Policy on the use of artificial intelligence
White Rabbit Brussels
Last updated: 3 August 2026 · Version 1.0
This page explains how White Rabbit Brussels uses artificial intelligence in its own work and in the services it provides to clients. It is public because we advise clients on AI Act compliance. It would be difficult to ask them to do this if we had not done it first.
Legal reference: Regulation (EU) 2024/1689 (the “AI Act”), as amended by Regulation (EU) 2026/1744 (the “Digital Omnibus”), in force since 27 July 2026.
1. Our role
White Rabbit Brussels is a deployer of artificial intelligence systems. We do not develop or place AI models or systems on the market and are therefore not a provider within the meaning of Article 3(3).
When we deliver an automation or assistant built on third-party models, we assess case by case whether that delivery makes us a provider under Article 25. We state the outcome in the contract.
None of the systems we use falls within the prohibited practices in Article 5 or the high-risk uses in Annex III.
2. The tools we use
| Tool | Provider | What we use it for | Personal data |
|---|---|---|---|
| Claude | Anthropic | Writing, analysis, editing and code | Only when anonymised |
| n8n (self-hosted) | Our own instance | Workflow orchestration | Yes, on our infrastructure |
| HeyGen | HeyGen | A synthetic video avatar of Alberto Maccari | The owner’s image |
| ElevenLabs | ElevenLabs | The owner’s synthetic voice | The owner’s voice |
| Higgsfield | Higgsfield | B-roll images and animations | No |
| whisper.cpp | Local | Audio transcription for subtitles | Processed locally |
| Notion · Google Workspace · Systeme.io | Their respective providers | Archive, documents and mailing lists | Yes, under their respective privacy notices |
We update this list whenever we introduce a new tool. We do not use AI tools outside this list for work intended for clients.
3. Transparency — what we disclose and how
Article 50 has applied since 2 August 2026. Our operating rule is simpler than the legal text and deliberately stricter:
If content from White Rabbit contains a voice, face, image, video or text generated or modified by AI, we disclose it visibly before or during use.
We do not consider metadata sufficient. Nor is a statement buried on a page such as this one enough. The disclosure must be perceptible to the person viewing the content.
| Content | How we disclose it |
|---|---|
| Video with a synthetic avatar and voice | A persistent AI AVATAR badge throughout the video, plus a line in the post description |
| Generated images and animations | A statement in the caption |
| Generated and subsequently edited text | “Draft generated with AI, reviewed and approved by [name]” |
| Reports and documents delivered to clients | A footer note referring to Article 50 |
| Chatbots and assistants delivered to clients | They identify themselves as AI in the first message, before any interaction |
We also use the platforms’ native “AI-generated content” labels. These do not replace the obligation. They are an additional measure, not compliance on their own.
About the avatar. Videos made with the avatar reproduce Alberto Maccari’s appearance and voice. His consent does not remove the disclosure obligation. The rule protects the viewer, not the person depicted.
About text on matters of public interest. Article 50(4) exempts AI-generated text where it has undergone human review and someone assumes editorial responsibility. In our workflow, that review is a real step, not a button. Every draft is read and edited before publication. Alberto Maccari assumes editorial responsibility.
4. Data and confidentiality
- We do not upload identifiable client documents to third-party AI services. We anonymise anything required for the task first.
- We do not use client data to train models, and we do not authorise providers to do so.
- Automations that process personal data run on our own n8n instance, not on shared services.
- Client credentials remain in the client’s own systems. We do not duplicate them in ours.
This section answers to the GDPR before it answers to the AI Act. In practice, it is the same conversation because it concerns the same operational risk.
5. AI literacy — Article 4
Article 4 requires deployers to take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. This includes external collaborators and freelancers.
The obligation has applied since 2 February 2025. Since 2 August 2026, national market surveillance authorities have had the powers to verify it. In Belgium, the lead authority is BIPT/IBPT.
Our measures
- Before working with AI tools, everyone acting on behalf of White Rabbit receives a session covering this policy: what may be uploaded, what must be disclosed and who approves the work.
- We record the measures taken in a named register in section 6. This provides written evidence of what we did.
- We review the register every six months and whenever someone joins.
- Anyone who works with us on an ongoing basis receives an update when the rules change.
What we do not do, and why. We do not present certificates. No body issues an “AI Act seal”, and the regulation creates no such certification. Article 4 prescribes no format and requires no attendance certificate. It requires proportionate, documented measures.
6. AI literacy register
This is an internal document. We reproduce it here because it is an example of what we deliver to clients.
| Person | Role | Measure taken | Content | Date |
|---|---|---|---|---|
| Alberto Maccari | Owner · editorial lead · deployer | Direct study of Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744; preparation of the internal disclosure standard; documented legal review using primary sources | Articles 4, 5, 50 and 99 · AI Act/GDPR boundary · deployer obligations · disclosure by format | 3 Aug 2026 |
| No external collaborators active at this date. | ||||
Honesty note before publication: add one row for every active external collaborator. If there are none, retain only the owner’s row and state “No active external collaborators on this date.” That is a valid and verifiable answer. Invented names are not.
Next review: February 2027.
7. What we ask suppliers
Before introducing a new tool, we check that the supplier states its role under the AI Act, documents the marking of generated content where required by Article 50(2), and offers data-processing terms consistent with the commitments we make to clients.
If a supplier does not answer those questions, we do not use its tool for work intended for clients.
8. Reporting a concern
If you believe White Rabbit has published AI-generated content without disclosing it, or that this policy has not been followed, write to whiterabbitbrussels@gmail.com. We reply within five working days. If the report is substantiated, we correct the content and record the correction below.
Corrections: none to date.
White Rabbit Brussels — Alberto Maccari
This policy was prepared with the assistance of artificial intelligence systems and reviewed by the owner, who assumes responsibility for it. Disclosure under Regulation (EU) 2024/1689, Article 50.
