Regulation (EU) 2024/1689

EU AI Act Compliance

How AffordableAI fits into the EU regulatory framework. Last updated: June 2026.

Classification

We serve an open-weight AI model on EU infrastructure. We do not develop or train models. Under the AI Act we are a downstream provider of an AI system — not the GPAI model provider, which is DeepSeek. Because the service is not high-risk, our substantive obligations reduce to the Article 50 transparency requirements.

Classification	Status	Basis
GPAI model provider Art 51–56	N/A	DeepSeek trained V4 Flash. We serve existing weights. DeepSeek bears Chapter V obligations.
High-risk AI system Art 6, Annex III	N/A	Coding assistance is not biometrics, critical infrastructure, education, employment, or law enforcement.
Prohibited practice Art 5	N/A	No social scoring, surveillance, exploitation, or emotion recognition.
Downstream provider Art 50	Applicable	We serve AI-generated content under our own brand. Article 50 transparency obligations apply.

Obligations

✓
Art 50 — Transparency
All API responses carry X-AI-Generated: true. The website states the AI origin of outputs.
✓
Art 4 — AI literacy
Staff understand model capabilities, limitations, and risks. Internal documentation maintained.
✓
Model transparency
Public documentation: model version, origin (HuggingFace/MIT), architecture, known limitations.
✓
Art 53(2) — open-source exemption
DeepSeek V4 Flash: MIT license, public weights, public architecture. The model provider bears 53(1)(c)–(d).
○
Dutch B.V. registration
Registration of Affordable AI B.V. with RDI (AI supervisor) and AP (data protection) is in progress.

Not required

✗
CE marking
High-risk systems only.
✗
EU database registration
Art 49 — high-risk only.
✗
Conformity assessment
Art 43 — high-risk only.
✗
Risk management system
Art 9 — high-risk only.
✗
Human oversight mechanisms
Art 14 — high-risk only.

Infrastructure & sub-processor security

We do not operate our own data centres. Inference and platform services run on audited European infrastructure, and the certifications below belong to those providers — they cover the layer our service runs on. AffordableAI is not itself SOC 2 or ISO 27001 audited; these are inherited assurances, not our own attestations.

Provider	Role	Certifications (per provider)
Verda	GPU compute for inference (Finland)	SOC 2 Type II; ISO 27001, 27017, 27018, 27701; 100% renewable
Scaleway	Website and API hosting (Amsterdam, NL)	ISO 27001 + SOC 2; EU provider
Clerk	Authentication and identity	SOC 2 Type II
Mollie	Payment processing	PCI-DSS Level 1

ISO 27701 (held by our inference provider) maps directly to GDPR processor obligations, and zero prompt/output retention keeps the personal data in scope to a minimum. Full sub-processor detail and audit-report availability are in the Data Processing Agreement.

Timeline

Phase	Deadline	Action	Status
Prohibited practices ban	2 Feb 2025	Comply or cease	Compliant
GPAI model obligations	2 Aug 2025	Verify DeepSeek compliance	Compliant
AI literacy	2 Feb 2025	Staff training	Complete
Dutch B.V. registration	Before serving	RDI + AP	In progress
Art 50 transparency	2 Aug 2026	AI labelling	Complete
DPA publication	Before customers	GDPR data processing agreement	Drafted

Legal references

Article	Subject	Relevance
Art 3	Provider vs deployer definitions	We are a downstream provider; DeepSeek is the GPAI model provider
Art 5	Prohibited practices	None apply to coding assistance
Art 6, Annex III	High-risk classification	Coding tools are not listed
Art 25	Responsibilities along the value chain	Serving under our own brand makes us a downstream provider
Art 50	Transparency obligations	We label AI-generated content
Art 53(2)	Open-source exemption	DeepSeek V4 Flash qualifies (MIT)

This page is a compliance summary, not legal advice. Full text: EUR-Lex. Questions: hi@affordableai.eu