EU AI Act — Our Position

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's risk-based law for artificial intelligence. This page sets out NDEVR's good-faith assessment of how the Act applies to OWL's optional AI features — the QUAIL assistant and AI-assisted modeling — how we classify their risk, and what we do (and will do) to meet the relevant obligations.

Part of NDEVR's compliance & conformity program · Questions: privacy@ndevr.org. See also our privacy policy and NIST AI RMF alignment.

Assessment in progress — not a legal conclusion. This is NDEVR's own analysis, published for transparency. It is not legal advice, not a conformity declaration, and not a settled legal classification. The Act's obligations phase in over several years and implementing guidance and harmonized standards are still emerging; we will update this page as they do, and our position is subject to review by counsel.

1. OWL's AI features

OWL's AI is optional and opt-in. If you never use it, no prompts or images are sent to any AI model. When you do use it:

  • QUAIL assistant relays your prompt text to an AI model to generate a response.
  • AI-assisted modeling can additionally capture rendered images of your current scene (or reference images you supply) and send them to the model so it can "see" what you are working on.
  • The model may be one we host ourselves or one operated by a third-party AI provider, and we may change providers as the service evolves (see sub-processors).
  • We do not send your username, account identity, files, or email with the prompt or image. We keep only per-request usage counts (model, token counts, status) for billing and rate-limiting, and we do not retain your prompts, images, or the AI's responses beyond serving the request.
  • No-training guarantee. We do not use — and we require any third-party AI provider we use not to use — your prompts or images to train AI models.

Full detail is in the privacy policy.

2. Our role under the Act

The AI Act assigns obligations primarily by role. NDEVR's assessment:

  • We are not a provider of a general-purpose AI (GPAI) / foundation model. We do not train or place such a model on the market; we use a model (our own or a third party's) to power a feature.
  • We act as a deployer of AI within OWL, and — where we relay prompts to and surface output from a model — as a downstream actor integrating an AI system into a product. The GPAI-provider obligations fall on whoever supplies the underlying model, not on us as an integrator.

3. Risk classification

The Act sorts AI uses into four tiers. Our assessment of OWL's features:

AI Act risk tierApplies to OWL?
Unacceptable / prohibited (e.g. social scoring, manipulative or exploitative systems, untargeted facial-image scraping, most real-time biometric ID)No. OWL does none of these.
High-risk (Annex III — biometric ID, critical infrastructure, education/employment/credit decisions, law enforcement, etc.)No. OWL's AI is a productivity assistant for modeling and chat; it makes no decisions in any Annex III domain.
Limited-risk / transparency (systems that interact with people or generate/manipulate content)Yes — this is where we land. QUAIL is a user-facing assistant and the modeling features produce AI-generated content, so the relevant duties are transparency ones: users should know they are interacting with AI and that output is AI-generated.
Minimal-risk (everything else)Parts of the experience fall here, but we treat the AI features under the transparency tier to be safe.

So our good-faith position is that OWL's AI features are limited-risk, triggering mainly transparency obligations rather than the high-risk conformity-assessment regime.

4. Transparency measures

Consistent with the transparency tier, we provide (and continue to strengthen):

  • Clear AI labeling. QUAIL and the AI-assisted modeling features are presented as AI assistants, so it is evident you are interacting with AI and that generated output is AI-produced.
  • Up-front disclosure of what is sent. The privacy policy states plainly that prompts (and, for image features, rendered scene images) are sent to a model, that no account identity or files accompany them, and that you can simply not use the image features if you do not want an image processed.
  • The no-training guarantee, applied to us and required of any third-party provider.
  • User control. AI is opt-in; you decide whether it runs at all.

5. Timeline

The Act applies in phases. Indicative dates:

MilestoneDate
AI Act enters into forceAugust 2024
Prohibited-practice rules applyFebruary 2025
GPAI-model provider obligations applyAugust 2025
Most remaining obligations (incl. many high-risk) applyAugust 2026
Certain high-risk obligations (products under other EU law) applyAugust 2027

Because OWL's AI features are not prohibited and not high-risk, the obligations most relevant to us are the transparency ones; we are tracking the phase-in and will update this assessment as guidance and harmonized standards are published.

6. Scope & honesty

This is NDEVR's good-faith, point-in-time assessment — not legal advice, a certification, or a declaration of conformity. We have not asserted that any obligation tied to a future date is already "met." If you have a specific AI-compliance requirement for evaluating OWL, contact privacy@ndevr.org.