EU AI Act posture

The AI Act regulates AI by the risk a use poses, not by the technology itself. Most of Ultron is a general-purpose productivity surface: it drafts, plans, researches, and acts under human oversight. We read that as a limited-risk use carrying transparency duties rather than the heavier obligations reserved for high-risk systems. This page explains how we apply the Act, the specific articles in play, and where the line to your own duties sits.

The Act applies to providers placing AI systems on the EU market and to deployers established or located in the Union, and it can reach providers and deployers outside the Union where the output of the system is used in the Union. Ultron is operated from Bucharest, Romania, so the Act applies to us directly. It also means that when you, as a customer, deploy a workflow whose output is used in the Union, the Act can apply to you regardless of where you are established.

Under the Act, Ultron is a provider, because we develop and place an AI system on the market under our own name. We are also a deployer, because we use third-party general-purpose models, listed on the Subprocessors page, under our authority to deliver the service. We hold the provider and deployer duties that attach to a limited-risk system in those capacities. We are not the provider of the underlying foundation models; those obligations sit with the model makers, as described under General-purpose models below.

Classification is by use, not by the product as a whole. A single platform can host minimal-risk, limited-risk, and, depending on how a customer deploys it, high-risk uses. Our default posture covers the platform as we provide it; your specific configuration can change the classification for your deployment.

Article 5 bans a defined set of practices. We do not operate any of them. The practices most relevant to a platform like ours, and our position on each:

The Act places specific obligations on the providers of general-purpose AI models, such as technical documentation, a policy to respect Union copyright law, and a summary of training content, with additional obligations for models posing systemic risk. Ultron does not provide those models; we deploy them through the providers on the Subprocessors page, who hold the provider-side obligations for their models. As a deployer, our duties are the transparency and oversight duties described on this page, applied to the system we build on top of those models.

The Act expects meaningful human oversight for the uses to which its oversight requirements apply. The platform's approval gate, the ability to pause and take over a run, and the audit trail are the mechanisms that provide it. The full design, and how it supports both the AI Act and Article 22 of the GDPR, is documented on the Automated decisions and human oversight page.

The AI Act sits alongside the GDPR; it does not replace it. Where a use involves personal data, both apply: the GDPR governs the lawfulness of the data processing, and the AI Act governs the risk and transparency of the AI system. Our data processing position is in the Privacy Policy and the Data Processing Addendum, and our model-data position is in How we use your data for AI. This page addresses only the AI Act layer.

When you build a workflow or an agent on Ultron and put it in front of other people, you may become a deployer, and in some cases a provider, of an AI system in your own right. If your use falls into a high-risk category under Annex III, for example certain uses in employment and worker management, access to essential private or public services, or creditworthiness, the corresponding obligations are yours: risk management, human oversight, transparency to affected people, record-keeping, and registration where required. Ultron gives you the transparency and oversight controls to support compliance, but the classification of your specific use, and the duties that follow, rest with you.

Enterprise customers who need documentation to support their own conformity work, such as a description of the system, the oversight controls, and the model-data position, can request it from legal@51ultron.com. We cooperate in good faith with competent authorities exercising powers under the Act, and we will tell affected customers about a request that concerns them unless the law prevents us.

The Act entered into force on 1 August 2024 and applies in phases.

We track the phased application and the Commission guidance, and we update this page and the underlying controls as obligations take effect.

The Act sets administrative fines by severity. Operating a prohibited practice can attract fines up to the higher of 35 million euro or 7 percent of total worldwide annual turnover. Breaching other obligations, including the transparency duties, can attract fines up to the higher of 15 million euro or 3 percent of turnover. Supplying incorrect information to authorities carries a lower tier. The size of the exposure is the reason our posture is to stay clearly within the limited-risk tier and to keep prohibited practices off the platform entirely.

Our reading of the Act will evolve as the remaining phases take effect and as the Commission issues guidance and harmonised standards. Material changes to this posture are reflected here with an updated timestamp, and enterprise customers relying on it for their own conformity work are notified on request.

Questions about our AI Act posture, and requests for documentation to support your own conformity work, go to legal@51ultron.com.