OKiDO and the EU AI Act
Where OKiDO stands under the EU AI Act, what we do to meet our obligations, and what it means for you as a customer.
Last reviewed: October 25, 2026
Provider of an AI system
We build OKiDO and its AI agents and offer them in the EU. The agents run on general-purpose AI models from OpenAI and Anthropic. We do not train or supply general-purpose AI models ourselves.
Minimal risk, by intended purpose
OKiDO is made to run business processes. It is not intended for the high-risk uses listed in Annex III of the Act, such as hiring decisions or credit scoring, and our terms and templates keep it that way.
You decide where the gates go
Agents do the repetitive steps in a process your team designed. You choose which actions need approval, and an agent can never pass an approval gate: only a person can.
Where the Act stands
The AI Act applies in phases. In July 2026 the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744), which moved the high-risk dates back. The dates below are the law as amended.
- 2 February 2025In force
Prohibited AI practices are banned. Providers and deployers must support AI literacy among their staff (Article 4, softened in July 2026 to taking measures that support it).
- 2 August 2025In force
Obligations for providers of general-purpose AI models, such as the models OKiDO's agents run on.
- 2 August 2026In force
Transparency obligations (Article 50): people must know when they deal with AI, and AI-generated content must be marked.
- 2 December 2026Next
End of the grace period for machine-readable marking of AI-generated content by systems that were already on the market before August 2026.
- 2 December 2027Upcoming
Obligations for high-risk AI systems listed in Annex III, such as recruitment, worker evaluation, credit scoring and education. Moved from 2 August 2026.
- 2 August 2028Upcoming
Obligations for high-risk AI built into regulated products (Annex I), such as medical devices and machinery. Moved from 2 August 2027.
What applies to OKiDO, and how we meet it
These are the obligations that apply to us as the provider of OKiDO, and the ones we meet voluntarily because they make OKiDO safer to use for regulated work.
Article 5
No prohibited practices
OKiDO does not recognise emotions, categorise people by biometric data, score people socially or manipulate behaviour. Agents act only on steps in processes that you define. We check new features against Article 5 before they ship.
Article 50(1)
Transparency to people
Messages our agents send to people, by email or notification, say that an AI agent wrote them. Inside your workspace, every agent comment and change is marked with the agent's name. Shared run links and public forms show which steps an agent completed.
Article 50(2)
Marking AI-generated content
Documents and files our agents create carry a machine-readable marker that they were generated by AI, and record which run and step produced them.
Articles 14 and 26 (voluntary)
Human oversight
Approval gates in a run can only be passed by a signed-in person. For each agent, project, tool and connected app you choose which actions need approval. Sending email, inviting people, deleting tasks and starting runs need approval by default. You can pause an agent, or stop all of its runs, with one switch.
Articles 12 and 26(6) (voluntary)
Records
Every agent action is recorded: the tool it used, its inputs and result, who approved it and which model ran it. Audit records can't be edited or deleted from the app and are kept for two years. Owners and admins can export them as CSV or JSON.
Articles 3(12) and 25
Intended purpose
Our intended purpose is published below and is part of our Terms of Service. Templates that involve people, such as hiring, staff onboarding or quality reviews, are built so the agent prepares and a person decides. The agent does not rank, score or reject people.
Article 4
AI literacy
Our Docs explain what agents can and cannot do, how approvals work and how to read the record. Every customer can book free onboarding and training.
Articles 53 to 55 (model providers)
The models underneath
OKiDO's agents run on models from OpenAI and Anthropic. As providers of general-purpose AI models they carry the obligations for those models, and both have signed the EU's General-Purpose AI Code of Practice.
GDPR
Your data and the models
Content sent to OpenAI and Anthropic is used only to produce the response. Under their API terms it is not used to train their models, and we don't train models on your content either. Both are listed as sub-processors.
Intended purpose statement
This statement sets out the intended purpose of OKiDO within the meaning of Article 3(12) of the EU AI Act. It is part of our Terms of Service.
1. Intended purpose
OKiDO is intended for structuring, running, tracking and auditing business processes. Its AI agents are intended to carry out defined steps in processes that the customer designs: collecting and organising information, preparing drafts and summaries, updating records in connected applications, and routing work to the responsible person for review or approval.
2. Uses outside the intended purpose
OKiDO is not intended, and must not be used, as the sole or decisive basis for:
- recruiting or selecting people, including screening, ranking or evaluating job candidates;
- decisions on promotion, termination, pay or other terms of work, allocating tasks based on a person's behaviour or personal traits, or monitoring and evaluating the performance or behaviour of individual workers;
- assessing the creditworthiness of natural persons, pricing life or health insurance for natural persons, or deciding eligibility for public benefits or essential services;
- admission, assessment, grading or proctoring in education and vocational training;
- biometric identification or categorisation, emotion recognition, law enforcement, migration, asylum and border control, or the administration of justice and democratic processes;
- safety components in the management and operation of critical infrastructure.
A customer who uses OKiDO for one of these purposes acts outside its intended purpose. Under Article 25 of the EU AI Act, that customer may become the provider of a high-risk AI system for that use, with the obligations that come with it.
3. Human oversight
Agent output is a proposal inside a process owned by a person. Approval gates, named owners and the record are part of how OKiDO works, and must stay in place in any process whose outcome affects a person.
4. Prohibited practices
OKiDO must not be used for any practice prohibited by Article 5 of the EU AI Act.
What it means for you
When you use OKiDO in your business you are a deployer under the Act. For processes inside OKiDO's intended purpose your duties are light. This is what applies, and what OKiDO gives you for each.
Article 4
AI literacy
Your duty
Take measures so the people who run AI-assisted processes understand what the AI does, where it can go wrong and how to supervise it.
What OKiDO gives you
Our Docs and free onboarding and training cover agents, approvals and the record.
Article 50(4)
Transparency
Your duty
If you publish AI-generated text to inform the public on matters of public interest without human review, or publish deepfakes, say that AI made it.
What OKiDO gives you
Put an approval gate before anything you publish, and the record shows a person reviewed it. Messages that agents send to people carry the AI label automatically.
Articles 25 and 26, from 2 December 2027
High-risk uses
Your duty
If you use AI for a high-risk purpose, such as screening candidates or evaluating staff, much heavier duties apply: human oversight, keeping logs for at least six months, informing workers and, as a provider, a conformity assessment.
What OKiDO gives you
OKiDO is not intended for these uses. If a process touches them, keep the decision with a person and let the agent only prepare. Our gates and records support you either way.
GDPR
Personal data
Your duty
You are the controller of the personal data in your processes. We process it on your behalf.
What OKiDO gives you
Our Data Processing Agreement and sub-processor list are published. OKiDO does not make automated decisions about people that have legal or similarly significant effects.
Practical steps when you adopt OKiDO
- 1
Check each process once.
Use the self-check. Everyday operations (onboarding, month-end close, incidents, delivery, sign-off) are minimal risk. Flag anything that touches hiring, staff evaluation, credit or essential services.
- 2
Keep decisions about people with people.
If a process touches a high-risk area, let the agent collect, schedule and draft, and let a named person decide after a real review.
- 3
Put a gate before anything that leaves your organization.
Offers, invoices, notices, reports: a human approval step before release is cheap, and the record then shows that a person reviewed it.
- 4
Name real owners.
Owners should be people with authority over the outcome, not a shared mailbox.
- 5
Tell your team.
Explain which steps an agent runs before a process goes live, and point people to the Docs.
- 6
Check again when things change.
Run the self-check again when you add templates, agents or connected apps. We update this page when the Act or its guidance changes.
Check your processes in two minutes
Tick what a process does and see its likely risk tier under the AI Act, the duties that follow and the dates that apply. No sign-up needed.
Who is responsible for what
Responsibility under the Act is split along the chain. This is who carries what when you run your processes on OKiDO.
| Topic | Model provider | OKiDO | You |
|---|---|---|---|
| General-purpose model obligationsArticles 53 to 55 | Responsible | Uses model providers that signed the GPAI Code of Practice | No duty |
| Prohibited practicesArticle 5 | Safeguards in the model | No prohibited features; new features checked | Doesn't set up prohibited uses |
| Intended purpose and classificationArticles 3, 6 and 25 | No duty | Responsible | Classifies its own processes; responsible for any use outside the intended purpose |
| TransparencyArticle 50 | Marking in the model where available | AI labels and machine-readable marking | Keeps labels on; reviews what it publishes |
| RecordsArticles 12 and 26(6) | No duty | Records, two-year retention, export | Keeps exports longer if its own rules require it |
| Human oversightArticles 14 and 26(2) | No duty | Approval gates, approval rules, pause and stop controls | Responsible |
| AI literacyArticle 4 | No duty | Docs, onboarding and training | Responsible |
| Personal dataGDPR | Sub-processor | Processor, under our Data Processing Agreement | Controller |
How we use AI ourselves
We hold ourselves to the same rules. The operations audit on this site is an AI interview, and it says so. Our blog posts and newsletters are drafted with AI and reviewed by our team before they are published.
Questions we get about the AI Act
OKiDO meets the obligations that apply to it as the provider of a minimal-risk AI system: no prohibited practices, transparency to people who deal with our agents, and marking of AI-generated content. We also offer human oversight and records that the Act only requires for high-risk systems. There is no official certificate for AI systems outside the high-risk category, so this page and our records are how we show it.
No. OKiDO's intended purpose is running business processes, which is not on the high-risk list in Annex III. A use becomes high-risk if OKiDO is used as the decisive basis for, for example, hiring or staff evaluation. That is outside our intended purpose, and our terms say so.
OKiDO gives you the controls and the evidence: approval gates, AI labels, records and exports. Whether a particular process is compliant depends on how you use it, which is why the self-check works one process at a time. The classification of your own processes stays with you.
Yes, if an AI agent sends it. OKiDO adds the label to messages our agents send, so you don't have to remember it. A draft that a person reviews and sends themselves is their own message.
No. Content sent to OpenAI and Anthropic is used to produce the response. Under their API terms it is not used to train their models, and we don't train models on your content.
Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), and softened the AI literacy duty. The transparency duties in Article 50 still apply from 2 August 2026.
Related documents
Legal notice
This page describes our assessment of OKiDO under Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744, and the features OKiDO provides to support your own compliance. It is information, not legal advice. It does not replace your own assessment as a deployer, or as a provider if you use OKiDO outside its intended purpose. We review this page at least every quarter and whenever the Act, its guidance or harmonised standards change.
Questions, or a request for our records or Data Processing Agreement: [email protected]