The EU AI Act, without the panic

The AI Act in a nutshell

The AI Act (Regulation (EU) 2024/1689) governs the use of artificial intelligence in the European Union. Its principle: obligations proportionate to the risk. A few practices are prohibited (social scoring, manipulation…), some are “high-risk” and heavily regulated (recruitment, credit, health…), and everything else, including generating product content, comes with light obligations, known as transparency obligations.

• February 2025: prohibited AI practices are banned.
• August 2025: obligations for providers of general-purpose AI models (Mistral, OpenAI…).
• August 2, 2026: the transparency obligations apply. This is the date that matters for product content and conversational assistants.
• December 2027: the “high-risk” obligations (postponed). They do not concern a PIM.

In practice, two transparency rules apply to a tool like cocoPIM: a conversational assistant must disclose that it is an AI, and AI-generated content must be detectable by machines (a marking in a machine-readable format, not necessarily visible to the end reader).

Who is responsible for what?

The AI Act distinguishes three roles, and yours is the lightest of the three:

• The model provider (Mistral, whose models power cocoPIM’s AI) bears the obligations on the model itself: documentation, copyright compliance, security. A French company, subject to European law, consistent with our commitment to sovereignty.
• cocoPIM is the provider of the AI system you use: it is up to us to flag AI when it steps in, to mark generated content and to put safeguards in place. That is done (see below).
• You are the “deployer”: your responsibility is limited to reasonable use, reviewing what the AI produces and knowing, within your team, who uses AI and for what.

What cocoPIM already covers

• Built-in traceability of AI content. Every value generated or translated by AI carries a provenance stored with the data: origin (generated, translated…), date, model used, any review. This provenance is set by the server (it cannot be faked from the interface) and it travels with your data: the API and the JSON export return it. This is exactly the “machine-readable marking” the regulation asks for.
• Human review, with the right tools: the review queue (module 11) lists everything the AI has produced that a human has not approved yet; every review is logged. You keep the final say, and you can prove it.
• CoCo discloses that it is an AI: the built-in assistant introduces itself as an artificial intelligence and reminds you that its answers may contain errors. And when a real person needs to take over, escalation to human support is one click away.
• Safeguards by design: the AI can only suggest existing options from your lists (no made-up values), never silently overwrites what you wrote, and quotas cap its use.
• Sovereignty. Mistral models, hosting in France: your product data does not leave the European legal framework.

What is left on your side

• Train your team: the regulation requires that the people who use AI understand the basics (Article 4, “AI literacy”). Modules 11 and 12 of this course can serve as material: what the AI can do, its limits, how to review it.
• Review before publishing: that is what the review queue is for. A description generated and then reviewed by a human is your content, fully owned.
• Keep the provenance downstream: if you pass your product content on to other systems, favor formats that carry the provenance (API, JSON export) when AI traceability matters to the recipient.