EU AI Act: Impact on RAG Systems

The AI Act (Artificial Intelligence Regulation) is the world's first comprehensive AI regulation. Entered into force in August 2024, it directly impacts RAG systems deployed in Europe. This guide helps you understand your obligations and achieve compliance.

Prerequisites: Familiarize yourself with the fundamentals of RAG and our guide on RAG security and compliance before continuing.

What is the AI Act?

Context and Objectives

The AI Act is a European regulation establishing a harmonized legal framework for artificial intelligence. Its main objectives are:

• Protect fundamental rights of European citizens
• Establish clear rules for AI developers and deployers
• Foster innovation while limiting risks
• Create a single market for AI systems in Europe

Implementation Timeline

Who is Affected?

The AI Act applies to:

• Providers: Those who develop AI systems
• Deployers: Those who use AI systems in a professional context
• Importers/Distributors: Those who place products on the European market
• Product Manufacturers: When AI is integrated into a product

DEVELOPERpython
from enum import Enum
from dataclasses import dataclass
from typing import List, Optional

class AIActRole(Enum):
    """Roles defined by the AI Act."""
    PROVIDER = "provider"
    DEPLOYER = "deployer"
    IMPORTER = "importer"
    DISTRIBUTOR = "distributor"
    PRODUCT_MANUFACTURER = "product_manufacturer"

@dataclass
class Organization:
    """Representation of an organization under the AI Act."""
    name: str
    roles: List[AIActRole]
    location: str
    eu_representative: Optional[str] = None

    def needs_eu_representative(self) -> bool:
        """Check if an EU representative is required."""
        # Non-EU organizations selling in EU
        return self.location not in EU_COUNTRIES and self._serves_eu_market()

    def primary_obligations(self) -> List[str]:
        """Return primary obligations based on role."""
        obligations = []

        if AIActRole.PROVIDER in self.roles:
            obligations.extend([
                "Quality management system",
                "Conformity assessment",
                "Technical documentation",
                "CE marking",
                "EU declaration of conformity"
            ])

        if AIActRole.DEPLOYER in self.roles:
            obligations.extend([
                "Use according to instructions",
                "Appropriate human oversight",
                "System monitoring",
                "Log retention",
                "Information to affected persons"
            ])

        return obligations

Risk Classification

The AI Act classifies AI systems into four risk categories:

1. Unacceptable Risk (Prohibited)

These systems are completely banned in Europe:

• Subliminal manipulation causing harm
• Exploitation of vulnerabilities (age, disability)
• Social scoring by public authorities
• Real-time facial recognition in public spaces (with exceptions)
• Biometric categorization by sensitive data
• Emotion recognition at work/school

DEVELOPERpython
class ProhibitedSystemChecker:
    """Checks if a RAG system uses prohibited practices."""

    PROHIBITED_PRACTICES = {
        "subliminal_manipulation": {
            "description": "Subliminal techniques to alter behavior",
            "indicators": [
                "hidden_messages",
                "unconscious_influence",
                "aggressive_dark_patterns"
            ]
        },
        "vulnerability_exploitation": {
            "description": "Exploitation of vulnerabilities",
            "indicators": [
                "age_targeting",
                "disability_targeting",
                "economic_situation_targeting"
            ]
        },
        "social_scoring": {
            "description": "Generalized social scoring",
            "indicators": [
                "behavioral_score",
                "trustworthiness_assessment",
                "citizen_classification"
            ]
        },
        "emotion_recognition_workplace": {
            "description": "Emotion recognition at work",
            "indicators": [
                "employee_facial_analysis",
                "work_stress_detection",
                "emotional_surveillance"
            ]
        }
    }

    def check_system(self, system_config: dict) -> dict:
        """Analyze a system to detect prohibited practices."""
        violations = []

        for practice_id, practice in self.PROHIBITED_PRACTICES.items():
            for indicator in practice["indicators"]:
                if self._detect_indicator(system_config, indicator):
                    violations.append({
                        "practice": practice_id,
                        "description": practice["description"],
                        "indicator": indicator,
                        "severity": "PROHIBITED"
                    })

        return {
            "is_compliant": len(violations) == 0,
            "violations": violations,
            "recommendation": "PROHIBITED - Do not deploy" if violations else "OK"
        }

    def _detect_indicator(self, config: dict, indicator: str) -> bool:
        """Detect a prohibited practice indicator."""
        # Detection implementation
        # ...
        pass

2. High Risk

These systems require strict compliance before market placement:

Affected Domains:

DEVELOPERpython
from typing import Dict, List, Tuple
from enum import Enum

class RiskLevel(Enum):
    PROHIBITED = "prohibited"
    HIGH = "high"
    LIMITED = "limited"
    MINIMAL = "minimal"

class RAGRiskClassifier:
    """Classifies RAG system risk level according to AI Act."""

    HIGH_RISK_DOMAINS = {
        "biometric_identification": {
            "keywords": ["facial recognition", "biometric", "identification"],
            "threshold": 0.8
        },
        "critical_infrastructure": {
            "keywords": ["energy", "transport", "water", "infrastructure"],
            "threshold": 0.7
        },
        "education": {
            "keywords": ["admission", "grading", "exam", "academic evaluation"],
            "threshold": 0.7
        },
        "employment": {
            "keywords": ["recruitment", "CV", "resume", "application", "hiring", "HR"],
            "threshold": 0.8
        },
        "essential_services": {
            "keywords": ["credit", "loan", "insurance", "benefits", "welfare"],
            "threshold": 0.8
        },
        "law_enforcement": {
            "keywords": ["police", "crime", "risk", "profiling"],
            "threshold": 0.9
        },
        "migration": {
            "keywords": ["visa", "asylum", "border", "immigration"],
            "threshold": 0.9
        },
        "justice": {
            "keywords": ["court", "judgment", "sentence", "recidivism"],
            "threshold": 0.9
        }
    }

    def classify_rag_system(
        self,
        system_description: str,
        use_cases: List[str],
        data_types: List[str],
        decision_impact: str
    ) -> Dict:
        """Classify a RAG system according to AI Act."""

        # Check prohibited practices first
        prohibited_check = ProhibitedSystemChecker().check_system({
            "description": system_description,
            "use_cases": use_cases
        })

        if not prohibited_check["is_compliant"]:
            return {
                "risk_level": RiskLevel.PROHIBITED,
                "violations": prohibited_check["violations"],
                "can_deploy": False,
                "reason": "Prohibited practices detected"
            }

        # Check if high risk
        high_risk_matches = self._check_high_risk_domains(
            system_description,
            use_cases
        )

        if high_risk_matches:
            return {
                "risk_level": RiskLevel.HIGH,
                "matched_domains": high_risk_matches,
                "can_deploy": True,
                "requirements": self._get_high_risk_requirements(),
                "reason": f"High-risk domain(s): {', '.join(high_risk_matches)}"
            }

        # Check if limited risk (transparency required)
        if self._is_limited_risk(use_cases, data_types):
            return {
                "risk_level": RiskLevel.LIMITED,
                "can_deploy": True,
                "requirements": ["Transparency obligation"],
                "reason": "Direct interaction with users"
            }

        # Default: minimal risk
        return {
            "risk_level": RiskLevel.MINIMAL,
            "can_deploy": True,
            "requirements": [],
            "reason": "No sensitive domain identified"
        }

    def _check_high_risk_domains(
        self,
        description: str,
        use_cases: List[str]
    ) -> List[str]:
        """Identify high-risk domains."""
        combined_text = f"{description} {' '.join(use_cases)}".lower()
        matched = []

        for domain, config in self.HIGH_RISK_DOMAINS.items():
            score = sum(
                1 for kw in config["keywords"]
                if kw.lower() in combined_text
            ) / len(config["keywords"])

            if score >= config["threshold"]:
                matched.append(domain)

        return matched

    def _get_high_risk_requirements(self) -> List[str]:
        """Return requirements for high-risk systems."""
        return [
            "Risk management system",
            "Data governance",
            "Technical documentation",
            "Record keeping (logs)",
            "Transparency and information",
            "Human oversight",
            "Accuracy, robustness, cybersecurity",
            "Conformity assessment",
            "CE declaration of conformity",
            "Registration in EU database"
        ]

3. Limited Risk

These systems only have transparency obligations:

• Chatbots and AI assistants (including RAG)
• Content generation systems
• Deep fakes and synthetic content
• Emotion categorization systems

DEVELOPERpython
class TransparencyRequirements:
    """Transparency requirements for limited risk systems."""

    def generate_disclosure(self, system_type: str) -> str:
        """Generate required disclosure text."""

        disclosures = {
            "chatbot": """
                You are interacting with an artificial intelligence system.
                This chatbot uses RAG (Retrieval-Augmented Generation) technology
                to generate its responses from a knowledge base.

                Responses are generated automatically and may contain
                inaccuracies. For important decisions, please
                consult a human expert.
            """,

            "content_generation": """
                This content was generated or assisted by artificial intelligence.
                It may contain errors or outdated information.
                Verify important information with primary sources.
            """,

            "emotion_detection": """
                This system uses artificial intelligence to analyze
                certain aspects of your communication. You have the right
                to refuse this analysis.
            """
        }

        return disclosures.get(system_type, disclosures["chatbot"])

    def get_required_disclosures(self, system_config: dict) -> List[dict]:
        """Return all required disclosures."""
        disclosures = []

        # Disclosure that it's AI
        if system_config.get("user_interaction"):
            disclosures.append({
                "type": "ai_interaction",
                "when": "Before first interaction",
                "content": self.generate_disclosure("chatbot"),
                "format": ["visible_text", "audio_if_voice"]
            })

        # Generated content disclosure
        if system_config.get("generates_content"):
            disclosures.append({
                "type": "generated_content",
                "when": "With each generated content",
                "content": self.generate_disclosure("content_generation"),
                "format": ["watermark", "metadata", "visible_mention"]
            })

        return disclosures

4. Minimal Risk

No specific obligations, but best practices recommended:

• Anti-spam filters
• Video games with AI
• Basic recommendation systems

Where Do RAG Systems Fall?

General Case: Limited Risk

Most RAG chatbots fall into the limited risk category:

DEVELOPERpython
def classify_typical_rag_chatbot() -> dict:
    """Classification of a standard RAG chatbot."""

    classifier = RAGRiskClassifier()

    # E-commerce customer support chatbot
    result = classifier.classify_rag_system(
        system_description="Customer support chatbot for e-commerce site",
        use_cases=[
            "Answer questions about products",
            "Help with order tracking",
            "Explain return policies"
        ],
        data_types=["product_catalog", "FAQ", "terms_conditions"],
        decision_impact="low"  # No significant decision
    )

    return result
    # Expected result:
    # {
    #     "risk_level": RiskLevel.LIMITED,
    #     "can_deploy": True,
    #     "requirements": ["Transparency obligation"],
    #     "reason": "Direct interaction with users"
    # }

High Risk Case: RAG in HR or Finance

Some RAG deployments can be high risk:

DEVELOPERpython
def classify_hr_rag_system() -> dict:
    """Classification of a RAG system for recruitment."""

    classifier = RAGRiskClassifier()

    # Recruitment assistance system
    result = classifier.classify_rag_system(
        system_description="RAG system for CV analysis and pre-screening",
        use_cases=[
            "Analyze candidate CVs",
            "Rank applications",
            "Suggest best profiles",
            "Generate interview questions"
        ],
        data_types=["CVs", "job_descriptions", "recruitment_history"],
        decision_impact="high"  # Affects hiring
    )

    return result
    # Expected result:
    # {
    #     "risk_level": RiskLevel.HIGH,
    #     "matched_domains": ["employment"],
    #     "can_deploy": True,
    #     "requirements": [...10 requirements...],
    #     "reason": "High-risk domain(s): employment"
    # }

Obligations for High-Risk RAG Systems

If your RAG system is classified as high risk, here are your obligations:

1. Risk Management System

DEVELOPERpython
from datetime import datetime
from typing import Dict, List, Any
import json

class RiskManagementSystem:
    """AI Act compliant risk management system."""

    def __init__(self, system_id: str):
        self.system_id = system_id
        self.risk_registry = []
        self.mitigation_measures = []
        self.review_schedule = []

    def identify_risks(self) -> List[Dict[str, Any]]:
        """Identify RAG system risks."""
        risks = [
            {
                "id": "R001",
                "category": "accuracy",
                "description": "Incorrect responses or hallucinations",
                "likelihood": "medium",
                "impact": "high",
                "affected_rights": ["right to accurate information"]
            },
            {
                "id": "R002",
                "category": "bias",
                "description": "Bias in training data",
                "likelihood": "medium",
                "impact": "high",
                "affected_rights": ["non-discrimination"]
            },
            {
                "id": "R003",
                "category": "privacy",
                "description": "Disclosure of personal data",
                "likelihood": "low",
                "impact": "very_high",
                "affected_rights": ["privacy", "data protection"]
            },
            {
                "id": "R004",
                "category": "security",
                "description": "Malicious prompt injection",
                "likelihood": "medium",
                "impact": "medium",
                "affected_rights": ["security"]
            },
            {
                "id": "R005",
                "category": "transparency",
                "description": "Lack of response explainability",
                "likelihood": "high",
                "impact": "medium",
                "affected_rights": ["right to explanation"]
            }
        ]

        self.risk_registry = risks
        return risks

    def define_mitigations(self) -> List[Dict[str, Any]]:
        """Define mitigation measures."""
        mitigations = [
            {
                "risk_id": "R001",
                "measure": "Automatic fact-checking",
                "implementation": "Response verification against reliable sources",
                "status": "implemented",
                "effectiveness": "high"
            },
            {
                "risk_id": "R001",
                "measure": "Systematic disclaimer",
                "implementation": "Warning about AI limitations",
                "status": "implemented",
                "effectiveness": "medium"
            },
            {
                "risk_id": "R002",
                "measure": "Data audit",
                "implementation": "Quarterly review of potential biases",
                "status": "scheduled",
                "effectiveness": "medium"
            },
            {
                "risk_id": "R003",
                "measure": "PII filtering",
                "implementation": "Detection and masking of personal data",
                "status": "implemented",
                "effectiveness": "high"
            },
            {
                "risk_id": "R004",
                "measure": "Input validation",
                "implementation": "Detection of injection attempts",
                "status": "implemented",
                "effectiveness": "high"
            },
            {
                "risk_id": "R005",
                "measure": "Source citations",
                "implementation": "Display of documents used",
                "status": "implemented",
                "effectiveness": "high"
            }
        ]

        self.mitigation_measures = mitigations
        return mitigations

    def generate_report(self) -> Dict[str, Any]:
        """Generate risk management report."""
        return {
            "system_id": self.system_id,
            "report_date": datetime.utcnow().isoformat(),
            "total_risks": len(self.risk_registry),
            "risks_by_category": self._count_by_category(),
            "mitigation_coverage": self._calculate_coverage(),
            "residual_risks": self._identify_residual_risks(),
            "next_review": self._get_next_review_date(),
            "certification_status": "pending"
        }

    def _calculate_coverage(self) -> float:
        """Calculate risk coverage rate."""
        covered = len(set(m["risk_id"] for m in self.mitigation_measures))
        total = len(self.risk_registry)
        return covered / total if total > 0 else 0

2. Data Governance

DEVELOPERpython
class DataGovernanceSystem:
    """Data governance system for RAG AI Act compliance."""

    def __init__(self):
        self.data_sources = []
        self.quality_checks = []

    def register_data_source(self, source: Dict[str, Any]) -> None:
        """Register a data source with required metadata."""
        source_record = {
            "id": source["id"],
            "name": source["name"],
            "type": source["type"],  # documents, API, database

            # Quality information (Article 10)
            "quality_assessment": {
                "completeness": source.get("completeness_score"),
                "accuracy": source.get("accuracy_score"),
                "timeliness": source.get("last_updated"),
                "representativeness": source.get("representativeness_score")
            },

            # Traceability
            "origin": source.get("origin"),
            "collection_method": source.get("collection_method"),
            "preprocessing": source.get("preprocessing_steps", []),

            # Bias and limitations
            "known_biases": source.get("known_biases", []),
            "limitations": source.get("limitations", []),
            "gaps": source.get("data_gaps", []),

            # Compliance
            "legal_basis": source.get("legal_basis"),
            "consent_type": source.get("consent_type"),
            "retention_period": source.get("retention_period")
        }

        self.data_sources.append(source_record)

    def assess_training_data_quality(self) -> Dict[str, Any]:
        """Assess data quality in accordance with Article 10."""
        assessment = {
            "overall_score": 0,
            "dimensions": {},
            "recommendations": []
        }

        dimensions = {
            "relevance": self._check_relevance(),
            "representativeness": self._check_representativeness(),
            "error_free": self._check_errors(),
            "completeness": self._check_completeness(),
            "statistical_properties": self._check_statistical_properties()
        }

        scores = [d["score"] for d in dimensions.values()]
        assessment["overall_score"] = sum(scores) / len(scores)
        assessment["dimensions"] = dimensions

        # Recommendations
        for dim_name, dim_result in dimensions.items():
            if dim_result["score"] < 0.7:
                assessment["recommendations"].append({
                    "dimension": dim_name,
                    "issue": dim_result.get("issues", []),
                    "action": dim_result.get("recommended_action")
                })

        return assessment

    def _check_representativeness(self) -> Dict[str, Any]:
        """Check data representativeness."""
        # Data distribution analysis
        issues = []
        score = 0.8  # Default score

        # Check geographic diversity
        # Check temporal diversity
        # Check use case coverage

        return {
            "score": score,
            "issues": issues,
            "recommended_action": "Diversify data sources"
        }

3. Technical Documentation

DEVELOPERpython
class TechnicalDocumentation:
    """Generates technical documentation required by AI Act."""

    def generate_full_documentation(
        self,
        system_config: Dict[str, Any]
    ) -> Dict[str, Any]:
        """Generate complete Article 11 documentation."""

        return {
            "metadata": {
                "document_version": "1.0",
                "created_at": datetime.utcnow().isoformat(),
                "system_name": system_config["name"],
                "provider": system_config["provider"]
            },

            # 1. General description
            "general_description": {
                "intended_purpose": system_config["purpose"],
                "intended_users": system_config["target_users"],
                "geographic_scope": system_config["deployment_regions"],
                "interaction_method": "chatbot_text",
                "version": system_config["version"]
            },

            # 2. System elements
            "system_elements": {
                "architecture": self._describe_architecture(system_config),
                "components": [
                    {
                        "name": "Retrieval Engine",
                        "type": "vector_search",
                        "description": "Semantic search in document base"
                    },
                    {
                        "name": "LLM Generator",
                        "type": "language_model",
                        "description": "Contextualized response generation"
                    },
                    {
                        "name": "Document Store",
                        "type": "database",
                        "description": "Document and embedding storage"
                    }
                ],
                "external_dependencies": system_config.get("dependencies", [])
            },

            # 3. Development process
            "development_process": {
                "methodology": "agile_mlops",
                "quality_assurance": self._describe_qa_process(),
                "testing_procedures": self._describe_testing(),
                "validation_metrics": self._list_metrics()
            },

            # 4. Capabilities and limitations
            "capabilities_limitations": {
                "intended_capabilities": [
                    "Answer questions about documentation",
                    "Provide factual information",
                    "Cite sources used"
                ],
                "known_limitations": [
                    "Cannot access real-time internet",
                    "May produce hallucinations",
                    "Limited to document base knowledge",
                    "Does not understand images or audio files"
                ],
                "foreseeable_misuse": [
                    "Use for medical decisions without supervision",
                    "Use for definitive legal advice",
                    "Generation of misleading content"
                ]
            },

            # 5. Human oversight
            "human_oversight": {
                "oversight_measures": self._describe_oversight(),
                "intervention_capabilities": [
                    "Emergency system shutdown",
                    "Manual response correction",
                    "Document source review"
                ],
                "recommended_competencies": [
                    "Business domain knowledge",
                    "Understanding of AI limitations",
                    "Specific tool training"
                ]
            },

            # 6. Performance metrics
            "performance_metrics": {
                "accuracy_metrics": {
                    "retrieval_precision": 0.85,
                    "retrieval_recall": 0.78,
                    "answer_relevance": 0.82,
                    "faithfulness": 0.90
                },
                "benchmarks_used": ["RAGAS", "custom_evaluation"],
                "test_conditions": self._describe_test_conditions()
            },

            # 7. Cybersecurity
            "cybersecurity": {
                "security_measures": [
                    "Data encryption at rest (AES-256)",
                    "TLS 1.3 for communications",
                    "Multi-factor authentication",
                    "Immutable audit logs"
                ],
                "vulnerability_assessment": {
                    "last_pentest": "2026-01-15",
                    "critical_vulnerabilities": 0,
                    "remediation_status": "completed"
                }
            }
        }

    def _describe_architecture(self, config: Dict) -> Dict:
        """Describe system architecture."""
        return {
            "type": "RAG (Retrieval-Augmented Generation)",
            "diagram_reference": "architecture_diagram_v1.png",
            "data_flow": [
                "1. Receive user question",
                "2. Embed the question",
                "3. Search for relevant documents",
                "4. Build context",
                "5. Generate response via LLM",
                "6. Post-process and add citations",
                "7. Return response to user"
            ]
        }

4. Record Keeping (Logs)

DEVELOPERpython
import logging
from datetime import datetime
from typing import Dict, Any, Optional
import json
import hashlib

class AIActLogger:
    """AI Act compliant logging system."""

    def __init__(self, system_id: str, storage_backend):
        self.system_id = system_id
        self.storage = storage_backend
        self.logger = logging.getLogger(f"aiact.{system_id}")

    async def log_interaction(
        self,
        interaction_id: str,
        user_query: str,
        system_response: str,
        retrieved_docs: List[str],
        metadata: Optional[Dict[str, Any]] = None
    ) -> Dict[str, Any]:
        """Record an AI Act compliant interaction."""

        log_entry = {
            # Identification
            "log_id": self._generate_log_id(),
            "interaction_id": interaction_id,
            "system_id": self.system_id,
            "timestamp": datetime.utcnow().isoformat(),

            # Input data (hashed for privacy)
            "input": {
                "query_hash": self._hash_content(user_query),
                "query_length": len(user_query),
                "detected_language": self._detect_language(user_query),
                "contains_pii": self._check_pii(user_query)
            },

            # Decision process
            "retrieval": {
                "documents_retrieved": len(retrieved_docs),
                "document_ids": retrieved_docs,
                "retrieval_scores": metadata.get("scores", []),
                "retrieval_time_ms": metadata.get("retrieval_time")
            },

            # Output
            "output": {
                "response_hash": self._hash_content(system_response),
                "response_length": len(system_response),
                "generation_time_ms": metadata.get("generation_time"),
                "confidence_score": metadata.get("confidence"),
                "sources_cited": metadata.get("citations", [])
            },

            # Technical metadata
            "technical": {
                "model_version": metadata.get("model_version"),
                "embedding_model": metadata.get("embedding_model"),
                "temperature": metadata.get("temperature"),
                "max_tokens": metadata.get("max_tokens")
            },

            # Control information
            "oversight": {
                "human_review_required": metadata.get("needs_review", False),
                "flagged_issues": metadata.get("flags", []),
                "automated_checks_passed": metadata.get("checks_passed", True)
            }
        }

        # Store the log
        await self.storage.store(log_entry)

        # Structured log for monitoring
        self.logger.info(
            "Interaction logged",
            extra={
                "interaction_id": interaction_id,
                "docs_retrieved": len(retrieved_docs),
                "response_time_ms": metadata.get("total_time")
            }
        )

        return log_entry

    async def log_incident(
        self,
        incident_type: str,
        severity: str,
        description: str,
        affected_interactions: List[str] = None
    ) -> Dict[str, Any]:
        """Record an incident for traceability."""

        incident = {
            "incident_id": self._generate_log_id(),
            "system_id": self.system_id,
            "timestamp": datetime.utcnow().isoformat(),
            "type": incident_type,
            "severity": severity,
            "description": description,
            "affected_interactions": affected_interactions or [],
            "status": "open",
            "reported_to_authority": severity == "critical"
        }

        await self.storage.store_incident(incident)

        if severity == "critical":
            self.logger.critical(
                f"Critical incident: {incident_type}",
                extra=incident
            )

        return incident

    def _generate_log_id(self) -> str:
        """Generate unique log ID."""
        timestamp = datetime.utcnow().isoformat()
        return hashlib.sha256(
            f"{self.system_id}:{timestamp}:{id(self)}".encode()
        ).hexdigest()[:16]

    def _hash_content(self, content: str) -> str:
        """Hash content for anonymized storage."""
        return hashlib.sha256(content.encode()).hexdigest()

Transparency Obligations for RAG Chatbots

Even at limited risk, RAG systems have transparency obligations:

Disclosure Implementation

DEVELOPERtypescript
// components/AIDisclosure.tsx
interface AIDisclosureProps {
  systemName: string;
  capabilities: string[];
  limitations: string[];
  dataUsage: string;
}

export function AIDisclosure({
  systemName,
  capabilities,
  limitations,
  dataUsage
}: AIDisclosureProps) {
  return (
    <div className="bg-blue-50 border border-blue-200 rounded-lg p-4 mb-4">
      <div className="flex items-start gap-3">
        <div className="flex-shrink-0">
          <svg className="w-5 h-5 text-blue-600" /* AI icon */ />
        </div>
        <div className="text-sm">
          <p className="font-medium text-blue-900 mb-2">
            You are interacting with {systemName}, an AI assistant
          </p>

          <details className="mt-2">
            <summary className="cursor-pointer text-blue-700 hover:text-blue-800">
              Learn more about this system
            </summary>

            <div className="mt-3 space-y-3 text-blue-800">
              <div>
                <h4 className="font-medium">Capabilities</h4>
                <ul className="list-disc ml-4 mt-1">
                  {capabilities.map((cap, i) => (
                    <li key={i}>{cap}</li>
                  ))}
                </ul>
              </div>

              <div>
                <h4 className="font-medium">Limitations</h4>
                <ul className="list-disc ml-4 mt-1">
                  {limitations.map((lim, i) => (
                    <li key={i}>{lim}</li>
                  ))}
                </ul>
              </div>

              <div>
                <h4 className="font-medium">Data Usage</h4>
                <p>{dataUsage}</p>
              </div>
            </div>
          </details>
        </div>
      </div>
    </div>
  );
}

// Usage
<AIDisclosure
  systemName="Ailog Assistant"
  capabilities={[
    "Answer questions about your products",
    "Provide information from documentation",
    "Cite sources used"
  ]}
  limitations={[
    "May produce inaccurate responses",
    "Cannot access real-time information",
    "Does not replace a human advisor"
  ]}
  dataUsage="Your messages are used only to generate responses. They are retained for 30 days then deleted."
/>

AI Act Compliance Checklist

For All RAG Systems (Limited Risk)

• Clear disclosure that user is interacting with AI
• Information about capabilities and limitations
• Human contact mechanism if needed
• AI-generated content marking

For High-Risk RAG Systems (Additional)

• Documented risk management system
• Data governance with traceability
• Complete technical documentation
• Compliant usage logs
• Human oversight measures implemented
• Robustness and cybersecurity testing
• Conformity assessment completed
• CE declaration of conformity
• Registration in EU database
• Post-deployment monitoring procedure

Conclusion

The AI Act represents a major change for RAG systems deployed in Europe. The good news: most RAG chatbots are classified as limited risk and only have transparency obligations. However, if you operate in sensitive domains (HR, finance, health), you will need to comply with high-risk system requirements.

Key takeaways:

1. Classify your system - Determine your risk level
2. Transparency is mandatory - Always inform that it's AI
3. Document everything - Keep records of decisions and processes
4. Prepare early - Full application arrives in August 2026

---

Further Reading

• GDPR and AI chatbots - Personal data compliance
• RAG audit trail - Request traceability
• RAG system evaluation - Quality metrics

---

Need an AI Act compliant RAG system? Ailog offers RAG solutions with built-in transparency and compliance documentation. Hosted in France, GDPR compliant and prepared for the AI Act.