Regulatory Position: EU AI Act
This page states, in plain terms, where Maistik Forge sits under Regulation (EU) 2024/1689 (the EU AI Act). It is written for teams evaluating Forge in an EU context and for the maintainers who keep that posture true.
Not legal advice
This is a technical position note, not a legal opinion. Your own obligations depend on how you deploy Forge and which AI agent and model provider you wire behind it. Treat this as a starting map, not a compliance sign-off.
Not a lawyer? Here's the regulatory jargon on this page in plain terms
- GPAI — "General-Purpose AI," the Act's term for foundation models like GPT or Claude that can be adapted to many tasks. GPAI obligations bind the companies that build those models, not tools like Forge that merely configure how you talk to them.
- Deployer — whoever actually runs an AI system in practice. If you use Claude Code with Forge, you are the deployer of Claude Code; Forge is not the thing being deployed, it configures the deployment.
- Annex III — the Act's list of "high-risk" use cases (hiring, law enforcement, critical infrastructure, and similar). Something on this list faces heavy obligations; ordinary developer tooling is not on it.
- Conformity assessment — the formal process a high-risk AI system must pass before it can be sold or used in the EU. Minimal-risk tools, Forge included, do not need one.
The one fact that shapes everything
Forge has no model, and never enters the model's inference loop.
- No LLM SDK is imported anywhere in the codebase — the runtime is a single static Go binary. See the Enforcement Doctrine.
- Forge renders instruction text and reads back deterministic evidence (counters, exit codes, scores). The AI inference happens entirely inside the AI coding agent you supply (
forge run --cmd …), against that agent's model provider — Anthropic, OpenAI, Google, and so on. - Forge's AI boundary sends no telemetry. Model prompts, responses, and your source code never pass through any telemetry of Forge's own — that data only ever goes to the AI provider you already configured. Forge separately sends anonymous CLI usage/error telemetry (command name, version, OS/arch, a random install ID) to monitor product health; see Installation. It reads your local repository and Git remote to establish project identity; it does not phone home with that data.
Because of this, Forge is best understood under the Act as tooling that configures and governs other AI systems, not as an AI system that performs the regulated task itself.
Role in the AI value chain
| Act role | Who | Forge? |
|---|---|---|
| Provider of a GPAI model | The model maker (Anthropic, OpenAI, …) | ❌ No. Forge trains no model and ships no model weights. |
| Provider of an AI system | Whoever places an AI system on the EU market under their name | ▵ Only in the narrow sense that Forge is a distributed tool. It performs no regulated inference of its own. |
| Deployer | The organization using an AI system | The user running Forge with their chosen agent is the deployer of that agent. |
The heavy obligations of the Act — conformity assessment, technical documentation, post-market monitoring, GPAI training-data summaries — fall on the model providers upstream and on high-risk deployers downstream. Forge is neither.
Risk classification: minimal
The Act classifies by use case, not by technology. A spec-driven development harness that governs code-generation workflows is not listed in Annex III (the high-risk catalogue: biometrics, critical infrastructure, employment, essential services, law enforcement, migration, justice). Ordinary developer tooling therefore falls into the minimal-risk tier, which carries no mandatory conformity obligations.
What this means for the Digital Omnibus deadlines
The Digital Omnibus on AI (proposed Nov 2025; provisional Council/Parliament agreement May 2026) deferred the high-risk Annex III obligations from 2 August 2026 to 2 December 2027 (and Annex I-embedded systems to 2 August 2028). That deferral does not change Forge's obligations — Forge was never in the high-risk tier, so the moved deadline is not load-bearing for it.
The obligations that do touch Forge
Three light-touch duties apply to any tool that participates in AI-assisted work. Forge's posture on each:
Transparency — Article 50 (applies 2 Aug 2026)
Where content is AI-generated, that should be disclosed. Forge's generated artifacts and its run output are produced by the agent and model you configured, and Forge surfaces that provenance rather than obscuring it. See Wire It Into a Live Agent for where the executing agent is named.
AI literacy — Article 4 (in force since 2 Feb 2025)
Organizations must ensure the people operating AI systems have adequate literacy. Forge supports this by being explicit about what leaves your machine: Forge itself sends nothing to any model; your chosen agent does, under its provider's terms. See Getting Started and Supported Agents.
GPAI supply chain — Articles 53 & 55 (in force since 2 Aug 2025)
These bind the model providers, not Forge. Forge's dependency is that the model providers you connect meet their own GPAI obligations (technical documentation, copyright policy, training-data summary). Choose compliant model versions; the supply-chain stance is documented in the SECURITY.md file shipped with each release.
The line Forge deliberately does not cross
Forge evaluates artifacts — specifications, designs, code, changes — never people. Its ranking and scoring (quality rubric, review lenses, change prioritization) operate on work products.
The moment an AI system is used to evaluate, rank, or allocate work to individual workers, it enters Annex III (employment) and becomes high-risk. Forge is designed to stay on the artifact side of that line, and any future feature must too. Prioritization in the dashboard ranks changes by derived urgency, not developers by performance.
Summary
- Forge is minimal-risk tooling, not a high-risk AI system and not a GPAI provider.
- The Digital Omnibus high-risk deferral is not relevant to Forge.
- Live duties are light: transparency (disclose AI-generated output), AI literacy (be clear about data flow), and relying on compliant model providers.
- The design invariant that keeps this true: no model, no inference loop, and no code or AI conversations leave your machine through Forge — only anonymous CLI usage/error metadata does — and Forge evaluates artifacts, never people.