EU AI Act and Outsourced AI Work: What Actually Matters

This is a plain-language explainer, not legal advice — talk to counsel for a compliance opinion specific to your business. But if you're an EU company considering outsourcing work to an AI vendor, three practical questions are worth asking before you sign anything, because they map directly to what regulators and customers will ask you.

1. Where does your data actually go?

Most AI vendors route requests to whichever underlying model is cheapest or fastest at that moment, often outside the EU. That's a reasonable default for low-stakes work, but it means your data — including anything a client mentioned in a task description — can end up processed by a non-EU provider you never agreed to. The fix isn't complicated: anonymize personal data before it leaves your systems, regardless of which provider ends up doing the work, and give yourself the option to restrict processing to EU-approved providers when the task requires it.

2. Can you say which model did the work?

Transparency obligations under the EU AI Act generally expect that AI-generated output can be traced and disclosed — you should be able to say, after the fact, which system produced a given result. A vendor that routes silently between a dozen providers and can't tell you afterward which one handled your task isn't giving you that. Ask for provider-level logging on every delivered task, not just a generic “powered by AI” disclaimer.

3. Is compliance a mode you can turn on, or a marketing claim?

“EU AI Act compliant” as a blanket claim about an entire product usually means very little — obligations vary by intended use and by each party's role. What you can reasonably expect is evidence: a documented provider policy, precise redaction limits, a visible model log, human oversight and use-case risk screening. No routing switch alone establishes compliance.

On LEMAIT, that's exactly what the EU AI Act processing mode does at the workspace level: it drops providers we consider unsuitable for EU-regulated work from routing (today: Chinese-hosted models), strips contact and identifier data — emails, phone numbers, bank and tax identifiers — out of the text before any provider sees it, and logs which model handled each task — versus the free mode, which optimizes for the lowest price across all providers. You can switch per workspace, and the setting is visible on every task.