Nextcloud AI features and the EU AI Act

Which EU AI Act duties apply when you run Nextcloud AI features

Nextcloud's AI features can support two duties under the EU AI Act: the transparency duties in Article 50 and the AI literacy duty in Article 4. That support only goes as far as your installation's documented features and logs, so treat those features as evidence to verify, not as a finished answer. The platform does not decide whether your use is in scope, does not train your staff, and does not make your organization compliant with any article. DeployOpen plans and prepares the systems, configuration and evidence these duties call for, but it does not certify compliance. Independent auditors and certification bodies issue assessments, and your legal counsel interprets the Act for your situation.

Start with roles, because they decide which duties land on you. Article 3 separates providers, who develop an AI system or have it developed and place it on the market or put it into service under their own name or trademark, from deployers, who use an AI system under their authority outside personal non-professional use. An organization that enables Nextcloud Assistant or a third-party AI app on its own server is usually a deployer of that app, and the app's developer is usually the provider. That changes if you write a custom AI app, place a model under your own name, or distribute the result. Article 2 reaches EU deployers and also non-EU deployers whose AI output is used in the EU. Build a register listing each AI app, its developer, its version and the person accountable for it, and confirm each role in writing with counsel.

Article 4 has applied since 2 February 2025 and covers providers and deployers of all AI systems, not only high-risk ones. It is therefore already in force for an organization running Assistant today. In substance, it asks you to take measures so that staff and others who operate or use AI systems on your behalf have sufficient AI literacy for their role and the context of use. The article does not name a course, length or format, so the work is to define groups such as administrators who configure AI apps, support staff and end users, then match training to each group. Before you cite AI interaction records or audit logging as evidence of training or use, confirm with Nextcloud which AI features your version documents and what those records actually capture on your server.

Article 50 is where the platform's labeling and records matter most, but several of its duties sit with providers. Under Article 50(1), providers must design AI systems that interact directly with people so those people are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person. Article 50(2) requires providers to mark synthetic text, audio, image or video output in a machine-readable format. As the deployer, you should test how the feature behaves in your environment, and you must disclose AI-generated text published to inform the public on matters of public interest under Article 50(4), unless it has undergone human review or editorial control with a person holding editorial responsibility. Article 113 applies the rest of the Act, including Article 50, from 2 August 2026.

Enforcement and exposure should set the order of work. National market surveillance authorities enforce the Act for AI systems, and Article 99 sets maximum fines of EUR 15 million or 3% of worldwide annual turnover, whichever is higher, for most operator obligations. Regulation (EU) 2026/1744 changed the dates for the high-risk rules, so confirm with counsel whether that amendment touches any date that applies to Article 4 or Article 50 for your deployment. Your next steps are to complete the role register, ask each vendor which Article 50 marking and labeling its feature provides, document your AI literacy measures, and verify on your own installation that the records exist as described. DeployOpen can prepare the configuration and evidence for that work, but the compliance judgment and any audit remain with your organization and independent assessors.

How each AI Act requirement maps to Nextcloud configuration

This table maps each AI Act duty relevant to Nextcloud AI features to the platform capability and the configuration your team needs. Read the middle column first, because several answers depend on the AI app and version you install. Identity links such as LDAP, OpenID Connect and SAML only attribute activity to users, so they do not satisfy any requirement on their own.

Requirement	Platform capability	Configuration needed
Article 4: Staff who operate or use AI systems must have sufficient AI literacy, scaled to their role and context.	Not a platform feature. The duty is met through training and policy, which Nextcloud does not supply.	Define which AI apps each role may use, deliver role-based training, and keep attendance and policy acknowledgment records.
Article 50(1): People who interact directly with an AI system must be told they are dealing with AI, unless this is obvious to them.	Confirm with Nextcloud documentation for your installed app version whether the assistant interface shows an AI notice.	Add an AI notice in onboarding and the app's description, then test the first-run experience with a new test account.
Article 50(2): Providers must mark synthetic text, image, audio or video output in a machine-readable way.	Confirm whether the installed AI app writes machine-readable markers to generated files or text. The duty sits mainly with the AI system provider.	Get the marking method in writing from the app provider. If none exists, record the gap and add a documented tagging step.
Article 50(4): Deployers publishing AI-generated text on public-interest matters must disclose it, unless a person with editorial responsibility reviewed it.	Nextcloud does not decide what gets published. Disclosure depends on the workflow you build around approvals.	Route drafts through a named editor's review in Collectives or Deck, and add the disclosure text to every published page.
Articles 3(3) and 3(4): Providers develop or place AI systems under their name. Deployers use them under their authority, outside personal use.	Not a platform feature. Your role depends on how you obtain, modify and brand each AI app.	Record each AI app's developer, version and whether you modify or rebrand it, since modification may shift provider duties.
Article 2: The Act reaches EU deployers and non-EU providers or deployers whose AI output is used in the EU.	Not a platform feature. Scope depends on where your users are and where outputs are used.	Document which user groups and sites use AI features, and whether any output reaches EU residents or EU-based operations.
Supporting control: Attribute each AI interaction to a named individual for internal records.	LDAP, OpenID Connect and SAML identify users. They do not create AI disclosures or labels.	Connect the directory your staff already use. Confirm which events the audit logging app records for the installed version.

Are you a provider or a deployer under the AI Act?

Your role under the EU AI Act decides which duties apply to you, so settle it before you switch on Nextcloud Assistant or any AI app. Article 3(3) defines a provider as an operator that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Article 3(4) defines a deployer as an operator that uses an AI system under its authority, outside personal non-professional use. The same organization can hold both roles for different systems, and the answer is set per system, not per organization.

Nextcloud GmbH's Assistant and the third-party AI apps you install are built by others, so the question is what your organization does with them. If you only install and operate a component under your authority, you are normally a deployer. If you modify a component, put your own name or trademark on it, or make a system you built available to others, you may also be a provider. Renaming an app in your own interface, for example, is the kind of step that can change your position, so record every rebrand and custom build. Confirm with counsel how "into service" applies to purely internal use of a system you built yourself.

The duties follow the role. Providers carry the design and marking obligations in Article 50(1) and 50(2), which require systems that interact with people to disclose that they are AI, and generated content to be marked in a machine-readable format. Deployers carry the disclosure duty in Article 50(4) for AI-generated text published to inform the public on matters of public interest, unless human review or editorial control applies. Article 4 on AI literacy applies to both roles for all AI systems. High-risk obligations have their own dates, which the 2026 amendment changed, so check the current consolidated text.

Illustrative scenario: a regional university installs a third-party AI app on its Nextcloud server, uses it internally, and publishes AI-drafted summaries of council decisions on its public website without editorial review. In this case the university is most likely a deployer, and it should assess whether Article 50(4) requires disclosure of those summaries. If the same university instead forks the app, renames it, and offers it to other institutions, it moves toward the provider role and its engineering and documentation duties grow. The facts decide the outcome, so the scenario is a prompt for review, not a conclusion.

Before deployment, build a short register for each AI component: who developed it, whether it was modified or rebranded, who uses it, and whether any output reaches the public or external parties. Ask Nextcloud GmbH or the app developer to document origin and any changes you cannot see. Then take that register to counsel and confirm your role per component, along with the dates that apply to your use. Review the register whenever you update an app or change what it is used for, because the role can change with a configuration or branding decision.

What evidence to keep for AI Act transparency and literacy

Most of the evidence for Nextcloud AI features is a set of dated records your organization keeps itself. The six categories below cover what users see, what the server records, how published AI text is reviewed, what staff are trained on, and how your role under the Act was decided. Each one needs a named owner and a retention rule set with counsel.

AI app inventory and versions

Record which AI apps are installed and enabled, the version of each, the model or external service each one calls, and the date of every change. Export this from the server at fixed points, such as before and after each monthly maintenance release, and store the copies outside the instance. Auditors and counsel will ask what was live on a given date, so the inventory should answer that without relying on memory.

Notices shown to users

Keep the disclosure text shown when someone interacts directly with an AI feature, which Article 50(1) requires unless the interaction is obvious in context. Also keep any label applied to AI-generated output. Capture the wording, each language version, where it appears in the interface, and the dates each version was live. Test-account screenshots that show the version number are often easier to defend than configuration files alone.

Review records for published AI text

Under Article 50(4), AI-generated text published to inform the public on matters of public interest must be disclosed unless it went through human review or editorial control and someone holds editorial responsibility. For each published item, record the reviewer, the review date, the changes made, and the approver. This matters most when Assistant drafts reach public web pages, press material or newsletters. Name the accountable editor in writing.

Server audit logs kept outside the instance

Server logs show evidence only if logging is switched on for the events you need, and only if copies are retained beyond the instance. Confirm which AI-related events, administrator changes and file access events the server records, where the log is written, and how long it is kept. Forward copies to a store that instance administrators cannot quietly edit, and test that a sample event arrives there. Set retention periods with counsel.

AI literacy training records

Article 4 has applied since 2 February 2025 and covers providers and deployers of all AI systems, so staff who use or oversee Assistant and other AI apps need training matched to their role. Keep the course outline, the audience, the dates, attendance, and the assessment or acknowledgment each person completed. Refresh the records when an AI app is added or its behavior changes. The Act does not prescribe course content, so tie it to your own deployment.

Role determination memo

Record whether your organization acts as a provider or a deployer for each AI feature, and the reasons. Under Article 3, a provider develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, while a deployer uses it under its authority outside personal non-professional use. Running an open-source app on your own servers does not by itself settle the role. Date the memo, list the features it covers, and revisit it when an app or its purpose changes.

How to configure Nextcloud AI apps for transparency and records

This sequence shows how to inventory Nextcloud AI apps, confirm your legal role, set user notices, verify labeling, retain audit records, limit access and document editorial review. The output is a configuration register that compliance, security and platform teams can check against the AI Act duties that apply to your deployment. Menu paths depend on the app version, so confirm each setting against the documentation for the version you run.

Inventory enabled AI apps and versions
The Nextcloud administrator lists every AI-related app enabled on each server, with its version, and every environment where it runs, including test and staging systems. For each app, record whether it sends prompts or content to a model hosted by a third party or to a model on infrastructure you control, because that changes your data flow and supplier questions. Compare the Nextcloud server version with the maintenance and release schedule to confirm the installed release still receives security fixes. The step is done when the owner of the AI deployment signs off the inventory and it is stored with your compliance records.
Confirm the role determination
Legal or compliance owners, with the platform team, decide whether your organization acts as a provider or a deployer for each AI use. Under Article 3, a provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority outside personal non-professional use. Organizations that enable a third-party AI app without building it are usually deployers, but rebranding, custom models or added AI components can change the analysis, so confirm each use case in writing. The step closes with a dated role record for each AI app and use case.
Set user-facing notices for AI interaction
Article 50(1) places the duty to design direct AI interaction so people know they are dealing with an AI system on the provider, and it provides an exception where this is obvious to a reasonably well-informed, observant and circumspect person. As deployer, you still control the context in which users meet the AI features, including entry points, welcome text, shared spaces and guest access. Use the notice options the installed version documents, or add your own banner or policy text where the app offers none. Test the notice with one account from each group that can reach AI features. The step is done when screenshots of each notice location are attached to the role record.
Verify labeling and marking options
Article 50(2) requires providers of systems that generate synthetic audio, image, video or text to mark outputs in a machine-readable format. As deployer, you verify what the installed version of each AI app documents about labeling, marking or metadata on generated content, and whether that setting is on by default. Do not assume a capability exists. If the documentation does not describe it, record it as an open gap and raise it with the app provider. Generate test outputs in each app, then inspect the files and exported text for the marking you expect. The step is done when every app has an entry stating what is marked, how you checked it and what remains open.
Configure audit logging and forward logs
Enable audit logging on the server and confirm which AI-related events the installed version records, such as which account used an AI feature, when, and in which app. Use the audit options the version documents, and check the server audit configuration guidance for the detail on each event type. Forward these logs off the server to storage you control, with retention set by your records policy rather than by the default settings of the server. Test by performing a known AI action with a test account, then search the retained store for that event. The step is done when the test event appears in retained storage with its timestamp and account, and someone outside the administration team can read it.
Restrict AI features to approved groups
Use group membership to limit which users can open each AI app and feature, starting with the groups named in the role record for each use case. Keep guest accounts and external sharing users out of AI features unless the role record covers them. Confirm for each app whether the installed version supports group-based restriction, and record the method if it does not. Test from the user side by signing in as one member of an allowed group and one member of a blocked group. The step is done when the test results are attached to the register and the group list matches the approved use cases. Recheck the list after directory or SSO group changes, since those can change access without any edit on the Nextcloud side.
Document review for public-interest publications
Article 50(4) requires deployers that publish AI-generated or manipulated text to inform the public on matters of public interest to disclose the AI origin. The disclosure is not required where the text has undergone human review or editorial control and a person holds editorial responsibility for it. Write a short procedure that names the reviewer, the checks the reviewer performs, the person holding editorial responsibility and how the disclosure or review record is kept with each publication. Link the procedure to AI literacy training for staff who use the AI features, since Article 4 has applied since 2 February 2025. The step is done when a named editor signs the procedure and a sample publication shows its review record.

What the Article 4 AI literacy duty requires from your staff

Article 4 of the AI Act requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI on their behalf. It has applied since 2 February 2025, and it is not limited to high-risk systems. If your employees use Nextcloud Assistant or another AI app enabled on your Nextcloud server, the duty already applies to you as a deployer. Treat it as a current obligation with no later start date, not as a future item for the high-risk rules.

Sufficient AI literacy is a judgment about your own organization, and the Act does not define it through a fixed curriculum. It does not prescribe a course, a number of hours or a certificate. What it expects is that you consider the people involved, their technical background, the context in which they use the tool and the risks that follow from that use. For Nextcloud Assistant, that usually means staff who draft or summarize documents, staff who work with files containing personal or confidential data, and administrators who decide which AI apps and models are enabled and which groups can reach them. Each group needs a different level of understanding, so one generic session for everyone is rarely enough to show you considered them.

In practice, a defensible approach has three parts. First, role-based training: map each role to the Assistant features it uses and the data it touches, then set the content for that role. Second, documented completion: keep records showing who was trained, on which version of the material, and when, and tie those records to the group memberships that grant access to AI features. Third, refreshers when AI features change: a new model, a new Assistant capability or a changed data flow should trigger a review of the training and, where needed, a short update. Confirm with your legal or compliance team how they want these records kept and how long they are retained.

Decide early who owns the AI literacy programme, who approves the role map and who signs off on refresher triggers. Confirm with your own team how the Nextcloud app inventory and admin audit records can support the evidence you keep, and be clear that these records show what you did, not that the training achieved a particular result. Your internal policy should state the approach, the roles covered and the review cycle in writing. The Act leaves this design to you, so the record of your reasoning is part of the evidence.

What Nextcloud and the AI Act do not cover for you

Nextcloud's AI features can label output, keep interaction records and log activity, but they remain product features. The six items below are duties and decisions that stay with your organization, whichever version or support tier you run.

Use case classification

The platform does not decide which risk level your use of an AI feature falls under. The same Nextcloud Assistant may be low risk in one department and high risk in another, because the Annex III categories depend on the purpose of use and the people affected. Document the classification for each use case, and check high-risk status separately from the software deployment.

Provider or deployer role

The software vendor's role does not settle yours. Your organization may take on provider duties if it builds its own AI system, substantially modifies an AI app, or places a system on the market or puts it into service under its own name. Most organizations that only use Nextcloud AI features are deployers, but confirm the role for each system, because the duties differ.

AI literacy program and records

Article 4 has applied since 2 February 2025 and covers providers and deployers of all AI systems, not only high-risk ones. The platform does not train your staff or keep training records. Build a literacy program suited to the roles that use Nextcloud AI features, record who completed it and when, and update it as features and use cases change.

Public-interest publication review

Under Article 50(4), deployers that publish AI-generated or manipulated text to inform the public on matters of public interest must disclose it, unless the text has undergone human review or editorial control and someone holds editorial responsibility. A machine-readable label on an Assistant draft does not decide this. Define which publication channels trigger review, name the editorial owner, and keep a record of each review.

Chapter III timing for high-risk rules

As amended in 2026, the high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems. Until your classification is documented, record the status as open. For any use case that may fall in Annex III, schedule documentation, risk management and human oversight work against the 2027 date.

Enterprise tiers and audit evidence

Nextcloud Enterprise tiers change the maintenance lifecycle, support hours and response times, according to Nextcloud's pricing page. They do not change your AI Act duties or produce conformity or audit reports. Most Annex III systems use internal-control conformity assessment under Annex VI, so your team assembles the technical evidence. DeployOpen can prepare that evidence, but it does not issue reports, and any external assurance comes from independent auditors or certification bodies.

When each AI Act duty starts and what changed in 2026

The first duties under the EU AI Act are already in force, and the ones that matter most for a Nextcloud Assistant rollout arrive in stages. Article 4 on AI literacy has applied since 2 February 2025 and covers providers and deployers of every AI system, not only high-risk ones. An organization that enables AI features for staff today already carries an AI literacy obligation. The transparency duties in Article 50, which cover telling people they are interacting with an AI system and marking generated content, fall under the rest of the Act, which applies from 2 August 2026. Before that date, confirm which Nextcloud AI features are switched on for which user groups, because each feature may map to a different duty.

The application dates run in three steps. Chapters I and II, covering definitions, AI literacy and prohibitions, have applied since 2 February 2025. The general-purpose AI, governance, notified body and penalty chapters have applied since 2 August 2025, except Article 101. The rest of the Act applies from 2 August 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, changed the high-risk timeline. It was published on 24 July 2026 and entered into force on 27 July 2026. Under the amendment, the high-risk rules in Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems. Record each Assistant use case against Annex III now, so you know whether any of them could fall into the high-risk category.

Article 99 sets the maximum fines, and the thresholds are set by the Act itself. Prohibited practices carry fines of up to EUR 35 million or 7% of worldwide annual turnover. Most operator obligations carry up to EUR 15 million or 3%. Misleading information given to authorities carries up to EUR 7.5 million or 1%. In each case the higher figure applies. National market surveillance authorities enforce the Act for AI systems, so the enforcing authority depends on where your users and operations sit. Ask legal counsel which authority would supervise your deployment and whether the Act reaches your instance under Article 2, including for non-EU organizations whose AI output is used in the EU.

Plan the upgrade calendar around these dates. Nextcloud publishes a new major version every four months and supports each for one year. Nextcloud 35 (Hub 26 Summer) was released on 16 September 2026, and Nextcloud 36 (Hub 27 Winter) is scheduled for 17 February 2027. Nextcloud 33 is supported until February 2027 and Nextcloud 34 until June 2027. Nextcloud does not allow skipping major releases, so each step is a separate upgrade with a backup taken first, and third-party apps must be confirmed compatible before you proceed. Re-check the version of the AI app at every one of these upgrades, along with its labeling and AI interaction record settings, because a change in the app can change the evidence your compliance file depends on. Test each upgrade on a staging copy before relying on it in production.

Questions buyers ask before hiring help with the AI Act

How much does EU AI Act work for Nextcloud cost?

Cost follows the written scope. The main drivers are role determination, the number of AI apps in use, publication workflows that need human review, the depth of staff training, and how long evidence is retained. Role determination and the number of AI apps set how many systems need analysis. Publication workflows add review steps for public-facing text. Training scope and evidence retention drive the recurring effort. DeployOpen does not publish a price list. Ask for a fixed-scope written quote that lists each deliverable, the assumptions behind it, and which items are one-time and which recur. Budget for the Nextcloud subscription separately. The Nextcloud pricing page lists Enterprise Standard, Premium and Ultimate tiers from 71.29, 104.99 and 204.75 euros per user per year for 100 or more users. Those are software fees paid to Nextcloud GmbH and are billed apart from services.

How long does an AI Act project for Nextcloud take?

No duration is fixed in advance. Timing depends on the same drivers as cost, plus how many AI apps are already live, how quickly named owners can decide role and publication questions, and how much evidence your logs already hold. Ask each proposal for a timeline tied to milestones: role and system inventory, configuration of labels and interaction records, training delivery, and evidence handover. Your change windows also matter. Nextcloud requires one major version at a time during upgrades, with a backup before each upgrade, so any version change inside the project adds sequencing. Check the dates yourself. Article 4 has applied since 2 February 2025, and the rest of the Act applies from 2 August 2026, subject to the 2026 amendment. Some work may already be due, so confirm the current timetable with counsel before setting a deadline.

What does our organization need to provide for an AI Act project?

Three inputs set the pace: named owners, legal input and access. Name one accountable owner for AI use, a technical owner for configuration, and a decision-maker for any workflow that publishes AI-generated text. Legal input must cover role determination and whether any AI output counts as public-interest text under Article 50(4). Technical access means administrator rights on the Nextcloud instance, visibility into the apps in use, and access to the server and audit logs that record AI interactions. A test environment with a recent copy of the instance lets changes be checked before production. Agree in writing who approves changes and who signs off evidence. Delays most often trace to unanswered role questions and slow approvals.

Can our own team handle EU AI Act work for Nextcloud alone?

Yes for parts of the work, if the team has Nextcloud administration skills and time to spare. A capable internal team can inventory AI apps, adjust settings, keep audit logs, and draft procedures. Outside help is most useful when you need a fixed scope with written deliverables, when staff are already committed to upgrades and daily operations, or when you want an independent review of your evidence before an assessment. Check three things before deciding: whether someone can own the evidence over time, whether they can keep the instance current through the Nextcloud release cycle, and whether legal input is available on role questions. A short internal pilot on one AI app can show the effort involved before you commit to a wider scope.

Are we a provider or a deployer under the AI Act?

It depends on how each AI system reached you and who puts it into use under your authority. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority outside personal, non-professional use. Organizations that enable Nextcloud AI features for staff are usually deployers. An organization that builds an AI app or offers one under its own name may take on provider duties, including the design and marking obligations in Article 50. Settle the question for each system in writing, with counsel, before choosing controls, because the duties differ between the two roles.

Does the AI Act apply to a small organization using Nextcloud AI?

Size alone does not decide it. The Act applies to providers placing AI systems on the EU market and to deployers in the EU, and Article 2 extends its reach to some non-EU providers and deployers whose output is used in the EU. Article 4, on AI literacy, has applied since 2 February 2025 and covers providers and deployers of all AI systems, not only high-risk ones. A small organization with staff using an AI assistant therefore still needs proportionate literacy measures. The risk level of each use case determines which heavier obligations apply. Smaller teams can scale the work down, but the scope still needs to be written down and reviewed. Confirm applicability for your organization with counsel.

What are the fines for breaking the AI Act?

Under Article 99, the maximum fine for prohibited practices is 35 million euros or 7% of worldwide annual turnover. The maximum for most operator obligations is 15 million euros or 3%, and misleading information given to authorities can reach 7.5 million euros or 1%. In each case the higher figure applies. National market surveillance authorities enforce the Act for most AI systems. The Commission's AI Office enforces the rules for general-purpose AI models and, under Article 75(1) as amended in 2026, holds exclusive competence for AI systems built on a provider's own general-purpose model. These figures are statutory maximums, and actual outcomes depend on the facts. For most organizations, the practical exposure is being unable to produce documentation when an authority asks for it.

How do Nextcloud labels and audit logs support AI Act transparency?

They provide evidence and some controls, but they do not satisfy Article 50 on their own. Article 50(1) requires that people are told when they are interacting with an AI system, unless this is obvious in context. Article 50(2) places machine-readable marking duties on providers of systems that generate synthetic content. Interface labels help people recognize AI output, and interaction records and audit logs help you show what was generated, when, and by whom. Before relying on them, confirm with the vendor which AI features write which labels and records, where those records are stored, how long they persist, and whether they can be exported for review. Test these settings in a non-production copy of the instance before you rely on them.

How DeployOpen scopes and delivers AI Act configuration and evidence

DeployOpen scopes the Nextcloud AI features your organization turns on, maps each one to the EU AI Act duties that apply to your role as provider or deployer, and then configures and documents the controls in infrastructure you control. Engagements are fixed-scope, with scope and deliverables agreed in writing before work starts.

How we scope

Written scope lists which Nextcloud AI apps, user groups and data flows fall under review.
Role mapping records whether your organization acts as provider or deployer for each feature.
Scope confirms transparency duties under Article 50 and AI literacy duties under Article 4 for each use.

How we build

Configure disclosure notices so users know they are interacting with an AI system.
Set up labeling and metadata for AI-generated outputs where the chosen apps support it, confirmed in testing.
Enable AI interaction records and audit logging, then test that entries capture the events the scope requires.

How we hand over

Documentation maps each configured control to the Article it supports and the owner who maintains it.
Evidence packs hold configuration exports, test results and log samples for your internal reviewers.
Handover includes a runbook covering who reviews AI app changes and how logs are retained.

How we support

Retainers cover monthly Nextcloud maintenance updates, re-checks after app updates and scope changes.
Regulatory changes, including the 2026 amendments to the Act, are reviewed against the documented controls.
Ongoing support is available as a retainer, with scope and response terms agreed in writing.