AI Act Compliance Statement

1. Legal framework applied

This site is published by an individual based in France. It deploys several artificial intelligence systems for demonstration and educational purposes, as part of an online CV. Therefore it complies with:

• The Regulation (EU) 2024/1689 (AI Act), particularly Articles 4 (AI literacy), 5 (prohibited practices), 50 (transparency), and recitals 132–137 on information duties.
• The Regulation (EU) 2016/679 (GDPR) for any personal data processing, applying Articles 5, 6, 12, 13, 25 and 32.
• The Directive (EU) 2019/882 (European Accessibility Act) and WCAG 2.1 level AA / RGAA guidelines.
• French Data Protection Act (n° 78-17 as amended) and CNIL recommendations on biometric processing.

2. Inventory of AI systems used

All systems below run locally in the visitor's browser (WebAssembly, WebGL, JavaScript). No data is transmitted to an external inference server.

3. Risk classification

The AI Act defines four risk tiers (unacceptable, high, limited, minimal). Here is how the site's systems are classified:

4. Transparency obligations (Article 50)

Article 50 imposes several information duties depending on the deployed system type. Here is how they are met:

4.1 Chatbot and narrative character — HAL

• HAL's non-human nature is clearly identified from the first interaction (explicit reference to HAL 9000, a fictional character).
• HAL makes no decision about the visitor, collects no personal data, and only persists anonymous functional preferences (visit counter, voice mode).
• A reading mode lets you fully hide HAL and mute its interventions.
• Dialogues are scripted, not LLM-generated — HAL cannot say unpredictable things about the visitor.

4.2 Synthetic voice — HAL Voice

• Voice is off by default and only enabled after an explicit user action (speaker button).
• Audio files are pre-generated offline with Piper TTS. No third-party voice synthesis service is called. No microphone capture.
• The synthetic nature of the voice is stated in the legal notices and on the site map.

4.3 AI-generated content

This site publishes no AI-generated text, image, audio or video beyond the HAL voices mentioned above. The AI projects in the CV (VISION Studio, RAG-PDF, MATCH, SIGN) are demonstrations where the user produces the input themselves; generated outputs remain in their own browser, for their own use.

No deepfake, no diffusion-generated image, no synthetic content is published on the site's pages.

5. Biometric processing and consent

Two demos use the webcam to extract light biometric data:

• SIGN: MediaPipe Hands extracts 21 hand keypoints. These points are transient, processed in memory (~30 ms), and immediately discarded. No video recording, no network transmission.
• VISION Studio (face / pose modes): facial landmarks or skeletal detection. Same, transient and local.

Consent

Webcam activation requires a double authorisation:

1. An explicit consent modal displayed by the site before any access request. The modal describes the purpose, the transient nature of processing, and the absence of network transmission.
2. The standard browser permission prompt (Permissions API).

Refusal at either step does not lock you out: other demos remain usable. Revocation is possible at any time via browser permissions.

The biometric data processed here falls under biometric processing per AI Act Article 3(35), but does not constitute unique biometric identification per Article 3(37). No identification template is computed, stored, or compared against a database of persons.

6. AI literacy (Article 4)

Article 4 obliges deployers of AI systems to ensure a sufficient level of understanding among users. On this site, this obligation is met through:

• A "Under the hood" or "What is this for" section on each demo, describing the technical pipeline in plain language.
• The models used are named (all-MiniLM-L6-v2, YOLO, MediaPipe Hands, etc.) with links to their documentation.
• A carbon footprint calculator on the sustainable design page to illustrate the energy cost of digital services.
• A PROMPT game that teaches prompt engineering basics to curious visitors.

7. Data processed, legal basis, network outbound

7.1 Personal data collected: none

The site collects no identifiable personal data. No user account, no signup, no tracking cookie, no third-party analytics service (Google Analytics, Matomo, etc.).

7.2 Local storage (GDPR-friendly)

Data is stored only in the visitor's browser (localStorage / sessionStorage), for purely functional use: theme preference, best time on mini-games, HAL's simulated mood, cached CV embeddings for the MATCH tool. Exhaustive inventory on the site map.

7.3 No data leaves the browser

Data produced by AI demos (recognition results, embeddings, matching responses, biometric keypoints) stays strictly in the visitor's browser. It is not logged server-side, not transmitted to any third party, not retained after tab close.

7.4 Legal basis (GDPR Article 6)

For the security module (see site map: suspicious event detection, banned IPs), the legal basis is legitimate interest for system security (Article 6.1.f GDPR). IPs are anonymised (last octet masked) and auto-purged after 30 days.

8. Prohibited practices check (Article 5)

None of the deployed systems perform:

• Subliminal manipulation or techniques impairing decision-making (Art. 5.1.a).
• Vulnerability exploitation (age, disability, socio-economic status) (Art. 5.1.b).
• Social scoring per Article 5.1.c.
• Crime commission risk assessment (Art. 5.1.d).
• Facial recognition database creation by scraping (Art. 5.1.e).
• Emotion inference in work or education contexts (Art. 5.1.f).
• Biometric categorisation inferring sensitive attributes (Art. 5.1.g).
• Real-time remote biometric identification in public spaces (Art. 5.1.h).

9. Your rights

As a visitor, you have the following rights:

• Right to information — you are currently reading the document that materialises this right.
• Right to object — you can disable all AI features via the reading mode (eye icon top-right), which hides HAL and mutes most AI effects.
• Right to erasure — you can wipe all local site data via your browser tools (Settings → Privacy → Site data).
• Right of access — the exhaustive list of locally-stored data is published in the site map footer.
• Right to complain — to the CNIL for GDPR questions, and to the authorities designated by French law for the AI Act (to be specified as implementing decrees are issued).

10. Contact and reporting

Publisher: Kevin Roualec, Lisieux (Normandy, France).
Contact: contact@kevinroualec.fr.
Host: IONOS SARL, 7 place de la Gare, 57200 Sarreguemines, France. Data hosted in the European Union.

This statement will be updated as AI Act codes of conduct, European Commission guidelines and CNIL positions are further specified. Version 1.0 published on 24 July 2026.