Legal logic
Derive your AI Act role: provider, deployer or both, with reasoning and a review cycle.
The legal logic determines, per AI system, the role in which your organisation acts. The role is not ticked but derived from what you do with the system. It also records whether training or user data is involved and whether the purpose has changed. The evaluation is rule-based and uses no AI; the current rule set is EU_AI_ACT_LEGAL_V1.1.
At a glance
- Included from
- Professional
- Where in the app
- Assess & classify → Legal logic
- Output
- Role (provider/deployer), reasoning, notes on data and purpose limitation, review date
- Legal basis
- Art. 3(3), (4) and (11) AI Act; Art. 5(1)(b) GDPR
- API
- /api/v1/legal-logic
The questionnaire
Three sections with eight yes/no questions.
| Question | Content |
|---|---|
| r1 | Do you develop the system yourself or train or fine-tune a model (including via service providers under your control)? |
| r2 | Do you make the system available to third parties (sell, license or otherwise provide it)? |
| r3 | Do you operate the system under your authority (internally or for customers)? |
| r4 | Do you materially modify a third-party system, for example by fine-tuning, changing its purpose or integrating it into your own system? |
| d1–d3 | Training data, deployment data in operation, and (re)training on user or customer data. |
| p1 | Does the current use differ from the originally documented purpose? |
How the role is derived (V1.1)
| Role | Rule |
|---|---|
| Provider | (r1 or r4) and (r2 or r3). Whoever develops or materially modifies and provides the system to others or puts it into service under their own name is a provider, including for purely in-house use (Art. 3(3) and (11) AI Act). |
| Deployer | r3: operation under your own authority (Art. 3(4) AI Act). |
| Provider and deployer | Both rules apply: typical for in-house developments. |
| Unclear | Neither rule applies. The app asks for explicit clarification. |
Change from V1.0
Up to V1.0, only whoever also provided the system to third parties counted as a provider. In-house developments for own use were therefore treated as mere deployment. Assessments under V1.0 keep their version, role and reasoning and carry a notice; to apply V1.1, re-run the legal logic.
Taking the role over into "Classification & roles"
The role in the classification profile (Documentation → Assurance) drives applicable provisions, checklist and controls. When a legal logic assessment is completed (status COMPLETED):
- If the profile has no role yet or the role came from the last legal logic assessment, it is taken over automatically.
- If the role was set by hand and differs, it is not overwritten. The app shows the result as a suggestion with an "Adopt" button.
- Only provider and deployer are taken over; importer and distributor in the profile remain untouched.
- Every takeover is recorded in the audit log.
Review cycle
For each assessment you set the cycle and the owner; if left empty, the previous version’s value applies, and 90 days for the first assessment. SimpleAct sends reminders before the due date by e-mail and, if connected, via Slack or Microsoft Teams.