The GDPR has applied since 25 May 2018. The EU AI Act applies in stages, with its main obligations from 2 August 2026. Eugeny is built around both: local-first processing, clear AI disclosure, optional external services named for what they are, and duties matched to the role we hold.
The AI Act arrives in stages. These are the dates that shape the work.
It governs how personal data is collected, used and protected across the Union, including the paths described on this page.
GDPR, Article 99(2)Chapters I and II take effect: the vocabulary the Act uses, the duty to support AI literacy, and the practices it bans outright.
AI Act, Article 113(3)(a)Article 50 transparency takes effect: people are told when they interact with an AI, and synthetic output is marked as far as technically feasible. Enforcement begins for the rules in force.
AI Act, Articles 50 and 113(1)The bans on non-consensual intimate imagery and child sexual abuse material apply. Providers of systems already on the market before 2 August 2026 must meet the Article 50(2) marking duty by this date.
Regulation (EU) 2026/1744, Articles 5 and 111The Chapter III requirements apply to AI systems classified as high-risk under Article 6(2) and Annex III, from documentation and data governance to human oversight.
AI Act, Article 113(3)(c)(i), as amendedThe same requirements reach AI systems that are safety components of products under the Union harmonisation legislation in Annex I.
AI Act, Article 113(3)(c)(ii), as amendedThe 2026 amendment, Regulation (EU) 2026/1744, moved the two high-risk dates and added the December 2026 transition. The Commission keeps the running list on its AI Act Service Desk.
The same product can be a provider's system and a deployer's tool. The GDPR adds controller and processor. Naming the role makes a duty specific.
Scope runs alongside role. The AI Act reaches providers placing systems on the EU market and deployers established or located in the Union, wherever the system was built (Article 2). The GDPR reaches processing in the context of an EU establishment, and offers made to people in the Union (Article 3).
AI Act
We place Eugeny on the market under our name. The duties that follow scale with the system: transparency under Article 50 for the systems it covers, and the Chapter III requirements only where a system is high-risk. Where we release a model under our name, the Chapter V duties come with it.
AI Act, Articles 3(3), 16 and 50AI Act
You use Eugeny under your authority. In professional use, the organisation that deploys it is the deployer, with duties that follow its purpose and context, including human oversight where a system is high-risk. Purely personal, non-professional use sits outside the deployer obligations.
AI Act, Articles 2(10), 3(4) and 26GDPR
Fornace decides why and how personal data is processed for this website, the release you download, support and our own operations. That makes Fornace the controller for those paths.
GDPR, Articles 4(7) and 24GDPR
A team that runs Eugeny on its own machines keeps the data and the control. Where we process on a team's instructions, we do so as processor, under Article 28 terms.
GDPR, Articles 4(8) and 28It follows intended purpose under Article 6 and Annexes I or III, and those duties start on 2 December 2027 for Annex III and 2 August 2028 for Annex I. If you integrate Eugeny into a high-risk use, the classification and the duties are yours to establish. Under Article 25, a party that puts its name on a high-risk system already on the market, or changes the intended purpose of an existing system so that it becomes high-risk, becomes the provider.
Eight commitments, each tied to the duty behind it. Specific enough to check.
The model runs on your Mac, and the default path keeps your work on the machine. Where a hosted service is part of a task, its provider's handling applies.
Fornace releases do not include your conversations without your permission. Soffio memory is held separately and can be inspected and removed. If you finetune a model on your own material, the result carries what you taught it.
Eugeny tells you that you are talking to an AI at the first interaction, in the interface and in plain language.
The AI Act requires providers of systems that generate synthetic audio, image, video or text to mark outputs in a machine-readable way and make them detectable as artificially generated or manipulated, as far as technically feasible, with exceptions for standard editing and outputs that do not substantially alter the input. Deployers disclose deepfakes when they publish them, as the Act requires. We design the studio around that standard.
What Eugeny remembers about your work lives in Soffio, separately from the model. You can inspect it and remove it, and removing it does not require retraining the model.
Eugeny is local-first. Where a hosted model or a media service is part of a task, we name the provider and its own handling applies; the GDPR transfer rules apply where data leaves the EEA.
Provider keys stay in Matchbox and reach a task as scoped access, never as a key inside the model. If a personal data breach occurs, we notify the supervisory authority no later than 72 hours after becoming aware, where the GDPR requires it; if that is not feasible, the notification explains the delay.
We publish how the model works, what it is for and where its limits are, and keep this page and the model page current, so a team can brief the people who use it.
Local-first by default. Where a service outside the machine is part of a task, we name it and its own handling applies.
Default
The model runs on your Mac, and the default path keeps the work there.
The company
This website, the release you download, the licence and the support you ask for. Fornace is the controller for these, and holds what the relationship needs.
Optional
A hosted model or a media service, named when it is part of a task. Each provider answers under its own terms, and the GDPR transfer rules apply where data leaves the EEA.
Where personal data reaches us, these rights apply under the GDPR, subject to the conditions in the Regulation. We answer within one month; where a request is complex, the Regulation allows an extension of up to two further months, and we tell you.
The release includes a data protection notice with the contact for requests. You can also complain to your national supervisory authority at any time; the European Data Protection Board lists them. This website sets no advertising cookies and runs no analytics profiling.
A system that runs where the work happens is a system a European organisation can hold to its own law. The roles are named, the duties have dates, and the data stays where the work is by default.
Checked 30 October 2026
European Parliament and Council, 27 April 2016. OJ L 119, 4.5.2016. Applies from 25 May 2018 under Article 99(2).
European Parliament and Council, 13 June 2024. OJ L, 2024/1689, 12.7.2024. Entered into force 1 August 2024; application dates in Article 113.
European Parliament and Council, 8 July 2026. OJ L, 2026/1744, 24.7.2026. Amends the AI Act: new prohibitions, the Article 50(2) transition and the high-risk dates.
CELEX 02024R1689-20260727. The consolidated text dated 27 July 2026.
European Commission, AI Act Service Desk. The Commission's milestone list, updated for the Digital Omnibus on AI.
The national supervisory authorities that enforce the GDPR, and where a complaint can be lodged under Article 77.
The system these duties are built into.