An insurance brokerage in Porto, ninety people. A client's supplier questionnaire asks which AI systems process their data. The compliance officer checks the software register. No product, no licence, no line in the budget. She answers none.

Four months later the client writes to say how much better the claim summaries have become. An account manager had been pasting claim files into a free chatbot on her own account since spring.

The EU AI Act never asks who paid for the licence. Article 3, point 4 defines a deployer as anyone using an AI system under its authority, except where the use is a personal non-professional activity. The one real exit, in Article 2, paragraph 10, is for people, not for workplaces.

This episode: what being the deployer of a chatbot you never bought actually costs, which is less than most people are braced for. Why Article 4 carries no European fine, and why that is not the relief it sounds like. One practice prohibited outright and available today on a free account. And why nothing in Article 26 touches that pile of job applications until 2 December 2027, while the duty waiting there cannot be met for a system nobody declared.

Then the honest part. The Act forbids nothing about who owns the tool. The real exposure is data protection, trade secrets and your own contracts. Banning it is almost always the wrong move, and two things here are genuinely unsettled.

Nineteen minutes, every article number checked.

DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility.

Information, not legal advice. Before you answer question nine, talk to a lawyer.

CHAPTERS

0:00 These are AI voices, and why we say so first

1:22 Welcome to Project Cognivora

1:59 The form that said no

2:28 Who the law calls the user, and it is not the typist

3:34 The one exit, and why nobody at work is near it

4:26 What it costs, and it is less than you are bracing for

6:11 Article 50, and the moment the output leaves the building

7:07 The prohibited one, available today on a free account

9:32 Recruitment, Article 26, and the date that is not yet

11:11 The agent switched on over the weekend

12:33 What the Act does not say, and where the risk really sits

15:12 The contractor, and the words on their behalf

15:38 Ninety seconds: five things to do on Monday

17:47 What happened in Porto, and who to send this to

SOURCES

Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

Regulation (EU) 2026/1744, the Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj

Commission guidelines on prohibited practices: https://digital-strategy.ec.europa.eu/en/policies/guidelines-prohibited-ai-practices

General Data Protection Regulation: https://eur-lex.europa.eu/eli/reg/2016/679/oj

KPMG and University of Melbourne, fieldwork November 2024 to January 2025: https://mbs.edu/faculty-and-research/trust-and-ai

https://www.project-cognivora.com

An engineering consultancy in Lyon, 220 people. Two engineers wrapped four hundred lines of code around a large American model and built an assistant that drafts technical proposals. Internal only. Their head of IT summed it up: we are not building AI, we are using it.

He was wrong, and had been since the day they switched it on. Not the day a customer saw it.

The Act does not much care who trained the model. Putting an AI system into service covers supply "for own use", and there is no internal exemption. Build a tool for your own staff and you are its provider and its deployer at once.

This episode is the map. Where the model ends and the system begins, and the word the Act has for you: downstream provider. What your model supplier owes you. What being a provider costs when your system is not high risk. And why Annex III is not automatic.

Then the honest part. The one third rule lives in guidelines, not in the Regulation. Nobody has said whether an agent calling three models is one system or several. And we could not find a single fine against any provider.

Twenty-one minutes, every article number checked so you can check us.

DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for it.

This episode is information, not legal advice. Before you answer a compliance questionnaire, talk to a lawyer.

CHAPTERS

0:00 These are AI voices, and why we say so first

1:42 Welcome to Project Cognivora

2:23 We are not building AI, we are using it

4:00 The engine and the car, and the word for you

4:58 What your model supplier owes you, and how to ask

7:01 What it costs when the system is not high risk

8:25 Article 50 already applies to you, and nobody said so

9:56 Fine-tuning, and the one third that changes everything

11:39 Article 25, and the logo that makes you the provider

13:37 Annex III, the filter, and the profiling hard stop

15:58 The exits, and why they are narrower than they look

16:47 Two penalty regimes, same numbers, different regulator

17:52 Three things nobody has answered yet

18:46 Ninety seconds: five things to do on Monday

19:57 What happened in Lyon, and who to send this to

SOURCES

Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

Regulation (EU) 2026/1744, the Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj

General-purpose AI models, C(2025) 5045 final: https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers

Article 50 transparency guidelines, 20 July 2026: https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations

Draft high-risk classification guidelines, 19 May 2026: https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems

https://www.project-cognivora.com

A company of 140 people in Hamburg ran a campaign fronted by a presenter talking to camera about floor coatings. There is no presenter. She was generated. In June that was lawful. The campaign is still running, and in August the rules changed. What arrived was not an inspector, but a letter from a competitor's lawyer.

Article 50 of the EU AI Act has applied since 2 August 2026. Four duties in one article, landing on different people: 1 and 2 bind providers, 3 and 4 bind deployers, and 5 governs how and when you say any of it. Your vendor's watermark discharges your vendor's duty and does nothing for yours.

Then the date almost everybody has wrong. The transitional period to 2 December 2026 is not in Article 50. The Digital Omnibus put it in Article 111(4); it covers only the marking in Article 50(2), and only for systems already on the market before 2 August 2026.

Also here: what the Commission guidelines of 20 July 2026 did to the word "obvious"; why a person who never existed is still a deep fake under Article 3(60) and a dragon is not; what "human review or editorial control" has to mean; the research that strips a watermark for fifty dollars; Article 99(4)(g) and the flip in 99(6) for smaller companies; and not one fine we could find.

Two hosts, twenty minutes, every article number checked so you can check us.

DISCLOSURE: Maya and Sam are AI-generated voices. They are not real people and this is not a recording of a conversation that took place. The music is also generated. The script was written and edited by a human, Kris Cordier, who carries editorial responsibility for it.

This episode is information, not legal advice. Before you decide no disclosure is needed, talk to a lawyer.

CHAPTERS

0:00 These are AI voices, and why we say so first

1:40 Welcome to Project Cognivora

2:20 Four duties, and the question that sorts them

3:28 Tell people it is a machine, and the escape hatch

4:51 Mark what the machine makes, and whose job that is

6:21 The deadline that is not in Article 50

7:46 Emotion recognition, and where Article 5 got there first

9:14 Deep fakes, dragons, and an objective test

11:25 Public-interest text, and what editorial control means

12:57 Marking is engineering, and the watermark washes off

14:09 The Code of Practice, and what signing it buys you

15:02 Article 99, and the flip that helps small companies

16:27 Nine without a caveat, and no fine we could find

17:43 Ninety seconds: five things to do on Monday

19:09 What happened in Hamburg, and who to send this to

SOURCES

Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj

Regulation (EU) 2026/1744, the Digital Omnibus: https://eur-lex.europa.eu/eli/reg/2026/1744/oj

Commission guidelines, C(2026) 5054 final, 20 July 2026: https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems

Commission questions and answers: https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act

https://www.project-cognivora.com