What applies depends on the system, how you use it, how it is classified and your role under the Act. We map which AI systems you use and what data goes in and comes out, assess where each one falls under the Act, and prepare your teams for when something goes wrong.
Last reviewed: 21 September 2026
Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. You become one by rebranding a vendor's AI, substantially modifying it, or using it for a purpose the vendor never intended.
Uses an AI system under its own authority in a professional context. This is where most organisations using third-party AI sit.
Using or licensing a third-party AI system therefore doesn't automatically put you outside the scope of the Act. Your role and obligations depend on the system and how you use it.
Under Article 3(1), a component is an AI system when it infers an output, such as a prediction, score, recommendation or content, rather than following rules a person wrote out in full. Deciding which components that applies to is the first piece of work.
| Component | AI system? | Why |
|---|---|---|
| Last-click attribution model | No | Fixed calculation |
| Rules-based audience segment | No | Conditions written by a person |
| Consent management platform | No | Records a choice |
| Value-based bidding or propensity score | Yes | Infers a prediction that drives spend |
| Personalisation or recommendation engine | Yes | Infers a recommendation and acts on it |
| Generative ad copy or a website chatbot | Yes | Generates content, talks to people |
We do the technical and classification work and document the evidence behind it. Your legal or compliance team makes the final call. Data Governance →
Three services, each for a different stage. They build on each other, and you can start with any of them.
AI Data Flow Assessment
What enters each AI system, where it comes from, who receives it and what happens to the output. Checked against the actual implementation as well as the documentation.
AI DPIA and FRIA
Whether your AI use case needs a DPIA or FRIA, and we carry it out or review the one you have. Worth repeating when the system, the data or the supplier changes.
AI Incident Response and Communication Training
Who recognises, escalates and decides when an assistant leaks information or an agent does something unintended, and who informs customers or regulators.
Prohibited AI practices and AI literacy
Governance rules and general-purpose AI models
General application, including the transparency obligations in Article 50. Generative systems already on the market have until 2 December 2026 for machine-readable marking.
High-risk AI systems listed in Annex III
High-risk AI embedded in regulated products
Your role under the Act and the requirements that apply are then established with legal or compliance counsel.
We support the technical work around that assessment: documenting systems and data flows, finding gaps in monitoring and data controls. We support the technical work around that assessment: documenting systems and data flows and finding gaps in monitoring and data controls.
We document how the system is implemented, what data it collects and processes, and how the technical controls work. Your legal or compliance advisers decide which disclosures or other measures are required. European Commission Article 50 guidance →
There is no single disclosure rule that applies identically to every organisation using a chatbot.
Article 50 places transparency obligations on providers and deployers in specified situations. Which requirements apply depends on your role, how the system is implemented and what it is used for.
If you use a third-party chatbot, that means first establishing what the provider has implemented and how your own organisation uses the system.
Before anyone decides what to disclose, someone has to know what the chatbot actually does with the data.
The AI Act does not replace GDPR. Where an AI system processes personal data, EU data protection law still applies.
The two frameworks ask different things, but both can require you to understand the data moving through an AI system: what it receives, where that came from, how it is processed and which systems receive it afterwards.
In the Netherlands, the Dutch implementation bill names the Autoriteit Persoonsgegevens as supervisor of the AI Act transparency obligations. The AP already supervises how personal data is processed, so the data flows behind your AI and your marketing come under the same lens.
As we see more and more artificial intelligence is becoming part of everyday business operations. Organizations are increasingly using AI in advertising platforms, customer service, personalization,...
ReadA common situation with AI governance is that it doesn't fail due to policy, but rather fails to achieve success in its implementation. Although most organizations are able to draw up an AI policy,...
ReadIf you're a Dutch marketing team checking whether your website meets consent requirements, you will often hear that it uses Google Consent Mode. Even though this is useful, it answers a narrower...
ReadWe don't provide legal advice or certify compliance. We do the classification assessment and the technical evidence behind it, and your legal or compliance team makes the final call.
For each AI system: what it is used for, what data it receives and produces, where that data comes from and goes to, which controls are in place, and who is responsible for it. That record is what your legal team works from.
To the parts that infer rather than calculate. Bidding algorithms, propensity models, personalisation engines, generative content tools and chatbots are AI systems under Article 3(1). Attribution calculations, rules-based segments and consent platforms are not.
We help you build the inventory, document the data layer, find the gaps in monitoring and technical controls, and maintain the setup alongside your legal or privacy team.
Cloud Nine Digital
Johann Siegerstraat 24
1096 BH
Amsterdam, Netherlands
T: +31 (0)20 787 1323
E: info@cloudninedigital.nl
Please do reach out. We are happy to help!