AI Act assessment

• Provider when we develop and release an AI system under our name or substantially modify a third-party model.
• Deployer when we internally use third-party AI systems.
• Distributor or integrator when we integrate third-party models and services into client systems.
• The applicable role is agreed in writing for each project.

• Prohibited practices: we do not develop or integrate social scoring, subliminal manipulation, exploitation of vulnerabilities, workplace or education emotion recognition, real-time remote biometric identification or sensitive biometric categorisation.
• High risk: systems used for recruitment, promotion, termination, task allocation, performance monitoring, admission or assessment in education receive a dedicated screening before work starts.
• Limited risk: chatbots, conversational assistants and content generation, subject to transparency duties.
• Minimal risk: internal support tools without an impact on people's rights or opportunities.

• The public website does not run AI systems, profile visitors or make automated decisions.
• The restricted area can extract public page titles, descriptions and previews through deterministic automation.
• Future AI-assisted features will be classified, clearly labelled and reviewed by a person before publication.

• Documented lifecycle risk management and data governance.
• Technical documentation, event logs and clear deployer instructions.
• Effective human oversight with the ability to review, correct or override outcomes.
• Accuracy, robustness and cybersecurity proportionate to intended use.
• Fundamental-rights assessments and worker information where required.

People interacting with an AI assistant are told that it is an AI system. Synthetic content is labelled where required. We provide initial and continuing AI training to our team and include AI literacy in client adoption projects.

We review provider documentation, terms, input-data policies and copyright information. We minimise personal data and favour configurations that prevent client data from being used for retraining. The AI Act complements GDPR; see our privacy policy.

• An internal owner maintains a register of systems, roles and risk classes.
• Compliance screening takes place at project start and after substantial changes.
• Report incidents or concerns to info@enret.it.
• This document is reviewed at least annually.