| Art. 31(1) | Tell users in advance that the service uses high impact or generative AI | Users confirm at signup, and a notice appears at first login and whenever the notice text changes. Agent chats carry a notice bar. HR screens for hiring and pay carry a stronger notice. The system records who confirmed which version and when. Company admins edit the notice text and each edit is kept as a version. | Met |
|---|
| Art. 31(2) | Label generative AI output as made by AI | AI output carries an AI generated label and a short explanation. Downloaded images and documents get a machine readable mark. Video files and web pages, including Markdown, carry one too. Email drafts and published pages are labeled as well. | Met |
|---|
| Art. 31(3) | Clearly disclose sound, images or video that are hard to tell from real ones | AI images get a burned in AI badge and AI video shows a badge for the whole playback. AI voice starts with a spoken notice. These marks cannot be turned off, and output that cannot carry them is not released. | Met |
|---|
| Art. 33 | Check in advance whether the AI is high impact | The check uses the legal list of areas and the guideline questions. The result and reason are recorded with the reviewer's name and a review date. A new agent or process can be switched on only after it has a check on record. | Met |
|---|
| Art. 34(1) i | Set up and run a risk management plan | An AI risk register tracks each risk with its likelihood and an owner. It is linked to the live state of autonomy caps and the stop switch. Incident records and actions taken are kept there too. | Met |
|---|
| Art. 34(1) ii | Explain final results and main criteria, with an overview of training data | Every output has an explanation card. It shows the model and provider along with the criteria and sources. It also notes what could not be confirmed and whether a person edited it. A training data overview summarized from the provider's public material is linked. The explanation can be downloaded. | Met |
|---|
| Art. 34(1) iii | Protect users | Personal data is detected and masked, and each document has a classification level with access rights. People can appeal HR results and file data subject requests. AI output is labeled. | Met |
|---|
| Art. 34(1) iv | Human oversight | Approval gates and delegation rules are in place, and AI may never finalize an irreversible decision. Every agent seat has a human supervisor and proxy work needs human approval. The responsible manager is named and published. | Met |
|---|
| Art. 34(1) v · Decree Art. 27 | Document safety and reliability measures and keep them for five years | The safety and trust document is generated as a company record and versioned with a content hash. It exports to HTML or JSON. Notice and review records are kept for at least five years. Risk and impact assessment records follow the same rule. Retention cannot be set below five years. The audit log is chained by hash. | Met |
|---|
| Art. 35 | Fundamental rights impact assessment (best effort duty) | Forms cover the seven items in Decree Art. 28 along with the guideline's scope and risk scenarios. A reviewer writes and submits the assessment. Another admin approves it and the result is kept. | Met |
|---|
| Decree Art. 27 | Publish the main duties and the responsible manager's contact | A public AI policy page (abfos.ai/ai-policy or a page per company) shows the key points on risk management and user protection. The manager's name and contact come straight from settings and read as not set when empty. | Met |
|---|