Checklist provider vs deployer of AI Chatbots (AI System)
The content of this page is a checklist for determining the provider vs. operator status of AI systems in the form of AI chatbots within the meaning of the EU AI Act (version 1.0).
The checklist is based on the following workflow. It is described in more detail in the technical article Provider vs. deployer of AI systems within the meaning of the EU AI Acts:
The checklist can be downloaded here as a link and as a freely usable PDF by clicking on the image below.
1. Objectives of this checklist:
This checklist helps providers and operators of AI chatbots to assess which role and which obligations they have based on which factors.
The checklist refers exclusively to AI systems within the meaning of Article 3 No. 1, No. 66 EU AI Act and in particular to AI chatbots with a general purpose.
2. Target group of this checklist:
- Legal, ethics & compliance
- Communication and marketing
- Software development
- Product/project management
- IT and Operations
Background information and technical details on the checklists can be found in this article on checklists for the EU AI Act.
3. Contents of the checklist as HTML:
| 1. AI system? |
| First, check whether the (planned) chatbot is actually an AI system within the meaning of the EU AI Act or which variant of an AI system is present: |
| If the definition of AI systems according to Article 3 No. 1 EU AI Act is met, e.g.: |
| – Is the offer machine-based and does it have an interaction interface? |
| – Are the other criteria met, especially autonomous operation? |
| Is the AI system used for direct interaction, Article 50 (1) EU AI Act? |
| – Is the AI system designed to interact directly with natural persons? |
| – For example, is it an AI chatbot in the form of an application or in browser-based form? |
| Is it a GPAI system with a general purpose, Article 50 (2) EU AI Act): |
| – Is it an AI system that incorporates a general-purpose AI model (as defined in Article 3 No. 63 EU AI Act) |
| – Can the AI system create synthetic content such as image, sound, video or text using a generative AI model? |
| 2. Providership? |
| Check the providership of the AI chatbot: |
| Development of the AI system: |
| – Was the AI chatbot developed in-house? |
| – Was the AI chatbot developed by a third party on its own behalf? |
| – Has another provider’s AI chatbot been significantly individualized? |
| In addition – placing on the market: |
| – Was the AI chatbot placed on the market under its own name or trademark for a fee or free of charge? |
| – Was the AI chatbot put into operation under its own name or the trademark for a fee or free of charge? |
| – Could it appear from a users perspective that one of the previous two variants applies? |
| 3. Provider obligations? |
| Check whether your AI chatbot meets the transparency obligations of Article 50 (1) and (2) EU AI Act as well as the imparting of AI literacy within the meaning of Article 4 EU AI Act. |
| Information for users, Article 50 (1) EU AI Ac): |
| – Was the AI chatbot designed and developed to inform users that it is interacting with an AI system? |
| – Is this obvious from the point of view of a reasonable natural person based on the circumstances and context? |
| Labeling of content in generative AI chatbot, Article 50 (1) EU AI Act: |
| – Is it ensured that the outputs of the AI chatbot are labeled in a machine-readable format and recognizable as artificially generated or manipulated? |
| – Does the AI chatbot only have a supporting function for standard editing or is input data or its semantics not significantly changed? |
| AI literacy: |
| – Is it ensured that people who are involved with the AI chatbot have sufficient AI literacy? |
| – Are they taking sufficient account of their technical knowledge, experience, education and training, and context? |
| 4. Deployership? |
| Check whether you are (additionally) a deployer within the meaning of Article 3 No. 4 EU AI Act. |
| Is the AI chatbot used on your own responsibility? |
| Is there a business and not a purely private use? |
| 5. Deployer obligations? |
| Check whether your AI chatbot meets the disclosure requirements of Article 50 (4) EU AI Act as well as the teaching of AI literacy within the meaning of Article 4 EU AI Act. |
| – Disclosure of deepfakes, Article 50 (4) sentence 1 EU AI Act): |
| – In the case of image, sound or video content, is the disclosure that deepfakes have been artificially created or manipulated ensured? |
| Disclosure of artificially generated texts, Article 50 (4) sentence 3 EU AI Act: |
| – Is the AI system being used to generate or manipulate text that is published to inform the public about matters of public interest? |
| – Is it disclosed that the text was artificially created or manipulated? |