Regulatory Compliance Terms

METADAT-AI LTD | Version 2.1 | October 2026 | www.metadat-ai.com/legal/policies/regulatory-compliance

These terms explain how EU and UK technology regulation applies to the Metadat-AI Platform and who does what.

Scope and status
1. These Regulatory Compliance Terms ("RCT") apply to each customer under the Customer Terms (the "Customer") and each reseller under a Reseller Agreement (the "Reseller"), and are incorporated into those agreements by reference. Obligations that apply only to Resellers are in the Reseller Programme Terms.
2. Capitalised terms have the meanings given in Part 1 of the Master Definitions Schedule (www.metadat-ai.com/legal/definitions). In these RCT, "AI Act" means Regulation (EU) 2024/1689, including as amended by Regulation (EU) 2026/1744, and "CRA" means Regulation (EU) 2024/2847.
3. If these RCT conflict with the Customer Terms or the Reseller Agreement, that agreement prevails.
4. Nothing in these RCT is a warranty that the Services comply with any law for a particular use.
5. These RCT are a Living Document. Metadat-AI may update them by publishing a new version at the URL above, with effect in accordance with section 13 of the Standard Legal Terms: an adverse update takes effect 30 days after notice, with a right to terminate before then; updates required by law, a court or a Regulator, or needed to address a security risk, take effect on publication.
Regulatory roles
1. Metadat-AI. Metadat-AI places the Software on the market in its own name. It is the provider of the AI systems in the Software for the purposes of the AI Act and, to the extent the CRA applies to the Software, its manufacturer.
2. Customer. The Customer is the deployer of the Services for the purposes of the AI Act and the controller of Personal Data in Customer Content, as set out in the Customer Terms and the Data Processing Agreement.
3. Reseller. A Reseller established in the EU that is the first to make the Software available on the EU market acts as importer for the purposes of the AI Act and the CRA, and must meet the obligations of an importer under them, including the pre-market checks, record-keeping and cooperation with market surveillance authorities. Any other Reseller that makes the Software available in the EU acts as a distributor. A Reseller established outside the EU is not an importer.
4. Representatives. No Reseller or Customer is Metadat-AI's authorised representative under Article 22 of the AI Act or its representative under Article 27 of the EU GDPR unless appointed in writing, and none may hold itself out as one. Metadat-AI will appoint an authorised representative under Article 22 of the AI Act before it makes any high-risk AI system available in the EU.
5. Becoming a provider. A Customer or Reseller that puts its own name or trade mark on an AI system in the Software, makes a substantial modification to it, or uses it for a high-risk purpose that Metadat-AI has not specified may itself become a provider under Article 25 of the AI Act. Neither may do any of these things without Metadat-AI's prior written consent.
EU AI Act: high-risk uses
1. Facial recognition. The Facial Recognition Features (Standard Mode and Extended Mode) and the Age and Gender Estimation Features are high-risk AI systems under Annex III point 1 of the AI Act, for which the obligations apply from 2 December 2027. These features may be used only under the Biometric Addendum and an Activation Certificate, and that activation process takes the place of the notice in clause 3.2 for them.
2. Notice of other high-risk uses. The Customer must notify Metadat-AI in writing at least 30 Business Days before deploying the Software, or using AI Outputs, in any context that constitutes or may constitute a high-risk AI system under Annex III of the AI Act, such as law enforcement, migration and border control, critical infrastructure, education, employment, access to essential private or public services (including credit, insurance or healthcare), or the administration of justice or democratic processes.
3. Metadat-AI's response. Within 30 Business Days of a notice, Metadat-AI will use reasonable endeavours to tell the Customer whether it will support the proposed use and, if it will, to provide the technical documentation and other information that the AI Act requires a provider to give a deployer for that use, subject to confidentiality. A notice does not permit any use that the Acceptable Use Policy prohibits. Metadat-AI may decline to support any high-risk use that it reasonably considers it cannot support in a compliant manner, and the Customer must not proceed with a use that Metadat-AI has declined. Information provided is not a warranty that the Services comply with the AI Act or are CE marked for that use.
4. Deployer obligations. For any high-risk use, the Customer is responsible for its obligations as deployer, including: using the Services in accordance with the Instructions for Use; assigning human oversight to competent people; keeping the logs under its control for at least six months (Article 26(6)); carrying out any fundamental rights impact assessment that Article 27 requires; informing workers' representatives and affected workers before use in the workplace (Article 26(7)); registering its use where it is a public authority (Article 26(8)); informing affected individuals where the law requires; and informing Metadat-AI without undue delay of any serious incident or risk that it identifies (Article 26(5)).
5. Provider cooperation. To the extent the Software is or contains a high-risk AI system, Metadat-AI will use reasonable endeavours to:
  1. maintain the technical documentation that the AI Act requires and, on the Customer's reasonable written request, make available the parts of it that the Customer reasonably needs to meet its deployer obligations;
  2. where the Services incorporate a general-purpose AI model supplied by a third party, pass on the information it receives from that supplier under Article 53 of the AI Act that the Customer reasonably needs;
  3. cooperate in good faith with any inquiry by a competent authority under the AI Act concerning the Software; and
  4. inform the Customer without undue delay where Metadat-AI reports a serious incident under Article 73 of the AI Act that concerns the Customer's use of the Services.
EU AI Act: transparency (Article 50)
1. Synthetic content. Where a feature of the Services generates synthetic audio, image, video or text content (for example, a synthetic voice track), Metadat-AI, as provider, will mark that output in a machine-readable format so that it can be detected as artificially generated, as far as technically feasible and as Article 50(2) requires. The Customer must not remove or alter those markings. Article 50(2) does not apply to features that perform an assistive function for standard editing or do not substantially alter the input data.
2. Biometric categorisation. The Age and Gender Estimation Features are a biometric categorisation system. A Customer using them must inform the individuals exposed to them of the operation of the system, as Article 50(3) requires, and process their Personal Data in accordance with data protection law. Instructions for Use section 8 explains how.
3. Deep fakes and public-interest text. A Customer that uses the Services to generate or manipulate image, audio or video content that is a deep fake must disclose that the content has been artificially generated or manipulated (Article 50(4)). For evidently artistic, satirical or fictional work, the disclosure may be made so as not to hamper enjoyment of the work. A Customer that publishes AI-generated or manipulated text to inform the public on matters of public interest must disclose that it was so generated, unless the text has undergone human review or editorial control and a person holds editorial responsibility for its publication.
Cybersecurity, data and online safety
1. Cyber Resilience Act. Metadat-AI maintains a Vulnerability Disclosure Policy (www.metadat-ai.com/legal/policies/vdp) and, to the extent the CRA applies to the Software, reports actively exploited vulnerabilities and severe incidents as Article 14 of the CRA requires. The CRA reporting obligations apply from 11 September 2026 and its product obligations from 11 December 2027.
2. NIS2. Metadat-AI may, at its discretion and at the Customer's cost, respond to the Customer's reasonable supply-chain security requests under national law implementing Directive (EU) 2022/2555 (NIS2).
3. EU Data Act. Data retrieval, export and switching for EU Customers are governed by clause 20 of the Customer Terms.
4. Online Safety Act 2023. Where the Customer operates an online service regulated under the Online Safety Act 2023, it is solely responsible for complying with that Act in connection with its use of the Services, including duties on illegal content and content harmful to children.
Bias and discrimination reporting
1. The Customer must notify Metadat-AI promptly if it identifies or reasonably suspects that the Services are producing outputs that may amount to unlawful discrimination against individuals of a particular demographic group, or that systematically underperform for a particular population, giving the details it reasonably can. Metadat-AI may suspend the relevant feature while it investigates (Customer Terms clause 18.1). Metadat-AI will assess each report under its post-market monitoring procedures, but has no obligation to modify or replace the Software within any fixed period.
Contact
1. Regulatory queries and notices under these RCT: legal@metadat-ai.com. Security vulnerabilities: security@metadat-ai.com, or as set out in the Vulnerability Disclosure Policy.

Version history


Version	Date	Summary
2.0	October 2026	Replaces version 1.1. Rebuilt: regulatory terms from the former Master Services Agreement added; regulatory roles and Article 50 allocation added; NIS2, CRA and Data Act sections reduced; reseller-only terms moved to the Reseller Programme Terms.
2.1	October 2026	NIS2 supply-chain cooperation made discretionary.