Licensed to be used in conjunction with basebox, only.
// security
Compliance
- Version: 1.0
- As of: October 2025
- Scope: EU / Germany
- Reference: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
1. Purpose of this document
This document describes the role, responsibilities and legal framework of the basebox AI Management System in connection with the provision and use of AI models under the EU AI Act. It serves as evidence and guidance for audit, compliance and integration purposes.
2. System characteristics
Product name: basebox AI Management System Provisioning: basebox Server – dedicated installation on customer systems Components: - Management environment for AI models (apps, REST API, RAG integration) - Model provisioning (open-source models) - Local execution without external cloud dependency - Optional connection of external closed-source models (procured separately by the customer) Technical modification of models: Quantisation only (for runtime and memory optimisation). No fine-tuning, no retraining, no change to weights or architecture.
3. Legal classification under the EU AI Act
basebox GmbH (hereinafter basebox) acts as supplier / infrastructure provider within the meaning of Art. 3 No. 23 EU AI Act.
basebox provides a software environment that enables the operation of various AI models but does not determine the purpose, mode of use or content of the AI processing.
Responsibility for operation, purpose and results lies with the respective customer (deployer).
basebox is not a provider within the meaning of Art. 3 No. 2 EU AI Act, because:
- no new AI models are developed or trained,
- the shipped models are unchanged (quantised, but functionally identical),
- and the intended purpose is determined exclusively by the customer.
4. Obligations of basebox as supplier
basebox fulfils the obligations under Art. 25 EU AI Act as follows:
| Area | Measure |
|---|---|
| Prohibited practices | basebox provides no models that violate Art. 5 EU AI Act (e.g. social scoring, manipulative systems). |
| Transparency | Model source, licence and version are documented in the accompanying MODEL_REGISTER.md. |
| Unmodified transfer | Models are provided in quantised form only; no changes to weights or training data. |
| Documentation duty | Every release contains technical information and licence notices. |
| Security review | Before delivery, models are checked for documented security vulnerabilities and exploits. |
| Reporting duty | In case of known systemic risks or security-relevant incidents, basebox informs affected customers and competent authorities without delay. |
5. Obligations of the customer (deployer)
The customer is responsible for the use of the provided infrastructure and models.
In particular, the customer is responsible for:
- Risk classification of the use case (high, limited or minimal risk).
- Monitoring and logging of system usage.
- Human oversight (manual control over AI outputs).
- Transparency towards end users when AI content is generated or used.
- Training (AI literacy) of staff in accordance with Art. 4 (3) EU AI Act.
- Compliance with the GDPR, in particular for personal data.
6. Model categories in the delivery
| Type | Examples | Source / licence | Provisioning by basebox |
|---|---|---|---|
| Open-source LLMs | LLaMA (3.x), Mistral, DeepSeek and others | per original licence | ✅ included in the standard package |
| Closed-source LLMs | e.g. OpenAI GPT models, Anthropic Claude | procurement & licence by customer | ❌ not part of the delivery |
Note:
Closed-source models are connected only if the customer demonstrates a valid licence and configures the connection on their own responsibility.
7. Compliance and audit evidence
The following accompanying documents are part of the delivery:
MODEL_REGISTER.md– overview of all included modelsDISCLAIMER.md– legal delineation provider / deployerINFRA_POLICY.md– technical and organisational measuresSAFETY_NOTICE.md– notes on safe operation
Together these documents form the compliance package under the EU AI Act for the basebox AI Management System.
8. Contact
basebox GmbH
Compliance & Legal Operations
Bahnhofplatz 3
86919 Utting am Ammersee
Germany
datenschutz@basebox.ai
*This document forms part of the technical and legal system documentation.
It does not replace individual legal advice but describes the role and distribution of obligations under Articles 25–29 EU AI Act.*