AI Act Information Sheet

This Schedule is provided by Cube5 as provider of the AI system Cortex, to enable the Client, as deployer, to use the Service in an informed manner and to comply with its own obligations. It is drafted on the model of the instructions for use required by article 13 of the AI Act, which Cube5 applies voluntarily to Cortex notwithstanding that Cortex is not a high-risk AI system.

1. Identification

2. Intended purpose

Cortex is designed and placed on the market to allow professional organisations to make their own document corpus searchable and interrogable, and to produce reports from it, in document-heavy business processes such as compliance, legal, operations, human resources, finance and procurement. Specifically, Cortex is intended to:

• parse documents and extract structured data from them, including tables, charts and scanned content;
• index documents on upload and make them searchable through semantic search;
• answer questions asked by an Authorised User about that corpus, with answers grounded in and cited to the source documents;
• generate draft business reports from that corpus, with inline citations, in an editable interface intended for human review before use.

Cortex is intended to assist a human professional. It is not intended to take, nor to automate, any decision.

3. Capabilities and level of performance

4. Known limitations and reasonably foreseeable misuse

• Erroneous or incomplete answers. Despite grounding and citation, the system may produce answers that are inaccurate, incomplete or that misinterpret a source passage. Citations must be verified against the source document.
• Omission. The system may fail to retrieve a relevant document or passage. The absence of an answer is not evidence of the absence of information in the corpus.
• Degraded input. Poorly scanned documents, complex or nested tables, handwriting, and documents in low-resource languages degrade extraction quality.
• Outdated corpus. The system answers on the basis of the documents present in the corpus at the time of the request. It is the Client's responsibility to keep the corpus current.
• Automation bias. The reasonably foreseeable misuse of the system is over-reliance on its output without human verification. The Client shall guard against it through the oversight measures in section 6.
• Custom LLM. Where the Client elects to use a Custom LLM in the Private SaaS Deployment Model, the capabilities, limitations, biases and safety behaviour of that model are determined by the Client and are outside Cube5's control. The statements in sections 3 and 4 of this Schedule are made in respect of the Supported LLMs.
• Confidentiality within the tenant. The system returns answers drawn from the documents the requesting user is entitled to access, as configured by the Client. Incorrect configuration of access rights by the Client may expose information to the wrong user.

5. Excluded uses

The following uses are excluded and are prohibited by Article 14 of the Agreement:

• any practice prohibited by article 5 of the AI Act, including social scoring, exploitation of vulnerabilities, untargeted scraping of facial images, emotion inference in the workplace or in education, biometric categorisation to infer protected characteristics, and the generation of non-consensual intimate material or child sexual abuse material;
• any use case within Annex III of the AI Act without a prior written amendment, and in particular: screening or filtering job applications and evaluating candidates or workers; evaluating creditworthiness or establishing credit scores; determining access to essential public benefits; evaluating learning outcomes or determining access to education; use by or on behalf of law enforcement, migration or border-control authorities; and assistance to a judicial authority in interpreting facts or law;
• use as a safety component of a product covered by Annex I of the AI Act;
• use as the sole basis for any decision producing legal effects, or similarly significant effects, in respect of a natural person, within the meaning of article 22 GDPR;
• use for the provision of regulated professional advice to a third party without the review of a qualified professional.

6. Human oversight measures

The Client shall implement the following measures, which Cortex is designed to support:

7. Transparency (article 50)

Article 50 of the AI Act imposes distinct obligations, some on Cube5 as provider and some on the Client as deployer. They are not interchangeable, and a measure that satisfies one does not satisfy another. This section is the detail behind Article 14 of the Agreement. The table below states which measure addresses which obligation, and who carries it.

7.1 Interaction disclosure – article 50(1)

• The conversational interface informs natural persons that they are interacting with an artificial-intelligence system.
• The disclosure is presented at the point of interaction and is not dependent on the Client's configuration.

7.2 Machine-readable marking – article 50(2)

Exclusions – second subparagraph of article 50(2). The marking obligation does not apply where the AI system performs an assistive function for standard editing, or does not substantially alter the input data provided by the deployer or the semantics thereof.

7.3 Deployer disclosure and editorial responsibility – article 50(4)

• Where the Client publishes AI Output as text informing the public on matters of public interest, it shall disclose that the content has been artificially generated or manipulated.
• That obligation does not apply where the content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for it.

8. Logging and traceability

• Cortex records audit trails of user and administrative actions within the Client tenant.
• AI requests are traced for diagnosis and quality-monitoring purposes; document content is excluded from those traces by default (Schedule 4, Appendix 2).
• Logs are available to the Client for the retention period set out in the Documentation, and are exportable during the Reversibility Period.

9. Regulatory position