EU AI Act: The Tool You Did Not Buy
Notas del episodio
An insurance brokerage in Porto, ninety people. A client's supplier questionnaire asks which AI systems process their data. The compliance officer checks the software register. No product, no licence, no line in the budget. She answers none.
Four months later the client writes to say how much better the claim summaries have become. An account manager had been pasting claim files into a free chatbot on her own account since spring.
The EU AI Act never asks who paid for the licence. Article 3, point 4 defines a deployer as anyone using an AI system under its authority, except where the use is a personal non-professional activity. The one real exit, in Article 2, paragraph 10, is for people, not for workplaces.
This episode: what being the deployer of a chatbot you never bought actually costs, which is less than most people are braced for. Why Article 4 carries no European fine, and why that is not the relief it sounds like. One practice prohibited outright and available today on a free account. And why nothing in Article 26 touches that pile of job applications until 2 December 2027, while the duty waiting there cannot be met for a system nobody declared.
Then the honest part. The Act forbids nothing about who owns the tool. The real exposure is data protection, trade secrets and your own contracts. Banning it is almost always the wrong move, and two things here are genuinely unsettled.
Nineteen minutes, every article number checked.
DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility.
Information, not legal advice. Before you answer question nine, talk to a lawyer.
CHAPTERS
0:00 These are AI voices, and why we say so first
1:22 Welcome to Project Cognivora
1:59 The form that said no
2:28 Who the law calls the user, and it is not the typist
3:34 The one exit, and why nobody at work is near it
4:26 What it costs, and it is less than you are bracing for
6:11 Article 50, and the moment the output leaves the building
7:07 The prohibited one, available today on a free account
9:32 Recruitment, Article 26, and the date that is not yet
11:11 The agent switched on over the weekend
12:33 What the Act does not say, and where the risk really sits
15:12 The contractor, and the words on their behalf
15:38 Ninety seconds: five things to do on Monday
17:47 What happened in Porto, and who to send this to
SOURCES
Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2026/1744, the Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
Commission guidelines on prohibited practices: https://digital-strategy.ec.europa.eu/en/policies/guidelines-prohibited-ai-practices
General Data Protection Regulation: https://eur-lex.europa.eu/eli/reg/2016/679/oj
KPMG and University of Melbourne, fieldwork November 2024 to January 2025: https://mbs.edu/faculty-and-research/trust-and-ai