EU AI Act at LeraLink
LeraLink's roles under the EU Artificial Intelligence Act, how each AI task is classified, and what is done for transparency.
Last updated: 13 November 2026
Scope of this page
This page explains how SSStudio, trading as LeraLink ("we"), applies Regulation (EU) 2024/1689 (the AI Act), as amended by Regulation (EU) 2026/1744 of 8 July 2026 (the "AI Omnibus"). It is written for customers, in particular public-sector organisations that must account for the algorithms they use.
It describes LeraLink as built today, in a controlled pilot. What LeraLink's AI does and does not do is described in How LeraLink Uses AI and in Responsible AI Commitments. This page does not repeat that description; it explains the legal position.
What uses AI in LeraLink
LeraLink has a fixed set of AI tasks. Customers cannot add tasks, write prompts or choose models.
| Task | What it produces | Who decides on the output |
|---|---|---|
| Translation | A proposed translation of a work or a passage | An author or editor accepts, edits or rejects it. Machine translations can be shown to readers before a person has reviewed them; they are then labelled 'AI translation · Not yet human-reviewed' |
| SEO suggestions | Four suggested search-engine fields for a work | A person; if nobody has reviewed them when the work is published, they go live marked "needs review" and the review stays open |
| Generated images | An image made when a person asks for one: a feature image for a work, an image for a Wall post or a site page, or a cover for a group of works | For a work, a Wall post or a page, a person accepts or rejects it. A cover for a group of works is applied when an editor asks for it, and can be replaced |
| Search index | Numerical representations of published text, used to find related works | Infrastructure; not shown as content |
| Knowledge extraction | The concepts and people a published text is about, and which Wikidata item each name refers to | Matched automatically only at high confidence; otherwise proposed to a person |
| Knowledge profiles | A description of a concept or person, from the evidence in published texts | Published marked as machine-made; a person's correction is kept beside it and always wins; a person can ask for removal |
| Composer | A composition assistant that makes proposals only, where it is enabled for an installation | A person |
AI does not write, title, summarise, research or evaluate a work for its author. It does not change published text, approve translations, decide rights or give anyone a role. Restricted works are never sent to any model.
Our roles under the AI Act
Provider of AI systems
We integrate general-purpose AI models developed by others into LeraLink's features and make those features available under our own name. For those features we are a provider of AI systems within the meaning of art. 3(3) of the AI Act.
We do not develop or train general-purpose AI models, and we do not fine-tune them. We are therefore not a provider of a general-purpose AI model. The models come from:
| Source | Used for |
|---|---|
| Models running on Cloudflare Workers AI | Every task; the only models for the search index |
| OpenAI | Translation, SEO suggestions and the knowledge layer |
| Google Gemini API (paid tier) | Generated images |
Each task tries its models in a fixed order set by the platform; an installation's administrators can see that order, with each provider, on the page 'AI in this installation'. A task moves to the next model only if the one before is unavailable. Other providers can be added by the platform administrator; none are in the default chains.
Deployer for our own use
Where we use LeraLink's AI features on our own installations, such as the Hub (hub.lera.link), we are also a deployer (art. 3(4)).
Customers as deployers
A customer that switches on and uses AI features in its installation, under its own authority, is a deployer of those AI systems. The obligations that the AI Act places on deployers, such as those in art. 50(4), fall on the customer for its installation. We provide the information and labels described below so that customers can meet them.
Risk classification
We have classified each task against the AI Act. The classification applies to LeraLink as built; the tasks are fixed and cannot be repurposed by a customer.
| Task | Prohibited practice (art. 5) | High-risk (art. 6, Annexes I and III) | Transparency (art. 50) |
|---|---|---|---|
| Translation | No | False | Art. 50(2) may apply to generated text, subject to its exception for systems that do not substantially alter the input or its meaning; art. 50(4) for deployers publishing text on matters of public interest, unless a person reviewed it and holds editorial responsibility |
| SEO suggestions | No | False | Art. 50(2) may apply to generated text |
| Generated images | No (see the safeguard note below) | False | Art. 50(2) applies to generated images; art. 50(4) for deployers where an image is a deep fake |
| Search index | No | False | Not applicable: no content is generated for people |
| Knowledge extraction | No | False | Not applicable: it selects existing records rather than generating content |
| Knowledge profiles | No | False | Art. 50(2) may apply to generated text; descriptions are visibly marked as machine-made |
| Composer | No | False | Art. 50(1) where a person interacts with it directly; art. 50(2) for its text |
None of the uses is prohibited, and none is high-risk as built. LeraLink's AI is not used for biometric identification or categorisation, emotion recognition, decisions about employment or workers, admission to or evaluation in education, access to essential services, credit, law enforcement, migration or the administration of justice. LeraLink supports courses and editorial peer review, but no model evaluates a learner, a submission or a reviewer.
New prohibitions from 2 December 2026. The AI Omnibus adds prohibitions on AI systems that generate realistic intimate or sexually explicit depictions of an identifiable person without their consent, or child sexual abuse material. LeraLink's image task makes an illustration from a description: one the platform builds from a work, or one a person writes. Such content is forbidden by our Acceptable Use Policy, and an image is made only when a person asks for one. We are reviewing whether the safeguards in the image task, including the safety settings of each model used, are adequate under the new provision before it applies.
Transparency: what we do
Visible labelling
- Every AI proposal (translation, SEO suggestion, generated image) is marked in the product as made by a model until a person decides on it. Machine translations can be shown to readers before a person has reviewed them; they are then labelled 'AI translation · Not yet human-reviewed'.
- An image generated in LeraLink shows readers a small sparkles sign named "Image generated with AI": on a work's page, in image Blocks, on catalogue cards and on the Wall. The sign does not yet appear in homepage modules, the newsletter, printed publications, share images or link previews.
- SEO fields that go live unreviewed are marked "needs review" in the Studio until someone approves, rewrites or rejects them.
- AI-written descriptions of concepts and people are marked as machine-made where they are shown, also to readers. A person's correction is shown beside the machine text, not hidden behind it.
Provenance
For every machine-made proposal, description and generated image, LeraLink records which task and which model produced it, and which person later accepted, edited or rejected it. That record is kept with the work and is not erased when a person edits the output.
Machine-readable marking of generated images
Art. 50(2) requires providers of AI systems that generate images to mark the output in a machine-readable format so that it can be detected as artificially generated, where technically feasible.
| Image source | Current state |
|---|---|
| Google Gemini | Google embeds its own SynthID watermark in images it generates |
| Models on Cloudflare Workers AI | No watermark or metadata marking is applied by the model |
| LeraLink's own image pipeline | Every image generated in LeraLink carries IPTC "trainedAlgorithmicMedia" metadata in XMP (JPEG, PNG and WebP), and resized copies served by LeraLink keep it. Where a provider's file already carries a C2PA Content Credential, LeraLink stores it unchanged; LeraLink adds no C2PA signature of its own. |
The mark travels with the file, so a copy of a generated image taken outside LeraLink still says that it was made with AI. Metadata can be stripped when a file is re-encoded elsewhere. LeraLink adds no invisible watermark of its own; a provider's watermark, such as SynthID, stays in the pixels.
Machine-readable marking of text
For text, LeraLink's records identify machine-made proposals and descriptions, and the interface marks them. Whether text that a person has reviewed and accepted still needs a machine-readable mark, and which technique fits, is being assessed against the European Commission's voluntary Code of Practice on marking and labelling of AI-generated content, published on 10 June 2026.
Timing
Art. 50 applies from 2 August 2026. Under the AI Omnibus, providers of systems covered by art. 50(2) that were placed on the market before 2 August 2026 have until 2 December 2026 to implement the technical marking. Visible labelling in LeraLink's interface and machine-readable marking of generated images (IPTC metadata) have both been in place since 13 November 2026.
AI literacy (art. 4)
Art. 4, as amended by the AI Omnibus, requires providers and deployers to take measures to support AI literacy among their staff and others who operate AI systems on their behalf. At LeraLink:
- SSStudio keeps the knowledge of the people who build and operate the platform on its behalf about the models, their limits and the AI Act up to date;
- installation administrators see, on the page "AI in this installation", each task, whether it is on, and the models that would run, with each provider's country, hosting region, training and retention facts, where those facts have been recorded;
- How LeraLink Uses AI and Responsible AI Commitments explain in plain language what the features do and do not do, and what a person must check before accepting a proposal.
Customers remain responsible for the AI literacy of their own staff who use the features.
Obligations of the model providers
The providers of the general-purpose AI models we use have their own obligations under chapter V of the AI Act, applicable since 2 August 2025, such as technical documentation, information for downstream providers and a copyright policy (art. 53). Those obligations are theirs, not ours. We rely on the information they publish, and record in our model register the facts the AI policies need: provider country, hosting region, whether inputs are used for training, and retention.
AI policies per installation
Each installation is under one AI policy, enforced for every model call, with no fallback around it: Standard; EU only (only EU-hosted models recorded as not training on inputs; the installation's text is left out of the search index); Open models only (published weights); No external AI (only models on Cloudflare). A model about which a required fact has not been recorded does not count as meeting a rule.
The facts about every model are not yet fully recorded. As a result, an installation placed under the EU-only policy currently has no AI features until those facts are entered. The AI policy of an installation is set by the platform administrator, at the customer's request.
Support for customers
Public-sector customers often need to describe the AI they use: in the Dutch Algoritmeregister, in a human-rights or data protection impact assessment, or in their own procurement records. We provide:
| What | How |
|---|---|
| The page "AI in this installation" | Read-only, for the installation's administrators: tasks, on/off state, models in order, provider country, hosting region, training and retention facts |
| "Models used by this installation" | A printable list, prepared by the platform administrator on request |
| A description for an algorithm register | On request: purpose of each task, the human decision point, the data sent, the providers, and the safeguards. The customer remains responsible for its own register entry and its legal basis |
| Answers to questionnaires about AI | On request, through legal@lera.link |
A customer can switch translation, SEO suggestions, generated images and the knowledge layer off for its installation. Whether its text is in the search index follows from its AI policy. An installation writes editorial instructions, such as how to translate or the style of images, but never a prompt or a model.
How we follow changes in the Act
The AI Act is being implemented in stages and has already been amended once. We follow:
- the Official Journal of the European Union, for amendments and implementing and delegated acts;
- the European Commission and the AI Office, for guidelines and codes of practice, including the Code of Practice on marking and labelling of AI-generated content;
- Dutch authorities responsible for AI supervision, including the Autoriteit Persoonsgegevens in its role on algorithms.
An internal register of LeraLink's AI systems and their classification is in preparation; it will be reviewed when a task, a model or the law changes, and each new AI task is to be classified before it is released. Changes that affect customers are announced under the Change Notification Policy.
Contact
Questions about AI and the AI Act: legal@lera.link. Privacy questions about AI processing: privacy@lera.link.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act): eur-lex.europa.eu
- Regulation (EU) 2026/1744 of 8 July 2026 amending Regulation (EU) 2024/1689 (AI Omnibus): eur-lex.europa.eu
- European Commission, Code of Practice on marking and labelling of AI-generated content (10 June 2026): digital-strategy.ec.europa.eu
- Algoritmeregister of the Dutch government: algoritmes.overheid.nl