ndaact.ai and the EU AI Act

Last updated : 2026-10-14

What ndaact.ai is not

ndaact.ai is not a high-risk AI system under the EU AI Act (Regulation (EU) 2024/1689). The tool detects personal data to replace it with markers before sending to a third-party LLM. It makes no automated decision producing a legal or significant effect on a person (no scoring, no credit, hiring or judicial decisions). Functionally it’s closer to a data loss prevention (DLP) tool than to an AI system regulated under Annex III of the Regulation.

We therefore don’t claim that ndaact.ai makes you compliant with the AI Act, neither overall nor for a high-risk system: that’s neither its role nor its scope.

Where the AI Act actually touches ndaact.ai users

If you’re a lawyer, notary, physician or DPO using general-purpose LLMs in your practice, you yourself, as a professional or organization, are an “AI deployer” under the Regulation. Two general obligations apply, regardless of the risk level of the use:

  • Article 4 — AI literacy (applicable since 2 February 2025): an obligation to ensure that people using AI within your organization have a sufficient level of skill and understanding of the tool.
  • Demonstrating documented governance of your AI usage (control measures, logging) is a recognized good practice, whether or not your organization has formalized an AI management system (AIMS, ISO/IEC 42001 standard).

What ndaact.ai concretely contributes to this effort

  • A documented control measure on a specific risk: personal data leaking to uncontrolled third-party generative AI.
  • A usage log (timestamp, type of data detected) that can serve as an actionable trace within your own AI governance record, alongside other measures you put in place.

What we don’t claim

  • ndaact.ai is not an AI management system (AIMS) and doesn’t substitute for one.
  • Using ndaact.ai doesn’t exempt your organization from its own AI literacy (Article 4) or governance obligations. It is only one control among those such a program has to include.
  • We never present ndaact.ai as a compliance tool for a high-risk AI system.

For you to judge

Connecting ndaact.ai to your own AI governance effort (voluntary AIMS, risk register, internal policy) is a decision for your organization, ideally alongside your DPO, CISO or a qualified advisor. The AI Act’s regulatory framework also keeps evolving, with harmonized standards still being developed.