Skip to content
Matteo Misiani Studio
Drop me a line
← Back to the home page
How I work, by law

How I work, by law.

Six commitments I make with every client. For each: what it means in practice, what you receive and the official text on EUR-Lex.

The AI Act was amended by Regulation (EU) 2026/1744, in force since 27 July 2026: the links point to the consolidated text.

AI Act · Transparency

They say they're an AI

Reg. (EU) 2024/1689, art. 50

In practice

Every agent introduces itself as a virtual assistant in its first message or the first sentence of a call. It never pretends to be a person and, if the customer asks to talk to someone, it hands the conversation to you.

What you receive

  • Agents that introduce themselves as virtual assistants on every channel
  • The introduction text, for you to approve before launch

Official text

AI Act, art. 50

AI Act · Human oversight

Decisions stay with you

In line with the AI Act, art. 14

In practice

You write the rules: what the agent may decide on its own and what goes to you. Complaints, refunds and exceptions always reach a person, with a summary of the conversation. You can pause any agent at any time.

What you receive

  • Configurable rules: what the agent decides, what goes to you
  • Complaints and exceptions forwarded to a person, with a summary
  • A switch to pause any agent

Official text

AI Act, art. 14

GDPR · Art. 28

A contract for your data

Reg. (EU) 2016/679, art. 28

In practice

Before we start we sign the data processing agreement: I process data only on your documented instructions, with appropriate security measures (art. 32), with declared sub-processors, and at the end of the contract I delete it or give it back to you.

What you receive

  • The data processing agreement (art. 28), signed before we start
  • The list of sub-processors and where they process data
  • Deletion or return of the data at the end of the contract

Official text

GDPR, art. 28 GDPR, art. 32

GDPR

Data processed under GDPR

GDPR, Chapter V (arts. 44–49) and art. 5

In practice

I choose the providers and list them in the contract, with where they process the data. I don't use your data to train models.

What you receive

  • Written list of the providers and of where the data is stored
  • Your data never trains the models

Official text

GDPR, art. 44 GDPR, art. 5

Full log

Every action stays on record

In line with the AI Act, art. 12, and the GDPR, art. 30

In practice

Every action of the agent is logged: when, at whose request, what it did, which document it used. You can consult the log whenever you want and export it. It also helps you keep the record of processing activities required by the GDPR (art. 30).

What you receive

  • Access to the action log, searchable and exportable
  • Retention periods agreed with you

Official text

AI Act, art. 12 GDPR, art. 30

Your code

The system is yours

Contractual commitment

In practice

The code lives in a repository in your name, the service accounts (telephony, WhatsApp, servers) are in your name, and the documentation explains how to run everything without me. No lock-in, no exit costs.

What you receive

  • A code repository in your name
  • Service accounts in your name
  • Documentation to run it without me

Self-declared commitments, written into every contract.

Prepare my demo