Project Cognivora

Project Cognivora

by Kris Cordier

Education Technology

Season 1

EU AI Act: The Tool You Did Not Buy

An insurance brokerage in Porto, ninety people. A client's supplier questionnaire asks which AI systems process their data. The compliance officer checks the software register. No product, no licence, no line in the budget. She answers none. Four months later the client writes to say how much better the claim summaries have become. An account manager had been pasting claim files into a free chatbot on her own account since spring. The EU AI Act never asks who paid for the licence. Article 3, point 4 defines a deployer as anyone using an AI system under its authority, except where the use is a personal non-professional activity. The one real exit, in Article 2, paragraph 10, is for people, not for workplaces. This episode: what being the deployer of a chatbot you never bought actually costs, which is less than most people are braced for. Why Article 4 carries no European fine, and why that is not the relief it sounds like. One practice prohibited outright and available today on a free account. And why nothing in Article 26 touches that pile of job applications until 2 December 2027, while the duty waiting there cannot be met for a system nobody declared. Then the honest part. The Act forbids nothing about who owns the tool. The real exposure is data protection, trade secrets and your own contracts. Banning it is almost always the wrong move, and two things here are genuinely unsettled. Nineteen minutes, every article number checked. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility. Information, not legal advice. Before you answer question nine, talk to a lawyer. CHAPTERS 0:00 These are AI voices, and why we say so first 1:22 Welcome to Project Cognivora 1:59 The form that said no 2:28 Who the law calls the user, and it is not the typist 3:34 The one exit, and why nobody at work is near it 4:26 What it costs, and it is less than you are bracing for 6:11 Article 50, and the moment the output leaves the building 7:07 The prohibited one, available today on a free account 9:32 Recruitment, Article 26, and the date that is not yet 11:11 The agent switched on over the weekend 12:33 What the Act does not say, and where the risk really sits 15:12 The contractor, and the words on their behalf 15:38 Ninety seconds: five things to do on Monday 17:47 What happened in Porto, and who to send this to SOURCES Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Regulation (EU) 2026/1744, the Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj Commission guidelines on prohibited practices: https://digital-strategy.ec.europa.eu/en/policies/guidelines-prohibited-ai-practices General Data Protection Regulation: https://eur-lex.europa.eu/eli/reg/2016/679/oj KPMG and University of Melbourne, fieldwork November 2024 to January 2025: https://mbs.edu/faculty-and-research/trust-and-ai https://www.project-cognivora.com

EU AI Act: You Built an Agent. Now You Are the Provider

An engineering consultancy in Lyon, 220 people. Two engineers wrapped four hundred lines of code around a large American model and built an assistant that drafts technical proposals. Internal only. Their head of IT summed it up: we are not building AI, we are using it. He was wrong, and had been since the day they switched it on. Not the day a customer saw it. The Act does not much care who trained the model. Putting an AI system into service covers supply "for own use", and there is no internal exemption. Build a tool for your own staff and you are its provider and its deployer at once. This episode is the map. Where the model ends and the system begins, and the word the Act has for you: downstream provider. What your model supplier owes you. What being a provider costs when your system is not high risk. And why Annex III is not automatic. Then the honest part. The one third rule lives in guidelines, not in the Regulation. Nobody has said whether an agent calling three models is one system or several. And we could not find a single fine against any provider. Twenty-one minutes, every article number checked so you can check us. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for it. This episode is information, not legal advice. Before you answer a compliance questionnaire, talk to a lawyer. CHAPTERS 0:00 These are AI voices, and why we say so first 1:42 Welcome to Project Cognivora 2:23 We are not building AI, we are using it 4:00 The engine and the car, and the word for you 4:58 What your model supplier owes you, and how to ask 7:01 What it costs when the system is not high risk 8:25 Article 50 already applies to you, and nobody said so 9:56 Fine-tuning, and the one third that changes everything 11:39 Article 25, and the logo that makes you the provider 13:37 Annex III, the filter, and the profiling hard stop 15:58 The exits, and why they are narrower than they look 16:47 Two penalty regimes, same numbers, different regulator 17:52 Three things nobody has answered yet 18:46 Ninety seconds: five things to do on Monday 19:57 What happened in Lyon, and who to send this to SOURCES Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Regulation (EU) 2026/1744, the Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj General-purpose AI models, C(2025) 5045 final: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers Article 50 transparency guidelines, 20 July 2026: https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations Draft high-risk classification guidelines, 19 May 2026: https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems https://www.project-cognivora.com

EU AI Act: Article 50, and the Deadline in December

A company of 140 people in Hamburg ran a campaign fronted by a presenter talking to camera about floor coatings. There is no presenter. She was generated. In June that was lawful. The campaign is still running, and in August the rules changed. What arrived was not an inspector, but a letter from a competitor's lawyer. Article 50 of the EU AI Act has applied since 2 August 2026. Four duties in one article, landing on different people: 1 and 2 bind providers, 3 and 4 bind deployers, and 5 governs how and when you say any of it. Your vendor's watermark discharges your vendor's duty and does nothing for yours. Then the date almost everybody has wrong. The transitional period to 2 December 2026 is not in Article 50. The Digital Omnibus put it in Article 111(4); it covers only the marking in Article 50(2), and only for systems already on the market before 2 August 2026. Also here: what the Commission guidelines of 20 July 2026 did to the word "obvious"; why a person who never existed is still a deep fake under Article 3(60) and a dragon is not; what "human review or editorial control" has to mean; the research that strips a watermark for fifty dollars; Article 99(4)(g) and the flip in 99(6) for smaller companies; and not one fine we could find. Two hosts, twenty minutes, every article number checked so you can check us. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for it. This episode is information, not legal advice. Before you decide no disclosure is needed, talk to a lawyer. CHAPTERS 0:00 These are AI voices, and why we say so first 1:40 Welcome to Project Cognivora 2:20 Four duties, and the question that sorts them 3:28 Tell people it is a machine, and the escape hatch 4:51 Mark what the machine makes, and whose job that is 6:21 The deadline that is not in Article 50 7:46 Emotion recognition, and where Article 5 got there first 9:14 Deep fakes, dragons, and an objective test 11:25 Public-interest text, and what editorial control means 12:57 Marking is engineering, and the watermark washes off 14:09 The Code of Practice, and what signing it buys you 15:02 Article 99, and the flip that helps small companies 16:27 Nine without a caveat, and no fine we could find 17:43 Ninety seconds: five things to do on Monday 19:09 What happened in Hamburg, and who to send this to SOURCES Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Regulation (EU) 2026/1744, the Digital Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj Commission guidelines, C(2026) 5054 final, 20 July 2026: https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems Commission questions and answers: https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act https://www.project-cognivora.com

EU AI Act: Outside Europe, and Still in Scope

A sixty-person company in Denver sells software that screens job applications. American customers, American servers. One of those customers has an eleven-person sales office in Dublin, and in March that office started using the tool. Nobody in Denver signed anything with Europe. That was enough. There is no establishment threshold in the EU AI Act, in the same way there is no size threshold. Article 2 applies to providers placing an AI system on the Union market "irrespective of whether those providers are established or located within the Union or in a third country". This episode is the map. Three doors lead into scope: you place a system on the Union market, somebody in the Union deploys it, or, the one people miss, you sit in a third country and the output produced by your system is used in the Union. Recital 22 explains why that third door exists, and uses the word circumvention. Also here: why this is not data protection law wearing a different hat. What applies today, which is Article 5, Article 50 and the general-purpose AI chapter, and what waits until 2 December 2027. The authorised representative in Articles 22 and 54, including the part where yours is required to report you to the regulator. And the Article 25 flip that turns your distributor into the provider. Then the honest part. A European Parliament briefing in March 2026 counted eight designated single points of contact out of twenty-seven. Not one harmonised standard has been cited in the Official Journal, the classification guidelines are still a draft, and we could not find a single AI Act penalty against any provider, anywhere. Two hosts, twenty minutes, every article number checked so you can check us. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content. This episode is information, not legal advice. Before you sign a compliance warranty, talk to a qualified lawyer. CHAPTERS 0:00 These are AI voices, and why we say so first 1:26 Welcome to Project Cognivora 2:02 Three doors into scope, and none of them ask where you are 3:42 The output test, and the line nobody has drawn yet 5:02 Why this is not data protection law 6:02 What already applies to you today 8:10 Article 50, and the transitional that is not in Article 50 9:49 What is coming: 2 December 2027 and 2 August 2028 11:18 The authorised representative, Articles 22 and 54 13:25 Your European partner, and the Article 25 flip 15:07 What enforcement looks like from far away 16:12 Eight of twenty-seven, no standards, no database 17:27 Ninety seconds: five things to do on Monday 18:45 What happened in Denver, and who to send this to SOURCES Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Regulation (EU) 2026/1744, the Digital Omnibus on AI: https://eur-lex.europa.eu/eli/reg/2026/1744/oj Commission guidelines on general-purpose AI models, July 2025: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers Project Cognivora: https://www.project-cognivora.com

EU AI Act: What Small Companies Have to Do Now, and What Is Coming

A twelve-person software company in Ghent shipped a small feature: when a patient emails the dental practice, the software drafts the reply. Six months later a hospital group sent a compliance questionnaire. Question eleven: are you a provider of an AI system under Regulation (EU) 2024/1689, and please attach your conformity documentation. He cannot write "no". He also does not need a lawyer. And question eleven asks for a document that, for his product, does not have to exist. This episode is why all three are true. For a small company the Act arrives as a customer questionnaire long before an inspector does. The skill is telling apart what applies today from what applies in 2027. What already applies: the prohibitions of Article 5, including the two a small developer can walk into. Article 4 on AI literacy. And Article 50 on transparency, in force since 2 August 2026, which ordinary software companies are least ready for: it is engineering work, not a policy document. Including the part almost nobody has noticed. The Digital Omnibus gave a four-month transitional period for the marking duty in Article 50(2), but only for systems already on the market before 2 August 2026. Those have until 2 December 2026. Anything shipped after that gets no grace period at all. What is coming: 2 December 2027 for the Annex III use cases, 2 August 2028 for high-risk AI inside regulated products. A module that decides who gets an instalment plan is evaluating creditworthiness, presumed high risk subject to the filter in Article 6(3). One sprint can turn a small company into the provider of a high-risk system. Also here: no size threshold anywhere in Article 2, three narrow ways out of scope, why the fine ceiling in Article 99 inverts for small companies, why most high-risk systems need no notified body, and the Article 25 trapdoor that turns a buyer into a provider. Plus the honest part: the classification guidelines are still a draft and no harmonised standard has been cited. Two hosts, twenty minutes, every article number checked so you can check us. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a real conversation. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content. This episode is information, not legal advice. Before you sign a compliance warranty in a customer contract, talk to a qualified lawyer. CHAPTERS 0:00 These are AI voices, and why we say so first 1:44 Welcome to Project Cognivora 2:21 There is no size threshold in the AI Act 3:50 The three ways out of scope 4:57 What already applies: the prohibitions of Article 5 6:26 Article 50, in force now, and it is engineering work 9:11 Article 4 in a company of twelve 9:36 General-purpose AI, and the fine that inverts 11:21 What is coming: 2 December 2027 and 2 August 2028 13:17 The guidelines are a draft, the standards unpublished 14:33 What being small actually buys you 16:21 Article 25, the trapdoor for small builders 17:15 Ninety seconds: four things to do on Monday 19:17 What happened in Ghent SOURCES Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Commission FAQ on Article 50, the December 2026 grace period: https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act Project Cognivora: https://www.project-cognivora.com

EU AI Act: AI Literacy, Part 2, What You Are Entitled to Know at Work

Article 4 of the EU AI Act is about you and is not addressed to you. Your employer carries the duty. You cannot be in breach of it, and nobody can certify you, because there is no certificate to issue. So this episode is not about your obligations. It is about your three rights, which sit in other articles and are considerably more concrete. One: you have to be told when you are dealing with a machine rather than a person, unless that is already obvious to a reasonably well-informed and observant person. Two: before a high-risk AI system starts being used on you at work, you and your representatives have to be informed, beforehand, not in the release notes. Three: if you have been told you are the human in the loop, the law says you must be given competence, training and authority. Sam explains why the third word is the one that is usually missing. There is also a detour into a law that predates the AI Act by six years. When a system is simply wrong about you, Article 22 of the General Data Protection Regulation is often the stronger instrument. Then the practical part: four things worth knowing that are not technical, four questions you can ask your employer without starting a war, and why the colleague who uses AI constantly may be the most exposed person in the building rather than the safest. Two hosts, eighteen minutes, every article number checked so you can check us. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content. This episode is information, not legal advice. If something is happening to you right now that feels serious, talk to your union or a qualified adviser. CHAPTERS 0:00 These are AI voices, and why that matters in this episode 1:31 Welcome to Project Cognivora 2:09 Article 4 is about you, but the duty is your employer's 4:00 Right one: being told you are talking to a machine 5:23 Right two: being told before it is used on you 7:05 When the system is wrong about you, Article 22 GDPR 9:34 Right three: being the human in the loop 11:02 Four things worth knowing, none of them technical 12:17 Why the heaviest user is often the most exposed 13:16 Four questions you can ask without starting a war 14:55 Back to the call scoring, three steps in order 16:37 Ninety seconds: what an employee takes away 17:41 Send it to the colleague who is now the human in the loop SOURCES Regulation (EU) 2024/1689, full text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Article 4, AI literacy, on the Commission's AI Act Service Desk: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4 The AI Omnibus enters into force, European Commission: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force Regulation (EU) 2016/679, the General Data Protection Regulation: https://eur-lex.europa.eu/eli/reg/2016/679/oj Project Cognivora: https://www.project-cognivora.com

EU AI Act: AI Literacy, Part 1, What Employers Actually Have to Do

A friend of Maya's runs a forty-person company in Antwerp. She forwarded an email: mandatory AI training, forty-five minutes, complete before the end of the month. She wanted to know whether that was the law, because somebody had told her that skipping it meant a fine of seven percent of turnover. Both halves of that sentence are wrong, and the way they are wrong is the most useful thing an employer can learn about Article 4 of the EU AI Act. Sam works through what the article actually requires, what the Digital Omnibus changed when it rewrote it on 27 July 2026, and why the duty is now one of effort rather than result. Then the part nobody mentions: there is no European fine attached to Article 4 at all, and that is not the relief it sounds like, because Article 99 tells every member state to put something behind it anyway. The second half is practical. Who counts as your staff, and why the freelancer with the image generator is in that sentence too. Why forty-five minutes of e-learning for everybody is the most common way to spend money without reducing risk. The three things worth writing down, none of which needs a consultant. And a myth list, because the certificate you were offered does not exist. Part two, next episode, is the same article seen from the other side, for everybody who works in an organisation rather than runs one. Two hosts, twenty minutes, every article number checked. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content. This episode is information, not legal advice. For anything high-stakes, talk to a qualified lawyer or your national competent authority. A note on timing: the consolidated text of the amended Article 4 had not been published at the time of recording, and the Commission's own page still showed the pre-amendment wording with a notice attached. The episode therefore describes the change rather than quoting the new text. CHAPTERS 0:00 These are AI voices, and why we say so first 1:41 Welcome to Project Cognivora 2:20 Article 4, in one sentence 4:02 What the Digital Omnibus changed on 27 July 2026 5:54 The seven percent fine, and why it is not this one 7:18 What Article 99 leaves to your own country 9:22 Four objections, answered 11:50 Who counts as your staff, freelancers included 13:21 What proportionate actually looks like 15:29 The three things worth writing down 17:14 The myth list 18:21 Ninety seconds: what an employer does on Monday 19:52 Send it to whoever signs off the training budget SOURCES Regulation (EU) 2024/1689, full text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Article 4, AI literacy, on the Commission's AI Act Service Desk: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4 The AI Omnibus enters into force, European Commission: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force Project Cognivora: https://www.project-cognivora.com

EU AI Act: Are You a Provider or a Deployer?

Maya made a video for work. She typed a script into an avatar tool, and eleven minutes later there was a version of her talking down the lens. She posted it. Then someone in the comments asked whether she was allowed to do that under the EU AI Act, and she realised she had no idea. This episode is the answer. Sam walks through what Regulation (EU) 2024/1689 actually regulates, and corrects the mistake almost everyone makes: the Act does not work on people or on content. It works on AI systems, and on the role you are playing when you touch one. Find out whether you are a provider or a deployer first, and everything else follows. We cover the four risk levels, the practices that are banned outright rather than merely restricted, why recruitment quietly drags ordinary companies into high-risk territory, and the obligation that has been in force since February 2025 that almost nobody talks about. Then part two: what to do about AI-generated content. Why the tool's watermark does not discharge your duty, why "but I consented, it's my own face" answers a completely different question, and the three questions that tell you whose problem this actually is. Two hosts, eighteen minutes, no legal jargon that isn't explained. DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for its content. This episode is information, not legal advice. For anything high-stakes, talk to a qualified lawyer or your national competent authority. CHAPTERS 0:00 These are AI voices, and why we say so first 1:25 Welcome to Project Cognivora 2:03 What the Act is, and the mistake almost everyone makes 3:46 The trapdoor: when a deployer becomes a provider 5:38 Four levels, and what is banned outright 7:18 High risk: recruitment, and what compliance actually costs 9:09 AI literacy, and the timeline after the Omnibus 10:40 Part two: the eleven-minute avatar video 12:23 "But it's my face. I agreed." 14:10 Chatbots, the reliefs, and three questions to remember 16:05 What "not misleading" still doesn't cover 17:49 Send it to the colleague who knows who they are SOURCES Regulation (EU) 2024/1689, full text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj European Commission, AI Act overview: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai EU AI Act Service Desk: https://artificialintelligenceact.eu Project Cognivora: https://www.project-cognivora.com