Terms and Conditions of Use

1. Definitions

For the purposes of this contract, the following terms have the meanings set out below:

• "Platform"— the EU AI Comply web application, accessible at euaicomply.eu, including all related features, APIs and documentation.
• "Provider"— EU AI Comply, a registered entity in Romania, operator of the Platform.
• "Client"— the legal entity or authorized natural person entering into a subscription and using the Platform for professional or commercial purposes.
• "User"— any natural person authorized by the Client to access the Platform under the Client's account.
• "Client Data"— all data, documents and information uploaded, generated or stored by the Client or Users in the Platform.
• "Service"— the set of features made available through the Platform according to the chosen subscription plan.
• "Subscription"— the right to use the Service for the agreed period and conditions, against payment.
• "EU AI Act"— Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence.

2. Acceptance of terms

By creating an account, activating a subscription or using the Platform, the Client confirms that: (a) they have read and understood this contract; (b) they have legal capacity and, if acting on behalf of a legal entity, have the authority to legally bind that entity; (c) they unconditionally accept these terms.

If you do not agree with any of these terms, you are not entitled to use the Platform. Continued use after publication of updated terms constitutes acceptance of the new version.

3. Service description and limitations

EU AI Comply provides a multi-tenant SaaS platform for managing compliance with Regulation (EU) 2024/1689 (EU AI Act). The Service includes, depending on the chosen plan:

• AI system inventory and classification by risk level
• Management of the 28 EU AI Act obligations applicable to deployers and providers
• Document Vault for storing technical and compliance documentation
• FRIA report generator (Art. 27) and audit packs in PDF format
• Serious incident management (Art. 73) and authority notification workflow
• Provider role-switch detector (Art. 25)
• AI literacy training records (Art. 4)
• Operations logs (Art. 26) and immutable audit trail

Essential limitations:

• The Platform does not provide and does not replace legal or specialist advice.
• The Provider does not guarantee that use of the Platform ensures full compliance with the EU AI Act or other applicable regulations.
• Legislative updates (including post-Omnibus amendments) are integrated in good faith but may lag behind official publication.
• Assessments and classifications generated by the Platform are indicative and must be validated internally.

4. Registration, account and security

The Client is responsible for: (a) providing accurate and complete information at registration; (b) maintaining the confidentiality of access credentials; (c) all actions taken under their account, whether authorized or not; (d) immediately notifying the Provider of any unauthorized access at [email protected].

Each account is strictly personal and non-transferable. Sharing credentials between different users is prohibited. The Client may add additional users up to the limit of the chosen plan, through the invitation mechanisms in the Platform.

The Provider implements appropriate technical and organizational security measures, including two-factor authentication (TOTP), encryption in transit (TLS 1.3) and strict per-company data isolation enforced at application level. However, the Client understands that no security solution provides an absolute guarantee.

5. Subscriptions, pricing and billing

Available plans: Starter, Growth and Enterprise. Details of each plan (prices, limits, features) are published at euaicomply.eu/pricing and may be modified with 30 days' prior notice.

Trial period: All plans (Starter, Growth and Enterprise) include a 14-day trial period, without a credit card. Upon expiry of the trial period, access is suspended if a paid subscription is not activated.

Payment processor — Paddle (Merchant of Record): Payment transactions are processed by Paddle.com Inc. (or Paddle Payments Ltd., as applicable), acting as Merchant of Record (MoR) for all purchases made on the Platform. In this capacity, Paddle issues tax invoices to the Client, collects and remits VAT in accordance with EU rules (OSS — One Stop Shop), and manages refunds and chargebacks. The subscription sale contract is concluded between the Client and Paddle, not between the Client and EU AI Comply. Paddle's buyer terms of use are available at paddle.com/legal/buyers.

Billing: Subscriptions are billed monthly or annually (with a 20% discount for annual billing), in advance. Displayed prices are expressed in EUR and exclude VAT. Applicable VAT is calculated and collected by Paddle according to the Client's location.

Late payments: Upon non-payment of an invoice at its due date, the Provider may suspend access to the Platform after 7 calendar days' notice sent by email. Access is restored within 24 hours of payment confirmation.

Cancellation and refunds: The Client may cancel the subscription at any time from the Platform. Access continues until the end of the paid period. Pro-rata refunds for unused periods are not issued, except where cancellation is caused by a material change to the Service or an error attributable to the Provider.

6. Usage rights and licence

The Provider grants the Client a limited, non-exclusive, non-transferable and revocable licence to use the Platform solely for the Client's organisation's internal compliance purposes, for the duration of the active subscription and in accordance with this contract.

The following are prohibited:

• Copying, redistributing or sub-licensing the Platform or its components
• Using the Platform to provide compliance services to third parties for payment, without the Provider's written consent
• Reverse engineering, decompiling or disassembling the Platform's source code
• Using the Platform for illegal, fraudulent or third-party-harming activities
• Attempting to access other clients' data or exceed authorized access limits
• Automated use (scraping, crawling) without the Provider's prior written consent

7. Intellectual property

The Platform, source code, design, classification algorithms, document templates, methodologies and all related materials are the exclusive property of the Provider or its licensors and are protected by Romanian Law no. 8/1996 on copyright and related rights, as well as applicable EU regulations.

Client Data remains the exclusive property of the Client. The Provider acquires no intellectual property rights over Client Data. The Client grants the Provider a limited licence to process Client Data solely for the purpose of delivering the Service.

Feedback submitted by the Client to the Provider may be used without restriction for Service improvement, without any obligation to compensate the Client.

8. Client Data and confidentiality

The Provider stores Client Data on servers located exclusively in the European Union. Access to Client Data is technically restricted through strict per-company data isolation, enforced at application level.

The Provider does not access Client Data except where necessary for: (a) delivering the Service; (b) technical support requested by the Client; (c) legal obligations. Provider personnel who access data are subject to confidentiality obligations.

The processing of personal data is governed by the Privacy Policy available at euaicomply.eu/privacy, which forms an integral part of this contract. In the GDPR context, the Provider acts as a data processor for personal data processed in the Platform on behalf of the Client. A Data Processing Agreement (DPA) is available upon request or included in the Enterprise plan.

9. Availability and service levels

The Provider makes reasonable efforts to keep the Platform available. Target availability is 99.5% monthly for Starter and Growth plans. For the Enterprise plan, a 99.9% uptime SLA is available upon request, through a separate contractual addendum.

Excluded from availability calculations: (a) scheduled maintenance, announced at least 48 hours in advance; (b) force majeure events; (c) malfunctions caused by the Client or third parties. The Provider notifies active Clients about scheduled maintenance periods by email and through the Platform banner.

10. Warranties and legal disclaimer

The Provider warrants that: (a) it holds the rights necessary to provide the Service; (b) it will implement reasonable security measures; (c) it will integrate officially published legislative changes in the shortest reasonably possible time.

Express liability exclusion statements:

• The Platform does not guarantee achieving or maintaining compliance with the EU AI Act or any other regulation.
• Risk classifications and assessments generated by the Platform are indicative; ultimate responsibility for correct AI system classification rests with the Client.
• The Platform does not replace the Client's obligation to consult a lawyer, data protection consultant or other qualified specialist for specific situations.
• The Provider is not liable for the consequences of business decisions taken on the basis of information in the Platform.
• The Legal Library content in the Platform is provided as an informational reference and does not constitute official legal interpretation.

11. Limitation of liability

To the maximum extent permitted by applicable law, the Provider's total liability to the Client for any claim arising out of or in connection with this contract (regardless of legal basis: contract, tort, warranty or otherwise) is limited to the amount paid by the Client to the Provider in the 12 months preceding the event giving rise to such claim.

The Provider shall not in any event be liable for: (a) indirect, incidental, special or consequential losses; (b) loss of profit, loss of data or loss of business opportunity; (c) fines or penalties imposed on the Client by regulatory authorities; (d) claims made by third parties against the Client.

The above limitations do not apply in the case of harm caused intentionally or through gross negligence, fraud, or where limitation is prohibited by law.

12. Suspension and termination

Termination by the Client: The Client may terminate this contract at any time by cancelling the subscription in the Platform. Termination takes effect at the expiry of the current paid period.

Suspension for non-payment: In the event of failed subscription renewal (payment rejected by Paddle), access to the Platform is automatically suspended upon expiry of the current paid period. The Client is notified by email by both Paddle and the Platform. Access is automatically restored upon payment confirmation. Client Data is kept intact during suspension, for a maximum period of 60 calendar days from the suspension date.

Termination for non-payment: If access remains suspended for non-payment for 60 consecutive calendar days, the Provider may unilaterally terminate the contract by written notice given 7 calendar days before the termination date. From the termination date, the Client has a 30-day window to export Client Data, after which it is irreversibly deleted.

Termination by the Provider on other grounds: The Provider may terminate this contract with immediate effect and without compensation, by written notice, if the Client: (a) materially breaches this contract and fails to remedy the breach within 15 days of notification; (b) uses the Platform for illegal or fraudulent purposes; (c) provides false information at registration; (d) becomes subject to insolvency or liquidation.

Effects of termination: Upon termination, the Client has the right to export Client Data in CSV/PDF format for 30 days from the effective date of termination, after which the Provider will irreversibly delete all Client Data, except for data the Provider is legally obligated to retain.

13. Modifications to terms and service

The Provider may amend this contract with a minimum of 30 calendar days' notice by email to the Client's contact address and through a Platform banner. Amendments take effect on the date indicated in the notice. If the Client does not agree with the amendments, it may terminate the contract before the effective date, without penalties, with pro-rata refund of amounts paid in advance.

The Provider may add new features or modify the Platform interface without prior notice, provided that existing essential features are not affected. Withdrawal of essential features is communicated with at least 30 days' advance notice.

14. Force majeure

Neither party shall be liable for delay or failure to perform its obligations caused by force majeure events, understood as circumstances independent of the parties' will, unforeseeable and insurmountable: natural disasters, acts of terrorism, armed conflicts, pandemics declared by authorities, major internet infrastructure disruptions, acts of public authorities. The affected party shall notify the other party within 5 business days of the event occurring.

15. Governing law and dispute resolution

This contract is governed by Romanian law. Any dispute arising out of or in connection with this contract shall first be resolved amicably, within 30 days of written notification to the other party. In the absence of an amicable agreement, disputes shall be resolved by the competent courts of Bucharest, Romania.

For clients who are consumers (natural persons acting outside their professional activity), the rights provided by Romanian Government Emergency Ordinance no. 34/2014 on consumer rights in distance contracts also apply. The online dispute resolution platform for consumers is: https://ec.europa.eu/consumers/odr

16. Final provisions

• Entire agreement— This contract, together with the Privacy Policy, Cookie Policy and any Data Processing Agreement, constitutes the entire agreement between the parties regarding its subject matter.
• Severability— If any clause of this contract is declared invalid or unenforceable, it shall be interpreted in the narrowest possible way to make it enforceable or, if not possible, shall be severed without affecting the remainder of the contract.
• Waiver— Failure or delay by either party in exercising a right does not constitute a waiver of that right.
• Assignment— The Client may not assign its rights or obligations under this contract without the Provider's prior written consent. The Provider may assign the contract in the event of a corporate restructuring, merger or acquisition, with notice to the Client.
• Notices— Any formal notice shall be sent by email to the parties' contact addresses. Notices are deemed received 24 hours after transmission, unless the sender receives an error notification.
• Language— This contract is available in Romanian and English. In case of interpretive divergence, the English version prevails for Clients outside Romania.