MAIBOH and the EU AI Act
MAIBOH is designed with compliance as a founding principle. Local mode is not an AI system under the EU AI Act. Live AI operates as limited risk with full transparency.
Risk Classification
| Mode | Classification | Rationale |
|---|---|---|
| MAIBOH Local | Zero Risk | Not an "AI system" (Art. 3(1)). Retrieves pre-written, human-approved text via fixed matching rules. Does not infer, generate, or adapt. |
| MAIBOH Live AI | Limited Risk | Generative AI system with transparency obligations (Art. 50). Visible badges, audit log, human oversight. |
Why MAIBOH Local Is Not an AI System
- Art. 3(1): The AI Act applies to systems that "infer" from inputs. MAIBOH Local retrieves pre-written text via fixed matching rules.
- Annex III: Not used for critical decisions (training access, result evaluation, surveillance).
- Art. 5: Does not manipulate, profile, or perform emotion recognition.
- Intrinsic transparency: Every response is labelled with a "Local" badge and its nature is clearly explained.
- Upstream human control: Every piece of content is reviewed and approved by an instructional designer before publication.
MAIBOH Live AI Compliance Controls
- Art. 50: Transparency badge: Every AI response shows the model used, user-toggleable, with screen-reader fallback.
- Art. 14: Human oversight: Approval board for AI courses: no content is published without human approval.
- Complete audit log: Model, latency, tokens consumed, failover events for every interaction.
- Circuit breaker: Multi-model cascading failover with RouteLLM for resilience and continuity.
- User feedback: Built-in mechanism for reporting problematic AI outputs.
- Compliance dashboard: Dedicated admin section with EU AI Act, GDPR, FRIA/DPIA data.
Cyber Resilience Act
MAIBOH is aligned with the Cyber Resilience Act (CRA) through:
- Security by design at every architectural level
- Row Level Security, JWT, SECURITY DEFINER functions
- Rate limiting and brute-force protection
- Error boundary and recovery system
- Session management with refresh and expiry detection
Honesty statement: MAIBOH provides product-level compliance controls (transparency, audit logging, human oversight, data isolation). Organisational obligations such as DPO appointment, DPIA and AI governance remain the responsibility of the deploying organisation.