Reglynn sells EU AI Act self-assessments. Reglynn is also an AI system under the EU AI Act.
It seemed indefensible to sell one without publishing the other. So this is our own assessment, run through the same four-step logic the product uses on customers, with the awkward parts left in.
The same caveat we put on every report applies here. This is a structured self-assessment, not legal advice and not a certification. We are not a notified body, and nothing here has been reviewed or endorsed by a lawyer or a regulator. Where we are uncertain, we say so rather than rounding down. Last reviewed 4 September 2026.
The summary
| Question | Our answer |
|---|---|
| Is Reglynn an AI system? (Art 3(1)) | Yes. It performs inference to generate reports and recommendations. |
| Our role | Provider of Reglynn. Deployer of Anthropic's Claude. |
| GPAI provider under Art 53? | No. API access and prompting only. No fine-tuning, no weight modification. |
| Prohibited practice? (Art 5) | No. No biometrics, no social scoring, no emotion recognition. |
| Annex III high-risk area? | No. Reasoning below. |
| Art 50 transparency | Yes - this is our obligation set. Reglynn generates content and runs a chat assistant, so both limbs reach us. |
| Art 4 AI literacy | Yes, applies. Record below. |
| Art 22 authorised representative | Not required. Operated from within the EU (Poland). |
| Risk tier | Limited risk. |
Why we are not high-risk
Annex III attaches to systems that make or materially influence decisions about natural persons - employment, education, credit and essential services, law enforcement, migration, justice, biometrics, critical infrastructure.
Reglynn assesses a company's AI system. Its subject is a legal person's software, not a human being. It does not profile individuals, score them, or gate anyone's access to anything. Our customer is a business; the output describes their product. Nothing we generate decides anything about a person.
The nearest limb is Annex III(8), covering AI used in the administration of justice and democratic processes. It is written for judicial authorities interpreting facts and law. We are not a judicial authority, we do not supply one, and our output is explicitly a self-assessment that tells the reader to verify with a qualified advisor. We are confident this does not reach us. We flag it because it is the closest thing to a boundary in our position, and we would rather name it than have you find it.
A commitment, because classification can drift. Reglynn will not assess natural persons. No CV screening, no individual competence scoring, no product where a human being is the subject of the assessment. That is a product boundary, not just a current fact - if we ever crossed it, our classification would change completely, and we would rather rule it out than manage it.
The dates that bind us
We publish these because most deadline tables still online are pre-Omnibus and wrong. These are the dates our own obligations run on, and the same ones the report engine uses.
| Provision | Status |
|---|---|
| Art 5 prohibited practices | In force since 2 February 2025. |
| Art 4 AI literacy | In force since 2 February 2025. Reworded by the June 2026 Omnibus, still in force. |
| Art 53 GPAI provider duties | Applied from 2 August 2025. Sits with Anthropic, not with us. |
| Art 50 transparency | Applied from 2 August 2026, and was not deferred. This is the set that binds us. |
| Art 50(2) machine-readable marking | From 2 December 2026. A duty on the provider of the generative model. |
| Annex III high-risk obligations | Deferred by the June 2026 Omnibus to 2 December 2027. |
| Annex I product-embedded high-risk | 2 August 2028. |
On penalties, so that nobody quotes the wrong figure at us or at you: Article 99(3) sets up to €35M or 7% of worldwide turnover for prohibited practices under Article 5. Article 99(4) sets up to €15M or 3% for most other breaches, including Article 50. For SMEs and start-ups, Article 99(6) applies whichever of the two figures is lower, not higher. We are a company of one, so our honest exposure on a disclosure gap is small. That is not the reason we close them.
Where AI actually sits in Reglynn
Two places use a model, and two places people assume do but do not. It is worth being precise about which is which.
- Your report is AI-generated. Your answers go to Anthropic's Claude, called from our automation, running Reglynn's own question set and risk logic. The wording of the report is written by that model and sent automatically. No human reads a report before it goes out; if a customer says theirs looks wrong, we re-run it.
- The chat assistant is AI. Lynn answers from our own knowledge base and now loads on all but a handful of our pages, so the Article 50(1) duty covers nearly the whole site rather than one corner of it.
- The free scan on the homepage is not AI. Eight questions and an email step, scored by fixed rules in your browser. No model sees it. We say so because claiming AI where there is none would be as dishonest as hiding it where there is.
- The paid assessment runs on reglynn.eu, hosted on Netlify and unlocked with the licence key from your Gumroad receipt. We no longer use a third-party form host for it.
The processors behind that are Gumroad (payment and merchant of record), Netlify (hosting and our two serverless functions), Make (automation), Airtable (logging), Anthropic (report generation) and tawk.to (live chat). The full list with purposes is in our privacy policy.
What we disclose today
Limited risk means the obligation is disclosure. Here is where AI involvement is stated, as at the review date above.
| Where | What we disclose |
|---|---|
| Our chat assistant | Introduces itself as an AI assistant before the conversation starts, and will always confirm it is an AI if asked, on every page it loads on. Art 50(1). |
| The homepage | States that the report is built by AI, and answers "which AI model does Reglynn use" in the FAQ, before you go near a payment page. |
| These content pages | Written with AI assistance and reviewed by a person who holds editorial responsibility for publication - the condition in Art 50(4). Nothing publishes here unread. |
| Terms & privacy policy | Name Anthropic's Claude as the model behind the reports, name the chat assistant, and confirm your answers are never used to train AI models. |
| This page | Translated alongside the rest of the site, so the disclosure is not English-only on a site that is not. |
What is still outstanding
A self-assessment that reports itself complete is a brochure. These are disclosures we have written and not yet shipped. Listing them before they are fixed is the point of publishing this at all.
- The report's own footer. Your report does not yet carry a "how it was made" block naming the AI system that wrote it. This is the artefact that gets forwarded to legal teams, so it is the one that matters most, and it is our top open item.
- The checkout pages. Our Gumroad product pages do not yet carry the AI disclosure line above the buy button. Today you learn it from the homepage and the terms rather than at the moment of payment.
- The delivery emails. Neither the paid report email nor the free tier email states that the report was AI-generated.
- The first screen of the paid assessment. It does not yet tell you, before question one, that your answers are analysed by an AI system. That currently sits in the privacy policy, which is exactly the placement our own sample report tells customers not to rely on.
- The sample report page. The published sample does not yet mirror the "how it was made" block.
- The privacy policy's processor list still names a form host we have stopped using. That list is being corrected.
None of these is a strict Article 50 breach. Article 50(1) covers systems interacting directly with a natural person, which here is the chat assistant and only the chat assistant, and that one discloses. The rest are GDPR transparency and plain credibility: a person handing us assessment answers should be told at that moment that an AI will read them, not three clicks away in a policy. We are treating them as though they were breaches, because the alternative is selling a diagnosis of a failure mode we still have.
On synthetic content marking
Article 50(2) places the machine-readable marking duty on the provider of the generative system - Anthropic, for Claude's output - not on us as a downstream deployer, and it applies from 2 December 2026. We are not required to watermark your report. We intend to state its origin in the document anyway, because a report that arrives in an enterprise legal team's inbox should say what produced it.
On imagery
We do not publish AI-generated images of real people, places or events. Our visuals are abstract brand graphics. If that ever changes, we will label them under Article 50(4).
Article 4 - AI literacy record
Reglynn AI literacy record. Veronika Samotii - sole operator; provider of Reglynn, deployer of Anthropic's Claude. Training: Umiejętności Jutra AI 3.0 (2026). Scope: what the report engine does, its failure modes, how to recognise a misclassification, and the limits of what the product may claim. Reviewed 4 September 2026. To be updated if anyone joins.
That is the whole obligation for a company of one. Article 4 was reworded by the June 2026 Omnibus and remains in force. It is worth saying plainly, because it is widely treated as either terrifying or imaginary and it is neither: it is a dated record of who knows what.
What we get wrong, and the limits of this
A self-assessment that only lists strengths is marketing. Ours has real limits:
- Classification at the boundary is the hard part, and we do not claim to have it perfect. The failure mode we work hardest against is over-classification - telling a company it is high-risk when Article 6(3) would exempt it. The report engine runs role, then GPAI, then the 6(3) exemption, then establishment, in that order, specifically because assigning someone else's duties to a deployer is what makes these tools useless.
- The report reflects your answers. Inaccurate input produces an inaccurate report. No amount of model quality fixes that.
- Reports are currently written in English only, whatever language you read this site in. The site is translated; the report is not yet.
- We are not a notified body and cannot certify anything. Our badge says "self-assessed" for that reason, and it always will.
- The regulation moves. Your report is stamped with the date and regulation version it was generated against. That stamp exists because we expect it to matter.
Why publish this at all
Three reasons, and only one of them is compliance.
The first is that it is the obligation. Article 50 asks for disclosure where AI is involved, and a single page collecting all of it is a better answer than six scattered mentions.
The second is that our own sample report tells customers to publish a user-facing AI disclosure rather than bury it in a privacy policy. Doing the opposite ourselves would be indefensible, and we would deserve to be called on it. The open list above is us saying it before anyone else does.
The third is simpler. If you are deciding whether to trust a €59 report about your own AI Act position, the most useful thing we can show you is our reasoning applied to ourselves - including the part where we flag the one limb of Annex III that sits near us, and the part where we list what we have not finished. You can judge the quality of the thinking before you pay for it.
If you think we have got any of this wrong, we would genuinely like to know: hello@reglynn.eu. Being publicly corrected on our own assessment would be embarrassing and useful, in that order.
Frequently asked questions
Is Reglynn itself an AI system under the EU AI Act?
Yes. Reglynn performs inference to generate compliance reports and recommendations, which meets the Article 3(1) definition. Reglynn is the provider of that system and a deployer of Anthropic's Claude. It is classified as limited risk, with Article 50 transparency as its obligation set.
Is Reglynn a certification?
No. Reglynn produces a structured self-assessment. It is not a conformity assessment, not a certification, and not legal advice. Reglynn is not a notified body, and its trust badges state self-assessment only.
Are my assessment answers used to train AI models?
No. Answers are processed to generate your report and are never sold, shared beyond the listed processors, or used to train AI models. Reports are generated using Anthropic's Claude API, and data submitted via that API is not used for model training.
Why is Reglynn not high-risk under Annex III?
Annex III attaches to systems making or materially influencing decisions about natural persons. Reglynn assesses a company's AI system - its subject is a legal person's software, not a human being. It does not profile individuals or gate anyone's access to employment, credit, education or services.
Now run it on yours
The same four-step logic - role, GPAI, risk tier, establishment - applied to your product. Free scan takes two minutes.
Start the free scanNo card, no account. Full gap report from €59. See a sample report first. Prices exclude VAT, added at checkout where applicable. 14-day refund.
Self-assessment, not legal advice. This page and the Reglynn report are a structured self-assessment based on the EU AI Act (Regulation 2024/1689, as amended by the June 2026 Omnibus). They indicate where you likely stand and what to verify with a qualified advisor. Reglynn is not a notified body and issues no certification.
How this was made. Reglynn reports are generated by an AI system built on Anthropic's Claude and delivered automatically. Reglynn is a Limited Risk AI system under Article 50; we disclose AI involvement wherever it occurs, including in our chat assistant. Our own self-assessment.