KBD does not need to become an AI-model company. The practical issue is knowing when KBD is using AI as a creative tool, deploying an AI system, integrating a client’s regulated product, or delivering content that must be disclosed.
Ordinary branding, static marketing sites, presentation design, and conventional web development are usually low-risk. KBD’s meaningful AI Act exposure is concentrated in AI-powered web experiences, synthetic media, AI-generated public-interest content, and projects involving high-impact decisions.
AI becomes part of project governance. KBD should track what tool was used, what data entered it, who reviewed the result, whether disclosure is required, and which party is legally responsible for the deployed system.
This is a practical triage model—not a substitute for project-specific legal classification.
Static sites, CMS work, branding, decks, ordinary forms
Privacy, copyright, accessibility, security, and ordinary client obligations still apply.
Brainstorming, image concepts, copy drafts, design assistance
Approved tools, confidential-data controls, licensing, human review, and asset provenance.
AI voice, avatars, realistic image/video manipulation, deepfakes
Disclosure, machine-readable marks where required, likeness permissions, and proof of client approval.
Sales assistants, event concierges, AI search, voice interfaces
Tell people they are interacting with AI; provide clear escalation and preserve the client’s role and responsibilities.
Hiring, credit, education, essential services, biometrics
Escalate early. KBD may be an integrator or downstream provider and the UI must support the client’s safeguards.
The most immediate web-development change is transparency at the interface.
Covered interactive AI systems generally need to tell people that they are interacting with AI at or before the first meaningful interaction. A hidden privacy-policy disclosure is not a good implementation pattern.
If KBD launches an AI feature under KBD’s own name or brand, KBD may have provider responsibilities. If KBD builds an AI experience for a client under the client’s brand, the client may be the deployer while KBD is an integrator or downstream provider.
The contract label alone does not decide this. Actual control, branding, intended purpose, and deployment responsibilities matter.
The European Commission says AI agents are not a separate legal category. Existing rules for AI systems and general-purpose AI models can apply to them, including transparency from August 2026 and high-risk obligations on the later timetable.
KBD’s design and storytelling work creates a practical need for a lightweight chain of custody for AI-assisted assets.
Standard assistive editing may fall within an exception, but KBD should not assume that every generative edit is “just editing.”
Article 50 addresses AI-generated text published to inform the public about matters of public interest when it has not undergone human review or editorial control. For relevant client work, KBD should assign a real human editor who takes responsibility for accuracy, framing, and publication—not merely someone who glances at the output.
KBD does not need to classify every technology client as high-risk, but it does need a reliable escalation trigger.
Candidate ranking, résumé filtering, targeted job advertising, worker monitoring, performance evaluation, promotion, or termination.
Creditworthiness, essential services, insurance risk or pricing, benefits, or other consequential eligibility decisions.
Education, law enforcement, migration, courts, democratic processes, critical infrastructure, and certain biometric systems.
A marketing site for an AI company is not automatically high-risk. But if KBD builds the interface through which a high-risk system makes or communicates decisions, KBD may need to support intended-purpose documentation, human oversight, user information, logging, escalation paths, and change control. KBD should not silently treat a regulated decision product as ordinary website work.
KBD does not need a large compliance department to start. It needs consistent project hygiene.
List internal AI tools, client-facing AI features, synthetic-media projects, agents, personalization, and automated decision work.
Classify the application, not just the model. The same model can be ordinary for copy drafting and high-risk for applicant ranking.
Do not place unreleased strategy, credentials, personal data, or proprietary source files into unapproved consumer AI tools.
Every external deliverable needs a person responsible for accuracy, rights, disclosure, brand fit, and client approval.
Document roles, approved tools, source-data permissions, disclosures, provenance, likeness rights, change control, and incident cooperation.
Keep enough of the prompt/tool/source/review trail to explain what KBD delivered without creating unnecessary retention risk.
A practical first pass for KBD over the next 90 days.
This is a practical business briefing, not legal advice. Whether KBD is a provider, deployer, downstream provider, or merely a service contractor depends on the facts of a particular project. Employment, credit, education, healthcare, biometric, public-interest, and client-regulated-product work should receive project-specific legal review.