Third-Party AI Liability

Your API provider's Terms of Service are clear: You are responsible for the output. Period.

#The "Deployer" Trap

Under the EU AI Act, OpenAI is the "Provider," but you are the "Deployer." The Deployer bears the burden of ensuring the AI implementation is safe, unbiased, and compliant with local laws (like the LOPD in Spain).

#What You Must Do

If you wrap GPT-4 or Claude:

• 1
  Input Filtering: You must scrub PII (Personally Identifiable Information) *before* sending it to the API.
• 2
  Output Guardrails: You cannot trust the model to self-censor. You need a second layer to catch hallucinations or harmful content.
• 3
  ToS Review: Read the fine print. Does your provider claim ownership of user data? If so, you might be violating GDPR just by using them.