This is the document set to which the AI Act framework in the compliance register refers. Owner: the owner of Stilops (role CISO/responsible person); drawn up on 24-7-2026 as the completion of the project "Compliance — AI Act", subsequently updated on the dates stated per section.
This overview is the public part of the file. The documents in the table below that are marked as "internal" are working documents and cannot be accessed via the register; upon request ([email protected]) we share them with a customer, auditor or supervisory authority.
Key conclusion in three sentences
Stilops is a deployer and downstream provider of AI systems built on general-purpose models from an external model provider (Anthropic); the GPAI obligations of Chapter V lie with that model provider. Under its current design and use, no Stilops application falls under an Annex III category or a prohibited practice — the classification is limited risk, as a result of which the hard obligations are transparency (art. 50) and logging/retention (art. 12/19). Both are, according to this file, in place; whether that counts as 'fulfilled' per control is stated in the public compliance register — and there an assessment only counts after the owner has confirmed it. The documents for art. 9, 11, 15 and 72 are a proportionate, voluntary baseline: high-risk-ready on paper, deliberately not claimed as high-risk (no CE marking, no art. 43 conformity assessment).
Documents
| Document | Article(s) | Control ID | Nature | Availability |
|---|---|---|---|---|
| Risk classification | art. 3/6, Annex III | ai-act:art.3/6 | mandatory baseline | internal, upon request |
| Risk management | art. 9 | ai-act:art.9 | voluntary baseline | internal, upon request |
| Technical documentation | art. 11/18, Annex IV | ai-act:art.11/18 | voluntary baseline | internal, upon request |
| Accuracy and robustness | art. 15 | ai-act:art.15 | voluntary baseline | internal, upon request |
| Transparency | art. 50 | ai-act:art.50 | mandatory | internal, upon request |
| Post-market monitoring | art. 72 (and 73) | ai-act:art.72 | voluntary baseline | internal, upon request |
| AI literacy for the customer's employees | art. 4 | ai-act:art.4 | mandatory (best efforts) | public |
| Incident and data breach procedure §4 | art. 73 (time limits) | nis2:art.23 | mandatory in case of serious incident | for customers |
Digital Omnibus — Regulation (EU) 2026/1744 (updated 2-9-2026)
Checked on EUR-Lex (https://eur-lex.europa.eu/eli/reg/2026/1744/oj): "Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)". Published in the Official Journal on 24-7-2026, entering into force on the third day thereafter: 27-7-2026.
What the Omnibus changes, and what that means for Stilops:
| Item | Before | After | For Stilops (limited risk, provider + deployer) |
|---|---|---|---|
| High-risk Annex III (art. 6(2)) | 2-8-2026 | 2-12-2027 | Not applicable — no Annex III match (risk classification). The date is only relevant if a re-assessment trigger is ever met. |
| High-risk Annex I (art. 6(1)) | 2-8-2027 | 2-8-2028 | Not applicable. |
| Art. 4 AI literacy | "ensure a sufficient level" | "take measures to support the development"; explicitly: no guarantee of a particular level per person | Has applied since 2-2-2025 and continues to apply. New control ai-act:art.4; the customer note on AI literacy is Stilops' measure towards customers, the internal work instructions are the internal one. Open: a fixed moment for offering it to the customer. |
| Art. 50 transparency | applicable from 2-8-2026 | unchanged: applies since 2-8-2026, with a four-month transition period for the marking under art. 50(2) for systems that were already on the market before 2-8-2026 | Stilops has been marking since 24-7-2026 (Transparency document); the transition period is not needed. Verified in the code on 2-9-2026. |
| Governance, GPAI, penalties | 2-8-2025 | unchanged | GPAI obligations lie with Anthropic. |
In short: the Omnibus lightens nothing for Stilops and adds no burden. The two hard obligations (art. 50, art. 12/19 baseline) already applied and are, according to this file, in place; art. 4 has been softened but was already a best-efforts obligation. The postponed high-risk requirements were never applicable. The explanation for control art.113 in the register has been updated accordingly.
Commission guidelines since the Omnibus (updated 17-9-2026)
- Art. 50 — final guidelines (20-7-2026) and Code of Practice on Transparency of AI-Generated Content (declared adequate by the Commission and the AI Board on 8/9-7-2026). Relevant for Stilops: an agent that communicates with persons must, at first contact, state both its AI nature and the organisation on whose behalf it acts; "routine or pro-forma review" does not count as the editorial responsibility of art. 50(4). The current channels comply because no autonomous channel to third parties exists (Transparency document); since 18-9-2026 Stilops itself adds the notice to every e-mail that an agent drafts, and since 4-10-2026 as a single sentence in the language of the recipient.
- Art. 6 — draft guidelines on high-risk classification (19-5-2026, consultation until 23-7-2026, final version expected before 2-12-2027). Two points affect Stilops: (1) a composite or agentic system is assessed as one AI system — keeping modules separate does not change the class; (2) the art. 6(3) exceptions ("preparatory", "narrow procedural task") do not apply as soon as the system profiles natural persons. "A human approves the proposal" is therefore not a classification argument in recruitment or credit. New re-assessment trigger in the risk classification.
- AI agents are, according to the Commission, not a separate category (AI Act Service Desk, FAQ 2026); the existing definitions and art. 5(1)(a)–(b) apply. Full assessment and sources: the Autonomy Assessment of 17-9-2026 (internal working document; available upon request via [email protected]).
Maintenance
- Annual review of the entire set, or earlier upon a re-assessment trigger from the risk classification.
- The technical documentation largely refers to the architecture documentation in the repository; this remains up to date through the rule that an architectural change updates its documentation in the same change.
- Control statuses in the compliance register are assessed internally (by the owner or by an agent run, recognisable by the agent name accompanying the assessment); a 'fulfilled' or 'not applicable' appears on the public register only after the owner has personally confirmed that assessment — never automatically from these documents.