Licensed to be used in conjunction with basebox, only.
// security
EU AI Act: What you need to know
Applies to
Product: Server · Audience: Data protection officers · Information security · Compliance · Decision makers
This page explains the five documents of the compliance package under the EU AI Act (Regulation (EU) 2024/1689). It only summarizes what the documents themselves say and is not legal advice. The wording of the documents is binding.
What the documents in this section are
Together, the documents form the compliance package under the EU AI Act for the basebox AI Management System. They are versioned: Compliance, Disclaimer, Infrastructure policy and Safety notice are dated October 2025, the Model register May 2026 (version 1.02). Their content is not updated continuously here. Where the product has changed since, the relevant page under Security & Compliance says so.
| Document | Content |
|---|---|
| Compliance | Legal classification, obligations of basebox and of the customer, model categories, contact |
| Disclaimer | Separation of roles and allocation of liability between basebox and the customer |
| Infrastructure policy | Technical and organizational measures with a status per measure |
| Model register | Delivered models with origin, license, version and quantization |
| Safety notice | Guidance for safe operation, known limitations, reporting incidents |
The role of basebox
According to the Compliance document, basebox acts as a supplier / infrastructure provider within the meaning of Art. 3 No. 23 EU AI Act. basebox provides the software environment but does not determine the purpose, type of use or content of the AI processing.
According to the Compliance document, basebox is not a provider (Art. 3 No. 2), because no new models are developed or trained, the models are only quantized and otherwise delivered unchanged, and the intended purpose is determined by the customer.
As a supplier under Art. 25, basebox among other things: provides no models that violate Art. 5; documents source, license and version in the model register; checks models for documented security vulnerabilities before delivery; informs affected customers and competent authorities without delay of known systemic risks or security-relevant incidents.
Your role and obligations as a deployer
As the customer, you are the deployer (Art. 3 No. 4) when you operate the system or use it with models. The Compliance document lists these obligations:
- Risk classification of the use (high, limited or minimal risk)
- Monitoring and logging of system use
- Human oversight, i.e. manual control over AI outputs
- Transparency towards end users when AI content is generated or used
- Training of staff (AI literacy)
- Compliance with the GDPR, in particular for personal data
If you retrain, fine-tune, modify or publicly provide a model, you become a provider yourself according to the Disclaimer, with the associated obligations (documentation, conformity assessment, CE marking). Closed-source models are not part of the basebox distribution; procurement, licensing and data protection are then your responsibility.
Cloud and Server
The package refers to basebox Server, the dedicated installation at the customer. By its own wording, the Infrastructure policy applies exclusively to basebox Server and calls basebox Cloud a separate product with no technical connection to Server installations.
For basebox Cloud, the pages under Security & Compliance describe infrastructure, roles and data processing: Cloud · Data processing & sub-processors.
Contact
Questions about the compliance package: datenschutz@basebox.ai.
Next step: Compliance · Compliance overview