Orderlion EU AI Act Overview

Version 1.0 · 20 August 2026

This page represents our latest version, it can be downloaded here.

‍

Orderlion GmbH, Himmelpfortgasse 17/7, 1010 Vienna, Austria, for the Orderlion platform and related services.

This document sets out how Regulation (EU) 2024/1689 (the AI Act) applies to the AI features in the Orderlion platform: what role we take, how each feature is classified, and what we do about the obligations that follow. It is written for customers and for the people who review software on their behalf. It is a transparency notice rather than a contract; the contractual position is in our General Terms and Conditions and our Data Processing Agreement, both of which are linked at the end.

1. Our role

Orderlion integrates large language models from third-party providers into features offered under its own name. That makes Orderlion the provider of those AI systems within the meaning of Article 3(3) of the AI Act, and a downstream provider in relation to the model providers.

Orderlion is not a provider of general-purpose AI models. We use models through their providers' APIs, with prompting and retrieval of a customer's own data. That stays well below the threshold at which a downstream actor becomes a model provider, so the obligations in Articles 53 to 55 sit with the model providers rather than with us.

Our customers are deployers of the AI features they switch on. The AI Act contains no business-to-business carve-out: where a feature involves interaction with a person, that person's rights apply whether they are a consumer or someone at work.

2. How our AI features are classified

None of the AI features in the platform is a high-risk AI system. Section 3 sets out why. Two of them carry transparency obligations under Article 50.

Inbox order capture, including automatic mode

What it does: Extracts structured order data from emails and attachments forwarded by the supplier, and passes it to the supplier's ERP system. Voice orders are transcribed first
Risk class: Minimal risk
Transparency obligation: None. There is no interaction with a person, and structured order data sent to an ERP system is machine-to-machine output rather than content presented to people

AI assistant (chat)

What it does: Supplier staff ask questions about their own business data and receive answers and suggestions
Risk class: Minimal risk, with transparency
Transparency obligation: Article 50(1). Users are told at the start of every conversation that they are interacting with an AI system, and a notice remains visible throughout

AI business reports

What it does: Scheduled summaries of the supplier's own sales data, delivered to that supplier's staff
Risk class: Minimal risk, with transparency
Transparency obligation: Article 50(2). Machine-readable marking is being implemented ahead of 2 December 2026, the date set by the Act's transitional provisions for features already on the market

Product recommendation campaigns

What it does: Suggests relevant products for each buyer from ordering history. The supplier configures the campaign and approves the content before anything is sent
Risk class: Minimal risk
Transparency obligation: No AI-generated text currently reaches buyers

Where a feature is ever added that sends AI-generated text directly to buyers, it will carry machine-readable marking from launch rather than relying on any transitional period.

Orderlion also uses AI tools internally, for example for meeting notes and drafting. In those cases Orderlion is a deployer rather than a provider, no customer data is processed for those purposes beyond what is described in our Privacy Policy, and internal use is governed by our internal AI usage rules.

3. Why none of our AI systems is high-risk

We assessed every feature against each category in Annex III of the AI Act and recorded the result. In summary:

We use no biometric identification, categorisation or emotion recognition anywhere in the platform. Wholesale ordering software is not a safety component of critical infrastructure. Nothing we offer is used for education or vocational training. Our analytics describe business performance, meaning orders, products and customers, and not the performance or behaviour of individual people. We assess no natural person's creditworthiness; buyers on the platform are businesses. The remaining categories, covering law enforcement, migration, and the administration of justice, are outside anything the platform does.

Because no feature falls within Annex III, the filtering assessment in Article 6(3) and the registration and documentation duties that follow it do not arise.

We have also confirmed that none of the practices prohibited by Article 5 is engaged. Product and promotion recommendations to professional buyers are transparent and based on business data.

This classification holds only while those things stay true, so every new AI feature is checked against the same list before it launches. In particular, no Orderlion feature scores or evaluates individual people, and none infers emotion.

4. Transparency in practice

Interaction with AI. The AI assistant tells users they are talking to an AI system, at the first interaction and visibly thereafter. This has been live since 31 July 2026, ahead of the date the obligation became applicable.

Marking of AI-generated content. Where the platform produces AI-generated text, machine-readable marking is being implemented within the timeline the Act provides.

Naming the AI. We do not present AI output as human-written, and we do not describe our features as making decisions about people, because they do not.

5. The model providers we use

The models behind these features are operated by third parties, which are listed in our subprocessor list along with their role, processing location and transfer mechanism. As at the date of this document they are:

Anthropic, for Inbox order extraction and the AI assistant.
OpenAI, for Inbox order extraction and the AI assistant.
Microsoft Azure OpenAI Whisper, in the EU, for transcribing voice orders before extraction.

Both Anthropic and OpenAI have signed the EU Code of Practice for general-purpose AI in full, and both publish model documentation. Obligations relating to the models themselves, including model transparency, copyright and systemic safety, sit with them. What we cannot delegate, and do not, is the transparency of our own product, the AI literacy of our own staff, and our responsibility as provider for the features we ship under our name.

Orderlion has itself signed the Code of Practice on Transparency of AI-Generated Content, in the version published on 10 June 2026. That is the voluntary code drawn up to support providers in meeting the marking obligations in Article 50, and we have signed it as a provider of generative AI systems.

EU-only processing. Customers who require it can activate an option under which all AI processing for their account takes place exclusively on Anthropic models served through AWS Bedrock in the EU. This is not a preference setting: it changes where processing physically happens, and for those accounts no AI processing takes place outside the EU.

6. Human oversight, and what the customer controls

For Inbox order capture the supplier chooses the mode. In standard mode, staff review every extracted order before it is transferred to the ERP system. In automatic mode, orders transfer directly, and orders the system judges uncertain or anomalous are flagged for manual review. The choice of mode, and the handling of flagged orders, rests with the supplier.

For the AI assistant, every output is a suggestion and every action requires a person to take it.

For recommendation campaigns, the supplier approves the content before anything is sent.

AI outputs are produced by probabilistic systems and can be wrong. The review mechanisms above exist for that reason, and we say so plainly in our General Terms and Conditions rather than implying a level of accuracy we cannot promise.

7. What this means for you

For the features described here, deployers have very few obligations of their own under the AI Act. The main one is Article 4: making sure the staff who use AI features have a sufficient understanding of them. We support that with feature documentation and with the oversight controls described above.

One obligation does fall to you. If you repurpose an Orderlion AI feature for a use that would be high-risk under the AI Act, for example evaluating individual people, then under Article 25(1)(c) you become the provider of that high-risk system, with the full set of provider obligations. Our General Terms and Conditions prohibit that use for exactly this reason.

8. How this document is kept current

This document is derived from an internal AI system register and a dated legal assessment, both of which are reviewed when a new AI feature is planned, when a model provider changes, when Austrian implementing legislation arrives, and when the Commission's guidance on Article 50 changes. It is versioned, and material changes are notified to customers in the same way as changes to our other published documents.