· NETBRAND CORP
Velô and the EU AI Act
How Velô is classified under Regulation (EU) 2024/1689 and how we apply its principles: transparency, human oversight, data governance, accuracy and cybersecurity.
What Velô does
Velô uses its own model, trained for a single task: marking where personal data appears in a text and of what type. On those marks, Velô applies the policy the customer configures: redact, tokenize, replace with synthetic values, shift dates or generalize. It processes text only: it does not analyze images or do OCR, and PDFs with images are quarantined. Velô makes no decisions about people, does not score or profile them, and does not generate free text.
How we classify it
- It is not a prohibited practice (Article 5).
- It is not a high-risk system. Document de-identification is not listed in Annex III, and Velô is not a safety component of the products in Annex I. If a customer integrates Velô into a system that is high-risk, the classification of that system belongs to whoever provides or deploys it, and we supply the technical documentation they need.
- It is not a general-purpose AI model, because it was trained for a specific task.
- Transparency (Article 50): Velô does not converse with people or create content that imitates real people. When it replaces data with synthetic values, we recommend marking the document as pseudonymized, and the audit log records every transformation.
The regulation applies to Velô when it is offered in the European Union or when its output is used there. This classification is our assessment and is not legal advice.
How we apply its principles
- Transparency and documentation: we publish performance, margin of error and limitations in Velô scope and limitations, including that the model was trained on data through 2026 and does not detect 100% of the data.
- Human oversight: we recommend sampled review, and the audit log records every detection and every re-hydration with its user and date.
- Data governance: the model is evaluated on documents never used to train it. Data, methodology and technical details are a trade secret; they are shared with authorities or customers only when appropriate and under confidentiality.
- Accuracy and robustness: we measure coverage, precision and per-document leakage, publish results by data type and set measurable goals for each version.
- Cybersecurity: Velô runs in the customer's network, validates its license offline and makes no external calls, with role-based access control and single sign-on (SAML, OIDC).
- AI literacy (Article 4): we provide documentation and an onboarding session for the teams that operate Velô during the POC.
The regulation's dates
The regulation entered into force on August 1, 2024. Prohibited practices apply from February 2, 2025 and obligations for general-purpose models from August 2, 2025. The remaining obligations apply in stages. We review this page when the deadlines or our assessment change.
Other frameworks
Velô is designed to support compliance with HIPAA, GDPR, LGPD, Colombia's Law 1581 of 2012 and Resolution 1995 of 1999. These are not certifications. See also the Privacy policy.
Last updated: November 5, 2026.