AI Transparency Notice

The Kodex Compliance Scanner assists organisations in assessing their compliance posture against applicable EU regulatory frameworks. It gathers and analyses evidence — such as policy documents, audit logs, and integration signals — and produces structured compliance reports with confidence-scored control evaluations and remediation guidance.

This system is a compliance assistance tool that supports human decision-making. It does not replace the judgement of qualified legal, compliance, or technical professionals, and it does not make binding legal determinations.

The system does not fall within any of the high-risk categories enumerated in Annex III of the EU AI Act. Specifically:

• It is not used in critical infrastructure management or safety components thereof
• It is not used for educational or vocational admission or assessment decisions
• It is not used for employment, worker management, or access to self-employment decisions
• It is not used in essential private or public services (e.g., credit scoring, benefit determination)
• It is not used for law enforcement, migration or asylum, or the administration of justice

The system provides advisory compliance assessments and does not make binding legal decisions, does not directly affect fundamental rights, and requires human oversight and independent verification for all compliance determinations. Accordingly, it is classified as a limited-risk AI system subject to the transparency obligations under Article 50 of the EU AI Act.

This classification is a self-assessment by Kodex-Compliance and has not been independently verified by a notified body. We review this classification on a regular basis and will update it if the system's capabilities or deployment context change materially.

These are general-purpose large language models (LLMs) developed by Anthropic PBC, accessed via API. Kodex-Compliance does not perform custom model training, fine-tuning, or reinforcement learning on user data.

The AI models are used for the following tasks:

• Evidence analysis — interpreting uploaded documents, policy excerpts, and integration signals against regulatory control requirements
• Control evaluation — assessing whether each regulatory control is met, partially met, or unmet based on available evidence, and assigning confidence scores
• Report generation — producing structured compliance reports, gap analyses, and remediation roadmaps
• Compliance chat — answering user questions about regulatory requirements, scan results, and remediation steps
• Cross-framework shadow pass — identifying coverage overlap and gaps across multiple regulatory frameworks

The scanning pipeline proceeds as follows:

Users should be aware of the following limitations before relying on AI-generated assessments:

• AI assessments are probabilistic, not deterministic — the same evidence may produce slightly different results across runs
• Confidence scores reflect the model's estimated certainty, not a guarantee of accuracy
• The system may produce false positives (flagging compliant items as non-compliant) or false negatives (failing to identify genuine gaps)
• Evidence quality directly affects assessment quality — incomplete, outdated, or misleading evidence will produce unreliable assessments
• The AI cannot independently verify the authenticity, completeness, or provenance of uploaded documents
• Rapidly evolving regulatory guidance (e.g., European Data Protection Board opinions, ENISA guidance) may not be immediately reflected in the model's outputs
• The system is not a substitute for qualified legal, compliance, or technical professional advice

Kodex-Compliance has implemented the following measures to ensure meaningful human oversight of AI-generated outputs:

• All scan results include per-control confidence scores so users can identify and scrutinise low-confidence determinations
• A clarification mechanism allows users to supply additional context before results are finalised
• All results are advisory — the system takes no automated enforcement actions
• Users can request a full human review of any AI-generated determination via our support channel
• The cross-framework shadow pass provides an independent validation perspective for multi-framework assessments
• Scan reports carry explicit disclaimers reminding users that results require independent verification

Data transmitted to Anthropic's API is subject to Anthropic's Privacy Policy and Data Processing Agreement. Anthropic does not use API inputs to train its models. All data is transmitted over TLS-encrypted channels. For details on how Kodex-Compliance processes your data, please see our Privacy Policy.

As a user of an AI system subject to the EU AI Act, you have the following rights:

If you believe the AI system has produced a harmful, inaccurate, or discriminatory output, or if you have any concerns about its operation, please contact us: