

EU AI Act: You Built an Agent. Now You Are the Provider
Episode notes
An engineering consultancy in Lyon, 220 people. Two engineers wrapped four hundred lines of code around a large American model and built an assistant that drafts technical proposals. Internal only. Their head of IT summed it up: we are not building AI, we are using it.
He was wrong, and had been since the day they switched it on. Not the day a customer saw it.
The Act does not much care who trained the model. Putting an AI system into service covers supply "for own use", and there is no internal exemption. Build a tool for your own staff and you are its provider and its deployer at once.
This episode is the map. Where the model ends and the system begins, and the word the Act has for you: downstream provider. What your model supplier owes you. What being a provider costs when your system is not high risk. And why Annex III is not automatic.
Then the honest part. The one third rule lives in guidelines, not in the Regulation. Nobody has said whether an agent calling three models is one system or several. And we could not find a single fine against any provider.
Twenty-one minutes, every article number checked so you can check us.
DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for it.
This episode is information, not legal advice. Before you answer a compliance questionnaire, talk to a lawyer.
CHAPTERS
0:00 These are AI voices, and why we say so first
1:42 Welcome to Project Cognivora
2:23 We are not building AI, we are using it
4:00 The engine and the car, and the word for you
4:58 What your model supplier owes you, and how to ask
7:01 What it costs when the system is not high risk
8:25 Article 50 already applies to you, and nobody said so
9:56 Fine-tuning, and the one third that changes everything
11:39 Article 25, and the logo that makes you the provider
13:37 Annex III, the filter, and the profiling hard stop
15:58 The exits, and why they are narrower than they look
16:47 Two penalty regimes, same numbers, different regulator
17:52 Three things nobody has answered yet
18:46 Ninety seconds: five things to do on Monday
19:57 What happened in Lyon, and who to send this to
SOURCES
Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2026/1744, the Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
General-purpose AI models, C(2025) 5045 final: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
Article 50 transparency guidelines, 20 July 2026: https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations
Draft high-risk classification guidelines, 19 May 2026: https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems