
Source document and confidenceEach extracted value is shown with its source document and a High, Medium or Low confidence, for you to check before you apply it. You verify what the AI found; no value reaches a passport without your review.
You verify and approve
Human-in-the-loop alwaysNo AI-extracted value is written to a passport until a person selects and applies it, and each AI-extracted document waits as Pending for verification. Your compliance officer reviews each proposed field and can correct or reject it. Traceable does not submit to the EU registry automatically: its EU Registry Readiness page prepares a submission file that you upload yourself.
Tamper-evident audit trail
Regulator-ready audit logAI document processing, human review and approval are recorded in an audit trail, and the records are linked by a hash chain. If a regulator asks why a value was recorded, you can show which document it came from and which person approved it.
How we protect your confidential data
The platform separates each customer's data from other customers' data in the application. Row-level security is enabled on database tables as a further control on direct database access.
The primary data store is hosted in Ireland on AWS eu-west-1. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union. AWS states in its Amazon Bedrock FAQ that neither AWS nor third-party model providers use inputs to or outputs from Amazon Bedrock to train models, and that inputs and outputs are not shared with model providers. Non-EEA subprocessors, including Resend for transactional email, operate under the EU-U.S. Data Privacy Framework or the European Commission Standard Contractual Clauses, in accordance with Chapter V of the GDPR. Full list at /legal/subprocessors/.
Documents you upload are used solely to extract compliance data for your passports. They are not used to fine-tune, retrain, or improve our AI models.
All data is encrypted with AES-256 at rest. The platform is served only over HTTPS, and browsers are instructed to use HTTPS for future visits.
We offer a Data Processing Agreement (DPA) under Article 28 GDPR. The DPA explicitly covers AI processing and restricts any use beyond contracted purposes.
AI-extracted documents carry an "AI" badge in the document library, and no AI-extracted value is written to a passport until a person selects and applies it. There is no silent AI output.
Our EU AI Act compliance roadmap
The EU AI Act entered force on 1 August 2024 with phased obligations. This is where we stand on each milestone.
AI Act enters force
CompleteRegulation (EU) 2024/1689 entered into force. We began our internal classification review.
Prohibited practices ban
CompleteArticle 5 prohibitions apply from 2 February 2025; the prohibitions added by Regulation (EU) 2026/1744 in Article 5(1), points (ba) and (bb), apply from 2 December 2026. We confirmed none of our AI systems fall under prohibited categories. We review our AI features against the EU AI Act, and keep AI use opt-in with human review of every AI-drafted field.
GPAI model obligations
CompleteObligations for providers of general-purpose AI models (Chapter V) apply from 2 August 2025. They fall on the provider of the model; for the Claude models we use, that is Anthropic.
Limited risk transparency obligations
In progressThe Article 50 transparency obligations apply from 2 August 2026. For systems generating synthetic content that were placed on the market before that date, Article 111(4) allows until 2 December 2026 to comply with the marking duty in Article 50(2). A fundamental rights impact assessment (Article 27) and a post-market monitoring system (Article 72) are obligations for high-risk AI systems only.
High-risk AI system rules apply
PlannedRules for high-risk AI systems apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for systems covered by Annex I (Article 113, as amended by Regulation (EU) 2026/1744). Conformity assessment (Article 43) applies to high-risk AI systems.
Questions about our AI?
We answer AI Act questions for enterprise prospects. If you need a completed security questionnaire, AI impact assessment, or custom DPA clause, contact us directly.