Guide

AI knowledge base and the EU AI Act: labeling requirement

The transparency requirements of the EU AI Act have been in effect since August 2026. What this means specifically for an AI knowledge base, who it affects, and what actually needs to be done in implementation.

Request Assessment ↗AI Knowledge Base

Quote on Request6 to 10 WeeksAs of 2026

In short

The transparency requirements from Article 50 of the EU AI Act have been in effect since August 2026: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard. For an AI knowledge base, this means: labeling is mandatory, not optional, and applies regardless of company size — a sole proprietorship is affected just as much as a corporation. What matters is purpose and risk, not headcount.

01 — Legal situation

EU AI Act: what applies

Since August 2026, the transparency requirements from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard.

The AI Act doesn't distinguish by company size: A sole proprietorship with an AI system in customer contact is affected just as much as a corporation. What matters is purpose and risk, not headcount.

There's also the obligation to ensure adequate AI competence for the people working with it. That's not an examination requirement, but it should be documented — a training session with a participant list is the simplest proof.

02 — Data protection

What GDPR requires

As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.

In practice, this means for an AI knowledge base: a data processing agreement with every involved service provider, verification of where processing takes place, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.

A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.

03 — Risks

What can go wrong

The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
No one maintains it. The biggest risk of all — and the most easily avoidable.
Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.

04 — Questions

Frequently asked questions

What is RAG?

The abbreviation stands for retrieval-augmented generation. Instead of having the language model answer from memory, your documents are searched first, and only the passages found are used to generate the answer. That's why the answer has a source.

Does this have to run in the cloud?

No. For sensitive areas, we use models that run entirely on your own hardware. That costs more to set up and slightly reduces answer quality, but no document leaves the building.

Our documents are a mess. Will it still work?

To a certain extent, yes — the system handles different formats and structures. What it cannot do is resolve conflicting information. If three versions of a price list are in circulation, you need to clarify which one applies first.

How long does setup take with a large document base?

It depends less on volume than on condition: well-structured repositories with few duplicates are ready in a few weeks, grown repositories with many old versions need a cleanup round first.

Will everyone see everything?

No. The permissions from your existing systems are carried over. If someone isn't allowed to open a folder today, they won't get answers from it either.

What if we have multiple languages in our document base?

No problem — the search understands questions and documents regardless of language and finds the right answer even when the question and source are written in different languages.

Can we roll this out to more departments step by step?

Yes, that's the usual approach. Start with one department, learn from their questions and results, then connect the next one — rather than releasing everything at once.

05 — Next

Next step

Let's talk briefly about whether this makes sense for you.

A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.

Send inquiry ↗ office@pipeline-solutions.at OR +43 681 207 64 203