# Regulatory Position: EU AI Act

This page states, in plain terms, where Maistik Forge sits under Regulation (EU)
2024/1689 (the **EU AI Act**). It is written for teams evaluating Forge in an EU
context and for the maintainers who keep that posture true.

::: warning Not legal advice
This is a technical position note, not a legal opinion. Your own obligations
depend on how *you* deploy Forge and which AI agent and model provider you wire
behind it. Treat this as a starting map, not a compliance sign-off.
:::

::: details Not a lawyer? Here's the regulatory jargon on this page in plain terms
- **GPAI** — "General-Purpose AI," the Act's term for foundation models like GPT or Claude that can be adapted to many tasks. GPAI obligations bind the companies that build those models, not tools like Forge that merely configure how you talk to them.
- **Deployer** — whoever actually runs an AI system in practice. If you use Claude Code with Forge, *you* are the deployer of Claude Code; Forge is not the thing being deployed, it configures the deployment.
- **Annex III** — the Act's list of "high-risk" use cases (hiring, law enforcement, critical infrastructure, and similar). Something on this list faces heavy obligations; ordinary developer tooling is not on it.
- **Conformity assessment** — the formal process a high-risk AI system must pass before it can be sold or used in the EU. Minimal-risk tools, Forge included, do not need one.
:::

## The one fact that shapes everything

**Forge has no model, and never enters the model's inference loop.**

- **No LLM SDK is imported anywhere** in the codebase — the runtime is a single
  static Go binary. See the [Enforcement Doctrine](/harness/overview).
- Forge renders instruction text and reads back deterministic evidence
  (counters, exit codes, scores). The AI inference happens entirely inside the
  **AI coding agent you supply** (`forge run --cmd …`), against **that agent's
  model provider** — Anthropic, OpenAI, Google, and so on.
- **Forge's AI boundary sends no telemetry.** Model prompts, responses, and your
  source code never pass through any telemetry of Forge's own — that data only
  ever goes to the AI provider you already configured. Forge separately sends
  anonymous CLI usage/error telemetry (command name, version, OS/arch, a random
  install ID) to monitor product health; see
  [Installation](/installation#telemetry). It reads your local repository and
  Git remote to establish project identity; it does not phone home with that
  data.

Because of this, Forge is best understood under the Act as **tooling that
configures and governs other AI systems**, not as an AI system that performs the
regulated task itself.

## Role in the AI value chain

| Act role | Who | Forge? |
|---|---|---|
| **Provider of a GPAI model** | The model maker (Anthropic, OpenAI, …) | ❌ No. Forge trains no model and ships no model weights. |
| **Provider of an AI system** | Whoever places an AI system on the EU market under their name | ▵ Only in the narrow sense that Forge is a distributed tool. It performs no regulated inference of its own. |
| **Deployer** | The organization using an AI system | The **user** running Forge with their chosen agent is the deployer of *that* agent. |

The heavy obligations of the Act — conformity assessment, technical
documentation, post-market monitoring, GPAI training-data summaries — fall on the
**model providers** upstream and on **high-risk deployers** downstream. Forge is
neither.

## Risk classification: minimal

The Act classifies by **use case**, not by technology. A spec-driven development
harness that governs code-generation workflows is **not** listed in **Annex III**
(the high-risk catalogue: biometrics, critical infrastructure, employment,
essential services, law enforcement, migration, justice). Ordinary developer
tooling therefore falls into the **minimal-risk** tier, which carries no
mandatory conformity obligations.

::: tip What this means for the Digital Omnibus deadlines
The **Digital Omnibus on AI** (proposed Nov 2025; provisional Council/Parliament
agreement May 2026) deferred the high-risk Annex III obligations from
**2 August 2026 to 2 December 2027** (and Annex I-embedded systems to
**2 August 2028**). That deferral **does not change Forge's obligations** —
Forge was never in the high-risk tier, so the moved deadline is not load-bearing
for it.
:::

## The obligations that *do* touch Forge

Three light-touch duties apply to any tool that participates in AI-assisted work.
Forge's posture on each:

### Transparency — Article 50 (applies 2 Aug 2026)

Where content is AI-generated, that should be disclosed. Forge's generated
artifacts and its `run` output are produced by **the agent and model you
configured**, and Forge surfaces that provenance rather than obscuring it. See
[Wire It Into a Live Agent](/harness/live-agent-hooks) for where the executing
agent is named.

### AI literacy — Article 4 (in force since 2 Feb 2025)

Organizations must ensure the people operating AI systems have adequate literacy.
Forge supports this by being explicit about **what leaves your machine**: Forge
itself sends nothing to any model; your chosen agent does, under its provider's
terms. See [Getting Started](/getting-started) and [Supported Agents](/guide/agents).

### GPAI supply chain — Articles 53 & 55 (in force since 2 Aug 2025)

These bind the **model providers**, not Forge. Forge's dependency is that the
model providers you connect meet their own GPAI obligations (technical
documentation, copyright policy, training-data summary). Choose compliant model
versions; the supply-chain stance is documented in the `SECURITY.md` file
shipped with each release.

## The line Forge deliberately does not cross

Forge **evaluates artifacts — specifications, designs, code, changes — never
people.** Its ranking and scoring (quality rubric, review lenses, change
prioritization) operate on *work products*.

The moment an AI system is used to **evaluate, rank, or allocate work to
individual workers**, it enters **Annex III (employment)** and becomes
high-risk. Forge is designed to stay on the artifact side of that line, and any
future feature must too. Prioritization in the [dashboard](/features/dashboard)
ranks *changes* by derived urgency, not developers by performance.

## Summary

- Forge is **minimal-risk tooling**, not a high-risk AI system and not a GPAI
  provider.
- The **Digital Omnibus** high-risk deferral is not relevant to Forge.
- Live duties are light: **transparency** (disclose AI-generated output),
  **AI literacy** (be clear about data flow), and **relying on compliant model
  providers**.
- The design invariant that keeps this true: **no model, no inference loop, and
  no code or AI conversations leave your machine through Forge — only anonymous
  CLI usage/error metadata does — and Forge evaluates artifacts, never
  people.**