AI Transparency Statement

1. Why this statement applies to a UK company

AiBizzApps Limited is established in the United Kingdom, which is not an EU member state. That is not an exemption. The AI Act reaches providers established outside the EU where an AI system is placed on the EU market, or where the output of the system is used in the EU. GRCxAI is sold to customers in the European Economic Area, directly and through resellers, so we treat ourselves as in scope by design rather than by accident.

We would rather be in scope and say so. A product sold on the strength of EU AI Act readiness cannot sensibly argue its way out of the same regulation.

2. Our role, and yours

The AI Act allocates duties by role, and the roles are not interchangeable:

• AiBizzApps Limited is the provider. We developed GRCxAI and place it on the market under our own name. The provider transparency duties in Article 50 are ours, and they are not delegable — we cannot pass them to a reseller by contract, and we do not attempt to.
• Resellers are distributors. They sell GRCxAI under our brand, unmodified. A reseller that re-branded the system, changed its intended purpose or substantially modified it could take on provider duties itself; our reseller terms prohibit all three, which keeps the position clean for everyone.
• The customer is the deployer. Deployer duties are the customer's, principally where they publish AI-generated output as information of public interest. Section 6 sets out what we ask of you.

3. Where AI is used in GRCxAI

Every AI feature in the platform is listed here. Where a feature is not listed, it does not use a large language model.

Inference is provided by Anthropic, PBC, as recorded in Schedule 4 of the Master Subscription Agreement. Customer Data is not used to train models.

4. Disclosure on interaction — Article 50(1)

Where GRCxAI interacts directly with a person, it says that it is an AI system. This applies to the compliance chatbot and to any future feature that converses with a user. The disclosure is shown at the start of the interaction, in the interface, without the user having to look for it.

This obligation carried no grace period. It has applied since 2 August 2026.

5. Marking of generated content — Article 50(2)

Article 50(2) requires synthetic content to be marked in a machine-readable form, so that software can detect it was AI-generated. A visible notice on a document is useful to a reader, but it does not by itself discharge this obligation.

Current status: this work is in progress. Systems already on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty, and we are working to that date. We will state here, with a date, when it is live.

What we intend to mark, and what we do not:

• Marked: final generated deliverables — policies, procedures, framework documents and generated reports exported from the platform.
• Not marked: intermediate drafts inside a closed workflow, short outputs, machine-to-machine API responses, and computed values such as risk scores and control mappings. These are outside the marking duty.

We are also assessing whether the business-to-business exemption in the Commission's guidance applies to how GRCxAI is actually used. We will record the conclusion here either way, because a determination nobody can see is worth very little.

One honest limitation: for plain text, no current marking technique satisfies every criterion the Act sets out. Where that is so, our position is to apply the best available method and to document what we did and why, against the state of the art at the time.

6. What we ask of customers

• Do not remove the markings. Stripping machine-readable provenance from a generated document defeats the purpose and moves the problem onto you.
• Have a competent person review AI output before relying on it. This is good practice in governance work regardless of the regulation, and it matters to your own position as deployer.
• If you publish AI-generated output as information of public interest, the deployer labelling duty is yours. We will give you what you need to meet it.

7. Risk classification

Our assessment is that GRCxAI is not a high-risk AI system under the AI Act. Governance document drafting, risk analysis, audit findings and a standards chatbot do not map to an Annex III category. On that basis the Article 16 provider obligations for high-risk systems — conformity assessment, CE marking, EU database registration, a technical file, an authorised representative — do not apply.

This is our determination, taken with advice, and it is kept under review. It would be revisited if the platform gained a capability that changed the analysis. We state it plainly because it is the first question a buyer's counsel asks.

8. Code of Practice

The Commission's Code of Practice on transparency of AI-generated content offers signatories a predictable route to demonstrating compliance. Our position on signature is under consideration and will be recorded here once settled.

9. Contact

Questions about this statement, or a request for the underlying documentation as part of a procurement or audit: [email protected].

This statement is published as a factual description of our position. It is not legal advice, and it does not form part of the Master Subscription Agreement except where that agreement refers to it.