Table of Contents
1 Legal assessment under the AI Act
1.1 Facts
The Austrian Regulatory Authority for Broadcasting and Telecommunications (RTR) offers a chatbot on the topic of the AI Act in German, accessible to the public via a web interface. This chatbot answers users' questions about the AI Act. The answers are intended as initial assistance and have no legal consequences. Technically, this chatbot is implemented as a "RAG" (retrieval-augmented generation) system. Mistral Small 3 is used as the LLM.
The entire system is published as open source software (Apache 2.0 license) on auf GitHub.
1.2 Subject matter and geographical scope
1.2.1 Geographical scope
In principle, the market location principle applies to the applicability of the AI Act, i.e., the regulations that apply are those for the respective market in which the product is placed on the market, regardless of the place of establishment. The decisive factor here is that the product is made available or put into service in a member state of the European Union, Art. 2 (1) (a) AIA.
The AI Act Chatbot is developed by RTR, which is based in Vienna, an EU member state, and is implemented on its website and made available to the public. Since the AI Act Chatbot is provided and put into operation in the EU, the local scope of application is established.
1.2.2 Material scope
1.2.2.1 Classification as an AI system
A RAG system (abbreviation "RAG" stands for Retrieval-Augmented Generation) is essentially based on a large language model system ("LLM") for finding relevant data sources, which is expanded by additional external knowledge sources (e.g., databases) without the LLM having to be elaborately retrained with this additional data. The initial letters RAG stand for the individual steps that the RAG system goes through to generate a response to a user query, namely retrieving relevant sources ("retrieval"), creating a prompt ("augment") and generating a response ("generate").
It should also be mentioned that an LLM is a general-purpose AI model as defined in Art 3(63) AI Act. If such an AI model is integrated into an AI system, the latter is classified as an AI system in accordance with Art 3(1) AI Act. An AI system is a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.
The AI Act Chatbot implemented on the website of RTR in its function as an AI Service Desk serves as a source of information on regulatory issues related to the AI Act. The external knowledge sources used by the AI Act Chatbot are the text of the AI Act and the publications of the AI Service Desk. In addition, the chatbot contains logic for selecting relevant sources (finding them using vector search of semantic similarity) and a user interface accessible to end users. The AI Act Chatbot is therefore classified as an AI system. The AI Act Chatbot from RTR is obviously a chatbot that generates a user's questions about the AI Act using a predefined prompt.
As an AI system, the AI Act Chatbot is therefore fundamentally subject to the scope of application of the AI Act.
1.2.2.2 Exception for open source?
The first step is to check whether any exceptions to the material scope of the AI Act apply. Due to the publication of the complete source code under an open source license, Art 2 (12) AI Act must be specifically examined. This regulation, introduced for the purpose of promoting free research and development, stipulates that AI systems provided under free and open source licenses are excluded from the material scope of the AI Act. However, this exception does not apply in the case of high-risk AI systems (Art 6, Annex I and III AI Act), prohibited AI systems (Art 5 AI Act) and AI systems with limited risk (Art 50 AI Act) (see Risk levels of AI systems).
Therefore, it must first be determined whether the AI Act Chatbot can be classified as one of the types of AI systems listed in Art 2 (12) AI Act. To do this, it must first be examined whether the AI Act Chatbot can be subsumed under one of the circumstances listed in Art 5 AI Act.
Art 5 AI Act regulates prohibited practices in the field of AI. Since the AI Act Chatbot developed by RTR cannot be subsumed under any of the circumstances specified in the relevant legal norm, it does not constitute a prohibited AI system under Art 5 AI Act.
The next step is to examine whether a high-risk AI system within the meaning of Art 6 of the AI Act exists. A high-risk AI system poses a high risk in terms of the probability of damage occurring and also the extent of damage to individual or public interests. However, high-risk AI systems pursuant to Art 6 of the AI Act are not prohibited per se due to the existing increased risk, but rather their placing on the market or putting into service is only permitted if certain requirements are met. Such AI systems are listed in Annex I and III of the AI Act, among others.
An AI system is considered a high-risk AI system if the conditions listed in Art 6(1)(a) and (b) and in Art 6(2) AI Act are met. Art 6(1)(a) and (b) AI Act defines a high-risk AI system as one that is intended to be used as a safety component of a product covered by Annex I to the Union harmonization legislation, or where the AI system itself is such a product. Art 6(b) of the AI Act stipulates that a product whose safety component is the AI system, or the AI system itself as a product, must receive a conformity assessment in accordance with the Union harmonization legislation listed in Annex I with regard to the placing on the market or putting into service of that product. According to the legal definition in Art 3(14), a safety component is a component of a product or AI system that performs a safety function for that product or AI system or whose failure or malfunction endangers the health and safety of persons or property.
In addition to the conditions set out above, pursuant to Art 6(2) AI Act, the AI systems listed in Annex III of the AI Act are to be classified as high-risk AI Systems.
Since, according to the above, the AI Act Chatbot is neither classified as a safety component itself, nor does it constitute a product according to Annex I AI Act, nor can it be subsumed under the use cases listed in Annex III, it is not an AI system that can be classified as high-risk AI system.
The AI Act only imposes legal requirements on AI systems that are not high-risk systems in explicitly regulated cases. These include AI systems for direct interaction with natural persons [Art 50(1) AI Act] and AI systems that generate or manipulate synthetic audio, image, video, and text content [Art. 50(2), Art. 50(4) AI Act].
Since the AI Act chatbot interacts directly with natural persons and generates automatic responses to specific questions relating to the AI Act based on external knowledge sources available to the RAG system (legal text of the AI Act and publications of the AI Service Desk), the facts of Art 50 (1) and (2) must be examined. For more details, see section 1.4.
1.2.2.3 General-purpose AI model, general-purpose AI system
Finally, it must be examined whether the AI Act chatbot can be subsumed under the legal definition of "General-purpose AI systems" pursuant to Art 3(66) AI Act or "General-purpose AI models" pursuant to Art 3(63) AI Act.
General-purpose AI systems are AI systems that are based on a general-purpose AI models and are capable of serving a variety of purposes, both for direct use and for integration into other AI systems.
General-purpose AI models (so-called "GPAI models") are AI models that have significant general usability and are capable of competently performing a wide range of different tasks regardless of how they are placed on the market and can be integrated into a variety of downstream systems or applications. This excludes AI models used for research and development purposes or for designing prototypes. The special feature of these is that they can be modified and made available to AI systems as a basis.
Although the AI Act Chatbot is based on an LLM, it serves only a limited or explicit purpose, namely answering questions about the AI Act. Thus, neither the requirements of Art 3(66) nor (63) AI Act are met. While the LLM used is a general-purpose AI model, the AI Act Chatbot cannot be classified as a general-purpose AI system or a general-purpose AI model due to its limited purpose.
1.2.2.4 Interim findings
Since the AI Act Chatbot is an AI system subject to the provisions of Article 50 (see below), the exception for free and open source licenses does not apply. This also opens up the material scope of application for the AI Act.
1.3 Risk level
There are different risk levels for AI systems, depending on their potential impact or the risks they may pose.
In view of the above reasons, the AI Act Chatbot is an AI system with limited risk. This entails certain transparency obligations under the AI Act. Depending on their role in the value chain, providers and operators of such AI systems must take the measures necessary to fulfill these obligations.
AI models are also classified into risk levels. Here, too, the rule applies: the higher the risk, the stricter the rules.
The GPAI models are therefore subject to specific requirements. Their providers are subject to information and documentation obligations.
Further details on the explicit transparency obligations can be found in section 1.4.
1.4 Role and obligations
1.4.1 Role
As already mentioned in section 1.3 there are different actors in the AI value chain of the AI Act. A distinction must be made between providers, operators, and users, among others.
A provider is a natural or legal person, public authority, agency, or other body that develops or has developed a general-purpose AI system or general-purpose AI model and either places the AI systems or models on the market under its own name or trademark or puts the AI system into service under its own name or trademark. No distinction is made between paid and unpaid activities.
An operator is a natural or legal person, public authority, institution, or other body that uses an AI system on its own responsibility. This does not include the use of an AI system for personal purposes.
An actor can be both a provider and an operator if they also use the AI system they have developed themselves on their own responsibility.
The AI Act chatbot is provided by RTR on its own website under its responsibility and is intended for user inquiries in connection with the AI Act. By entering a prompt, the user receives an automatically generated text-based response. Therefore, the scope of application of Art 50 (1) and (2) is generally applicable. It should be noted here that these are explicit provider obligations. The role of the provider [Art 3(3) AI Act] is fulfilled here by RTR.
Furthermore, it remains to be clarified whether the role of the provider of a general-purpose AI model is fulfilled. This is the case when the general-purpose AI model is used in an AI system. From this, it can be deduced that "developing" within the meaning of Art 3(3) AI Act is taking place.
The AI system in question relies on an existing LLM that is supported by an external knowledge base when responding to customer inquiries. The knowledge base is therefore embedded via "in-context learning" – neither were the model parameters adapted by "fine-tuning", nor was an adaptation carried out via the interposition of a LoRA ("low-rank adaptation"). The AI model is therefore used unchanged.
Based on the above findings and the AI Office's "Code of Praxis GPAI," it can be concluded that the sole use of an existing LLM within an AI system doesn’t fulfill the role of a GPAI model/GPAI system provider. This also applies to the use case of RTR.
Finally, it must be assessed whether RTR fulfills the role of operator of an AI system. Since RTR uses the AI Act Chatbot on its own responsibility, it is also classified as an operator pursuant to Art 3(4) AI Act.
1.4.2 Obligations
Depending on the respective role in the AI value chain, the AI Act regulates different obligations. It is also important to note the specific type of AI systems or AI models involved.
With regard to GenAI systems, Art 50 AI Act regulates various obligations for providers and operators. As soon as an AI system is used that is designed and developed for direct interaction with natural persons, providers of such AI systems must fulfill certain transparency obligations. This involves the obligation to expressly inform users interacting with an AI system if this is not already clearly recognizable from the perspective of a reasonably informed, attentive, and knowledgeable natural person based on the circumstances and context of use [Article 50(1) AI Act]. Providers of AI systems must also ensure that the outputs of the AI system (audio, image, video, or text content) are labeled in a machine-readable format and are recognizable as artificially generated or manipulated [Art 50(2) AI Act].
As a provider of an AI system, RTR must therefore comply with the transparency requirements of Art 50 (1) and (2) AI Act.
1.4.2.1 Transparency obligations under Art 50(1) AI Act
The RTR website features a user interface through which the AI Act Chatbot is accessible and is prominently identified as the "AI Service Desk AI Act Chatbot.”. It is obvious to a reasonably informed, attentive, and knowledgeable person that they interact with an AI system. Therefore the transparency requirement under Art 50(1) AI Act complies with. In addition, after pushing the "Ask a question" button, it is possible to follow after entering the prompt in the input field of the AI Act Chatbot and clicking the how the AI Act Chatbot works and how the answer further down on the website is generated line by line. also makes it clear that a synthetic text is being created.
1.4.2.2 Transparency obligations under Art 50(2) AI Act
As the provider of an AI system, RTR is generally subject to an obligation to provide identification in accordance with Art 50(2) AI Act. The outputs of the AI system are appropriately labeled on the user interface, specifically in the form of a notice indicating that the responses are AI-generated.
RTR is currently unable to meet the legal requirement—where technically feasible—to provide outputs in a machine-readable format. Implementing a technical watermark (recital 133 AI Act) cannot be achieved by RTR at this point in time without disproportionate effort according to the current state of the art. RTR therefore reserves the right to carry out a renewed evaluation of technical possibilities prior to the entry into force of this provision, on August 2, 2026.
1.4.2.3 Other transparency obligations under Art 50(4) AI Act
The transparency obligations of the operator of an AI system that generates or manipulates synthetic audio, image, video, or text content are derived from Art 50(4) subpara2 AI Act. It should be noted that in the case of such text content, this obligation only applies if information is provided on matters of public interest and no human or editorial review takes place.
Art 50(4) AI Act regulates the disclosure obligation of an operator with regard to content generated or manipulated by an AI system (deepfakes). It should be noted that in the case of such text content, this obligation only applies if information is provided on matters of public interest.
The AI Act chatbot generates text content based on the training data (retrieval) which, however, is neither published nor contains information that is of public interest. Therefore, there is no application of Art 50 (4) AI Act.
1.5 Obligation to AI literacy
The legal definition of the term "AI literacy" can be found in Art 3(56) AI Act and reads as follows:
"... skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause;”
Art 4 AI Act imposes an obligation on providers, operators, and data subjects of AI systems to take measures to ensure that their staff and other persons involved in the operation and use of AI systems on their behalf have a sufficient level of AI literacy. What measures these may be depends on the AI system or AI model used and its risk level. The technical knowledge of employees, their experience, their education and training, and the context in which the AI systems are to be used, as well as the persons or groups of persons for whom the AI systems are to be used, must be taken into account. It can therefore be said that AI literacy is an interdisciplinary field that encompasses not only technical but also legal and ethical aspects (recital 20 AI Act). AI literacy must be demonstrated as soon as AI is used and therefore affects all relevant actors in the AI value chain in order to ensure appropriate compliance with and proper enforcement of the regulation. No distinction is made between AI systems and models or risk classes.
Consequently, as a player in the AI value chain and as a provider and operator of an AI Act chatbot, RTR is also subject to the obligation under Art 4 AI Act and must take appropriate measures to demonstrate the required AI literacy. Staff, in particular developers and supervisors of the chatbot, must provide evidence of appropriate education or training. In addition, it must be ensured that users of the AI Act chatbot who work with the AI system on behalf of RTR also have the necessary AI literacy.
Within the framework of its legal mandate pursuant to para 20c KOG and para 194a TKG, RTR has established the AI Service Desk, which serves to build expertise in the design and use of artificial intelligence.
The AI Service Desk is composed of technicians, economists, and lawyers who possess the relevant training and knowledge required for the use of AI. Thus, RTR is able to demonstrate the necessary AI literacy through the established AI Service Desk. This also applies to the development team responsible for maintaining the AI Act Chatbot, which consists of technicians and lawyers from the AI Service Desk.
2 GDPR considerations
Please refer to the German version of this page.
3.2 Software licensing aspects
The entire code of the AI Act Chatbot is published under the Apache Public License 2.0 . This permissive Open Source licence allows (also commercial) use of the entire solution by third parties, without any prior consultation with RTR. This licence covers the entire code of the software except for logos and trademarks of RTR. It is typical in programming to also build on libraries provided by others. The numerous software components used (such as other Open Source solutions from third parties), are automatically recorded and checked for compatibility with the Apache Public Licence 2.0. The list of all software components used is automatically regenerated with each build process, the latest version can be accessed here.