Intended purpose, excluded uses, and behavioral constraints

Read this page before you put an agent into production. It states what Duale AI builds the Platform for, which uses are excluded, and how the Platform behaves at its edges.

This page is the instructions for use within the meaning of Article 3(15) of Regulation (EU) 2024/1689. It states the intended purpose defined in Article 3(12). The terms of use and terms of sale refer to it.

What the Platform is for

Duale AI provides one thing: orchestration of software agents.

You declare a pool of language-model routes and supply your own provider keys. You write your agents’ instructions, register the tools that reach your systems, and decide what data they receive. The Platform also supplies built-in tools; a task request cannot narrow that set. For each task, the Platform ranks routes from your pool. One task can make more than one model-provider call before it returns a terminal result.

The Platform produces text. It generates no images, no audio, and no video. It trains no model and fine-tunes none.

When you enable an image-capable model in your pool, an agent can receive an image embedded in an indexed document. The Platform’s own output stays text. The Platform fetches those image bytes only to send them to the model. It keeps a short-lived working copy while it makes that call, discards the copy once it goes unused, and never logs the bytes. It stores no durable copy, and no interface deletes the working copy on demand.

That intended purpose covers every function:

• routing;
• indexing your documents and ranking search results, which Duale AI performs with its own models rather than with your pool;
• web search and public-page reading;
• running a program an agent writes in a fresh sandbox, separate from your systems.

Agent harness states what the Platform runs for one task.

An answer whose requested response format is plain text or unset normally carries a machine-readable mark identifying it as machine-generated. Content marking states which answers carry one, how to verify it offline, and when an answer arrives unmarked.

Excluded uses

Do not use or configure the Platform for any use listed in Annex III of Regulation (EU) 2024/1689. Those uses are:

• Biometrics—remote biometric identification, biometric categorization, emotion recognition.
• Critical infrastructure—safety component for water, gas, heating, electricity, road traffic, or critical digital infrastructure.
• Education and vocational training—admission, assessment of learning outcomes, steering a level of education, proctoring.
• Employment—recruitment, targeted job advertising, filtering applications, evaluating candidates, promotion, termination, allocating tasks based on behavior or personal traits, monitoring and evaluating workers.
• Access to essential services—eligibility for public benefits, creditworthiness, credit scoring, risk assessment and pricing in life and health insurance, emergency call triage, dispatching emergency services, patient triage.
• Law enforcement—any use listed in point 6 of that Annex.
• Migration, asylum, and border control—any use listed in point 7 of that Annex.
• Justice and democratic processes—assisting a judicial authority or an arbitrator in establishing facts or applying the law; influencing an election.

Do not use the Platform as a safety component of a product that requires third-party conformity assessment under Article 6(1) of the same Regulation.

Within the meaning of Article 25(2) of Regulation (EU) 2024/1689, Duale AI expressly specifies that the Platform is not to be changed into a high-risk AI system.

Two common mistakes

Adding a human review step does not, on its own, take a use off that list. Human oversight is an Article 14 requirement for systems already classified as high-risk. It can still matter under the Article 6(3) exemption. There it helps show one of three things: the tasks are narrow and procedural; the tasks are preparatory; or the system merely improves work a human already completed. Adding a review step to a use listed above does not reclassify it.

Splitting a use across several agents does not remove it either. Where several AI systems form part of a more complex system and their combined purpose or joint outputs materially influence a decision, the whole configuration is assessed together.

Both points come from the Commission’s guidelines on the classification of high-risk AI systems, 2026-05-19, paras 70-71 and 75. Those guidelines are still a draft and bind no one.

If you need one of these uses

Write to contact+highrisk@mail.duale.ai before you start. Duale AI answers within 15 working days. Without a separate signed agreement, the use stays excluded.

Configuring the Platform for one of these uses changes its intended purpose. Article 25(1)(c) then makes you the provider of the resulting high-risk system, with the obligations of Article 16.

How routing works

You declare the pool. The Platform picks from it. Duale AI never answers your task with a model outside your pool. Indexing your documents and ranking search results are the exception named above. Duale AI performs both on its own European infrastructure with its own models. It reuses nothing from them outside your context.

You set the routing policy: target accuracy, target permissiveness, cost sensitivity, speed preference, priority, required skills, preferred skills.

These are weights, not guardrails. They raise or lower the chance of selecting a given model. They never forbid a selection. Setting required_skills does not guarantee that the selected model carries the skill—when the pool cannot meet the full request, the Platform uses the best available eligible route.

Routing is not deterministic. Two identical tasks can run on different models. One task can call several providers. Usage analytics can record provider and model calls for completed executions; it is not a route-attempt history.

Skill labels—medical, legal, finance, cyber_offensive and the others—report how a model scored on public, reproducible benchmarks. They do not state a use Duale AI offers. The excluded uses above prevail over any label.

Behavior you must plan for

Know these before an agent acts on a live system.

Tool calls arrive at least once. The same call can reach your code twice or more. Deduplicate on your side. If a duplicated call moves money, sends a message, or writes to a third-party system, the correction is yours. Build a compensating action for every irreversible tool.

Only the agent that submitted a task can stop it. sdk.stop_task(task_id, reason) stops that task and every task started under it. A stop for another agent’s task is accepted and then ignored. Revoking a provider key stops nothing that already runs. A task can run for days.

A stop does not undo work already sent out. It prevents new work. A call already sent to a model provider or a tool runs to its end, and the platform does not recall it.

Tool execution is asynchronous. You set a timeout. When it expires without a result, the agent continues on a best-effort basis and the execution is not confirmed.

Deadlines are absolute dates, never relative durations. A paused task does not shift its deadline.

The deadline also budgets final writing. If a task starts with 30 minutes left, the Platform stops planning no later than minute 25. It can use the remaining five minutes and up to five minutes after the deadline to write the terminal result from work it already captured. That grace permits no new planning or tool calls. If final writing does not finish within the grace period, the task ends as a failure.

On a long task, the Platform sends the model less than the whole history. Well before that history fills the context window of the selected route, it starts sending less of it, oldest first. The task instruction you submit is sent unchanged on every model call of that task. The Platform never deletes what it stored, and the model can read the original back. How the SDK works states what it reduces and what it leaves intact.

An interrupted task does not resume. Continuing a conversation needs a parent that finished successfully, so after an interruption you submit a new task. It starts without the interrupted task’s history and carries a new deadline that you set.

The Platform builds no human review step for you. You develop the tools the agent calls, so you decide where a human intervenes, against what criteria, and how often. If you build no review step, the agent acts without one. The one control the platform gives you is the stop above.

What Duale AI records

Use these records as supporting evidence, not as a complete explanation of an outcome:

No record states why one model ran rather than another. Duale AI also does not record the version of the routing algorithm. Two runs of the same agent can therefore differ for a reason the records do not explain. Authoring or editing an access policy or a group is not recorded at all. The Python SDK does not export audit logs. A tenant administrator can export them from the web interface; the editor and viewer roles cannot.

Evidence and audit states what the records cover and what they leave out.

Who must tell people an AI is involved

The Platform exposes no conversational interface to natural persons. Your code calls it through the SDK and the API.

If you re-expose outputs to natural persons under your own name, you become the provider of that system. You must then tell those people that they are interacting with an AI. Each agent carries a unique identifier and a description so you can state which agent acts and on whose behalf.