Skip to main content

Η σελίδα υπάρχει και στα ελληνικά. Διαβάστε τη στα ελληνικά

Book an X-RayX-Ray Book a Workflow X-Ray: a fixed-price diagnosis

AI Trust Standard

The first five seconds.

The Netex AI Trust Standard: the AI Act, GDPR and a person always within reach.

It says it's AI in its first sentence, inside the first five seconds. Before twelve seconds are up, it has told you the call is recorded and how to reach a person. That's how every assistant we deliver opens.

Sound is off. Captions play as normal.

  1. 0.0 sAI disclosurelaw

    ‘Hello, you're speaking with an AI system.’

    AI Act, Article 50(1): anyone interacting with an AI system is told so, at the latest at first contact, unless it's obvious.

  2. 3.2 sRecording noticelaw

    ‘This call is recorded to help us serve you.’

    GDPR, Articles 12–13: you're told the purpose, the retention period and your rights. The short line is spoken on the call; the full details are also sent in writing with the confirmation message.

  3. 6.5 sPath to a personNetex rule

    ‘For a person, say ‘person’ or press 0.’

    A Netex rule, not a legal requirement. Every assistant we build has it, because you trust a system when you know you can get out of it.

  4. 10.7 s‘How can I help?’

The timings are measured on the recording you hear, made with a synthetic voice. The timings are measured on the recording you hear, made with a synthetic voice.

This page describes how we work. It isn't legal advice: for your own case, speak to your lawyer or your data protection officer (DPO).

For the people who talk to the assistant

Built into every deployment.

AI Trust Standard1.0 · 2026

  1. AI disclosure at first contact, and an ‘AI’ label that stays visible for the whole conversation.law · AI Act Art. 50(1)
  2. A recording and transcription notice, with purpose, retention period and a link to the privacy notice.law · GDPR Arts 12–13
  3. A one-step path to a person: say ‘person’, press 0 or tap the button.Netex rule
  4. Critical details (dates, names, phone numbers, VAT numbers) are read back before anything is confirmed.Netex rule
  5. A label on images, video and audio created or altered with AI, whenever they look real.law · AI Act Art. 50(4)
  6. In clinics: no symptom triage, no medical advice, the minimum possible data.law · GDPR Art. 9 · Netex rule

The same applies on this site: the assistants you can try here say they're AI in their first sentence, and every AI-made image carries a label.

For you, the client

What we sign together.

  1. Role mapping: you are the controller and the deployer of the system; we are the processor. A data processing agreement (DPA), a sub-processor list and where the data lives.
  2. If a system ships under our own name, we say so: we are then also its provider under the AI Act, with the duties that come with it.
  3. Which models and vendors are used, which versions, and how we tell you before any change.
  4. Accuracy measured in the pilot, on your own data, together with the system's known limits.
  5. Human checkpoints: what the system does on its own and what needs approval.
  6. Logs, retention periods, an incident process, readiness to notify a breach within 72 hours, exit and data-portability terms.
  7. Training for your team, so they work with the system safely and know its limits (AI literacy, Article 4 of the AI Act).
  8. Your data doesn't train models, ours or anyone else's.

Want the same framework for systems we didn't build? The Comply & Secure add-on covers Article 50 disclosures and labels, baseline security controls and a supplier security statement. Ask us about Comply & Secure

A locked grey steel filing cabinet with the key in its lock, in soft window light.This image was created with an AI tool (AI Act, Article 50).

Red lines

What we don't build.

The first three are high-risk areas under Annex III of the AI Act, with obligations from 2 December 2027. Emotion recognition at work and in education is already prohibited. We don't touch any of them.

  • CV screening or employee scoring.
  • Credit decisions.
  • Automated grading of students.
  • Emotion recognition.
  • Medical diagnosis or symptom triage by front-desk assistants.
  • Assistants that hide that they're AI, or that won't let a person leave.

The Greek framework

Who supervises, and what applies.

Timeline

The dates that matter.

  1. in force

    The prohibited practices (Article 5) and the AI-literacy duty (Article 4) apply.

  2. in force

    Law 5321/2026, implementing the AI Act in Greece, is published.

  3. in force

    Regulation (EU) 2026/1744 (the ‘Digital Omnibus’) postpones the high-risk obligations. Article 50 transparency is not postponed.

  4. in force

    Article 50 transparency duties apply.

  5. coming

    The grace period for machine-marking synthetic content ends, for systems on the market before 2 August 2026 (a provider duty).

  6. coming

    Obligations for Annex III high-risk systems: employment, education, credit, essential services.

  7. coming

    Obligations for AI embedded in products (Annex I).

Last reviewed: 13 October 2026

Before handover

100 calls before the first real one.

Greek numbers, names and addresses are the hard part for any voice system. So every voice assistant goes through 100 test calls, on your own scenario, before it speaks to one of your customers.

We measure: accuracy on booking details, response time per turn, hand-off rate to a person, and caller satisfaction.

We hand over only when accuracy on details is at least as good as the person doing the job today.

For documents and vision: a review queue for anything below the confidence threshold, and an error count every month.

1 2 3 4 5 6

What the test set covers

Questions

What a careful buyer asks.

Do I have to tell customers they're talking to an AI?

Yes. Since 2 August 2026, Article 50 of the AI Act requires that anyone talking to a chatbot or voice assistant is told they're interacting with an AI, at the latest at first contact, unless it's obvious. We always do it in the first sentence, and keep an ‘AI’ label visible throughout the conversation.

Which authority supervises AI transparency in Greece?

The Hellenic Data Protection Authority. Law 5321/2026 names it the market-surveillance authority for Article 50 transparency, for prohibited practices and for high-risk systems. It's the same authority that oversees GDPR, so we recommend treating the AI notice and the privacy notice as a single package.

How large are the fines?

For Article 50 breaches, up to €15m or 3% of worldwide annual turnover. For small and medium-sized businesses, the lower of the two amounts applies. The fine is the smaller risk, though: an assistant that hides that it's an AI loses the customer's trust on the very first call.

Are models trained on our data?

No. We only work with providers who commit contractually not to train models on our clients' data. Processing happens in the EU, and the sub-processor list is part of the data processing agreement. If you'd rather your data never left the building, there's also an option with an open model on your own server.

Can our clinic's assistant discuss health matters?

Not symptoms or treatments. The assistant books, moves and reminds people of appointments, and answers practical questions. Health data is a special category under GDPR Article 9, so we collect the minimum, carry out an impact assessment, and pass every medical question to a person.

Is our assistant a high-risk system?

A reception, booking or customer-service assistant usually isn't: it carries transparency duties, not high-risk ones. High-risk systems include, among others, those used for hiring, grading, credit and essential services, with obligations from 2 December 2027. We don't build those. Borderline cases are assessed in the X-Ray.

Ask us whatever your DPO would ask.

In the 45-minute Scan call we talk about data too, not just hours.