Version 1.1 — in force from 15 September 2026
These general terms and conditions apply to the "AI Act audit" services provided by DataNerds. They apply exclusively between undertakings (B2B).
Article 1. Identification and definitions
LOOX, a private limited company incorporated under Belgian law, trading under the name DataNerds, with registered office at Sint-Adriaanstraat 40, 3150 Haacht, Belgium, registered with the Crossroads Bank for Enterprises under number 1031.401.097, VAT BE 1031.401.097, email info@datanerds.be, website www.datanerds.be.
Every reference to "DataNerds" in these terms, in quotations, on the website and in commercial documentation is a reference to LOOX BV. All obligations are entered into by, and all invoicing is carried out in the name of, LOOX BV.
Assignment: the services agreed between the parties, as described in the quotation or order confirmation.
Audit: the AI Act review described in article 4.
Deliverables: the reports, registers, matrices, advice, templates and other results that DataNerds provides to the Client in the context of the Assignment. Where these terms draw a distinction, this term covers both the DataNerds deliverables and the legal deliverables.
Legal deliverables: the legal risk assessments, due diligence reports, legal qualifications and advice prepared by the affiliated lawyers and provided to the Client through DataNerds.
DataNerds deliverables: all other deliverables, including the inventory, the technical analyses, the operational components of the gap analysis, the remediation plan and the output generated by Thor.
Methodology: the audit framework developed by DataNerds, including the questionnaires, classification logic, scoring models, templates, prompts and prompt chains, architecture and design documents, guardrail configurations and the underlying software (including Thor).
Marks: the trade marks, logos, trading names and product and service designations of DataNerds, as listed in article 12.8.
Website: www.datanerds.be, including its structure, navigation, texts, images, design, source code and underlying databases.
Affiliated lawyers: the independent lawyers or law firms with whom DataNerds works on the legal components of the Assignment.
Article 2. Scope and order of precedence
2.1 These general terms and conditions form an integral part of every quotation, order confirmation and agreement between DataNerds and the Client. By signing the quotation, by placing an order or by accepting the commencement of the work, the Client acknowledges that it has taken note of these terms and accepts them.
2.2 The general terms and conditions, purchasing conditions or other clauses of the Client do not apply, including where they are communicated later and even where they contain a precedence clause, unless DataNerds has expressly agreed to them in writing in advance.
2.3 In the event of a conflict, the following order of precedence applies: (i) the signed quotation or order confirmation, (ii) the data processing agreement, (iii) these general terms and conditions, (iv) any other annex.
2.4 A failure to apply a provision of these terms, or to apply it immediately, does not constitute a waiver of rights.
Article 3. Quotations and formation
3.1 Quotations from DataNerds are without obligation and valid for 30 calendar days, unless stated otherwise.
3.2 Quotations are prepared on the basis of the information supplied by the Client concerning, among other things, the number of AI systems, the number of entities, the sites involved and the documentation available. Should that information prove incorrect or incomplete, DataNerds is entitled to adjust the scope, the timing and the price in accordance with article 10.
3.3 The Agreement is formed by the Client's written acceptance of the quotation, or by the actual commencement of the work by DataNerds with the Client's knowledge.
Article 4. Subject matter of the services
4.1 Unless the quotation provides otherwise, the Audit consists of the following phases:
a) Intake and delimitation: determination of the perimeter — the entities, processes and systems within scope.
b) Inventory: identification of the AI systems and AI models that the Client develops, has developed, places on the market, puts into service or uses.
c) Risk classification: allocation of the systems to the risk categories of the EU AI Act.
d) Gap analysis: comparison of the existing situation with the applicable obligations, including points of contact with the GDPR in so far as these are expressly within scope.
e) Reporting: an audit report setting out findings, a risk assessment and a prioritised remediation plan.
f) Explanation: a discussion of the report, held in person or by digital means.
4.2 The following are not included in the Assignment unless expressly agreed in writing: the implementation or remediation of identified shortcomings; technical audits of source code, model weights, training data or cyber security (bias, robustness or performance testing); conformity assessments by a notified body within the meaning of the EU AI Act; CE marking and the preparation of technical documentation; representation before a supervisory authority or a court; and tax, accounting or financial advice.
4.3 DataNerds is not a notified body, not an accreditation body and not a recognised conformity assessment body. The Audit is a private review. It does not replace a conformity assessment procedure, an EU declaration of conformity or registration in an EU database where the EU AI Act requires these.
4.4 The designation "DataNerds Seal of Approval" and any similar designation refer to an internal quality label of DataNerds. They do not constitute certification, a quality mark or a declaration of conformity within the meaning of the EU AI Act or of any other legislation, and may not be presented as such by the Client to third parties or to a supervisory authority.
4.5 Where DataNerds also provides services from its service catalogue alongside the Audit (including the set-up, hosting, monitoring or maintenance of AI environments), these terms apply in full, supplemented by the specific provisions of the relevant quotation or services agreement.
Article 5. Legal component and role of the affiliated lawyers
5.1 DataNerds is not a law firm and is not registered with a bar association. DataNerds does not itself provide legal advice reserved to lawyers and does not perform acts reserved to lawyers under the Belgian Judicial Code.
5.2 The legal qualification and the legal advice within the Assignment are provided by the affiliated lawyers, who act in their own name, under their own professional indemnity insurance and in observance of their professional obligations, including legal professional privilege and the checking of conflicts of interest.
5.3 The Client acknowledges that, where the affiliated lawyers contract directly with the Client, the relationship in respect of that component is governed by the terms of the law firm concerned, and that DataNerds is not liable in respect of that component.
5.4 The Client acknowledges that the involvement of DataNerds in the communications may mean that legal professional privilege and the confidentiality of correspondence between lawyer and client cannot be relied upon in all circumstances. Where the Client wishes to obtain strictly privileged legal advice, it shall say so in advance, so that a separate channel with the affiliated lawyers can be set up.
5.5 The Client agrees that DataNerds may provide the affiliated lawyers with the Client data necessary for the legal component, subject to confidentiality and limited to what is required for that assessment.
5.6 The limitations of liability applied by the affiliated lawyers in their own terms also apply in relation to the Client. The Client accepts that it cannot assert any claim against the affiliated lawyers that goes beyond those limitations, and shall indemnify DataNerds against any claim that it or a third party may bring against the affiliated lawyers notwithstanding those limitations. DataNerds shall provide the Client with the text of the applicable limitations on first request.
5.7 The Client shall not use the name, trading name, logo, house style or any other distinctive sign of the affiliated lawyers without their prior and express written consent. The Client shall not give third parties the impression that acts, systems, processes or practices are legally covered, certified or approved by the affiliated lawyers, and shall not present the risk assessments as a guarantee of compliance or as a definitive legal approval in relation to supervisory authorities, business partners, investors or any other third party.
5.8 Restriction on use of the risk assessments: the intellectual property rights in the risk assessments vest in the affiliated lawyers. Following payment in full, the Client obtains a limited, non-exclusive, non-transferable and non-sublicensable licence to use them internally within its own organisation and in connection with the use of Thor. The risk assessments may not be shared with third parties and may not be used as a basis, reference or training material for the development of tools, software or services. The licence lapses automatically and without notice of default upon non-payment, upon misuse, or upon termination of the Agreement.
5.9 Where the Client wishes to disclose a risk assessment or part of one to its auditor, insurer, financier or to a supervisory authority, it shall notify DataNerds in advance, and DataNerds shall seek the consent of the affiliated lawyer concerned. That consent shall not be unreasonably withheld. Without that consent, disclosure is not permitted.
Article 6. Client obligations
6.1 The Client undertakes to provide, in good time, completely, accurately and in a usable form, all information, documentation and access that DataNerds may reasonably require, and to make the necessary staff available for interviews and workshops.
6.2 The Client is responsible for the accuracy and completeness of the Client data. DataNerds does not independently verify these and may reasonably rely on them. The deliverables are prepared solely on the basis of the information provided and of the state of the legislation at the time of reporting.
6.3 The Client holds the rights necessary to disclose the Client data to DataNerds and warrants that such disclosure does not infringe the rights of third parties, contractual confidentiality obligations or data protection legislation.
6.4 The Client shall designate a single point of contact with sufficient decision-making authority.
6.5 Delay or incompleteness in the Client's cooperation suspends the periods applicable to DataNerds and gives rise to a right to compensation for the resulting waiting time and additional costs at the applicable hourly rate.
Article 7. Nature of the obligation
7.1 All obligations of DataNerds are obligations to use best efforts. DataNerds performs the Assignment with the care that may be expected of a normally careful and professional service provider in the same circumstances.
7.2 DataNerds does not warrant that, following performance of the Audit or of the remediation plan, the Client meets the requirements of the EU AI Act or of any other legislation, nor that a supervisory authority, a court, a notified body, an auditor or a business partner will follow the analysis of DataNerds.
7.3 The EU AI Act has staggered dates of application and is supplemented by implementing acts, delegated acts, harmonised standards and guidelines. The deliverables reflect the position as at the date of reporting. DataNerds is not obliged to update the deliverables subsequently, unless a maintenance or follow-up agreement has been concluded.
Article 8. Time periods
8.1 Stated time periods are indicative, unless a period is expressly designated as binding in the quotation.
8.2 Exceeding an indicative period does not give rise to any right to damages, price reduction or rescission.
8.3 The period for the legal component begins only once the affiliated lawyer has received all information, documents and data necessary for the assessment and the commencement conditions set by that lawyer have been met. Late, incomplete or inaccurate delivery by the Client postpones that period automatically by an equal number of calendar days.
Article 9. Price, invoicing and payment
9.1 Prices are expressed in euro and exclusive of VAT, taxes, travel expenses and third-party costs, unless stated otherwise.
9.2 Unless agreed otherwise, DataNerds invoices 30% on commencement and the balance on delivery of the audit report. For assignments lasting more than two months, invoicing takes place monthly on the basis of progress.
9.3 Invoices are payable within 30 calendar days of the invoice date. In no event shall the payment period exceed the maximum permitted by law for transactions between undertakings.
9.4 Complaints regarding an invoice must be made in writing and with reasons within fourteen calendar days of the invoice date. Complaints do not suspend the obligation to pay the undisputed portion.
9.5 In the event of non-payment on the due date, interest is payable automatically and without notice of default in accordance with the Belgian Act of 2 August 2002 on combating late payment in commercial transactions, increased by fixed damages of 10% of the outstanding amount, subject to a minimum of EUR 125, without prejudice to the recovery costs provided for by that Act.
9.6 In the event of non-payment of an invoice that has fallen due, DataNerds is entitled to suspend performance of all current assignments, following written notice of default that has remained without effect for ten calendar days.
Article 10. Change of scope
10.1 Any extension or change of scope, any additional system, any additional entity and any additional reporting round is regarded as additional work.
10.2 Additional work is estimated and confirmed in writing in advance (email is sufficient). In the absence of agreement to the contrary, additional work is charged at the applicable hourly rate of EUR 200 excluding VAT.
10.3 Where the legislation or the guidance of a supervisory authority changes materially during performance, the parties shall consult in good faith on the consequences for scope, timing and price.
Article 11. Duration and termination
11.1 The Agreement ends on delivery of the deliverables, unless a term has been agreed.
11.2 An agreement for a fixed term may be terminated by either party by written notice of one month. An agreement for an indefinite term may be terminated on three months' notice.
11.3 On termination by the Client, all services performed up to that point and the unavoidable costs already incurred by DataNerds are payable.
11.4 Either party may terminate the Agreement with immediate effect, without recourse to the courts, if the other party fails to remedy a material breach within fifteen calendar days of a written notice of default setting out the breach precisely.
11.5 DataNerds may in addition terminate the Agreement with immediate effect if performance would place it in conflict with the professional rules of the affiliated lawyers, with a conflict of interest or with mandatory legislation.
11.6 Articles 12 to 16, 17 and 21 survive the end of the Agreement.
Article 12. Intellectual property
12.1 The Methodology, the software (including Thor), the templates, the questionnaires, the scoring logic, the know-how and all associated intellectual property rights remain the exclusive property of DataNerds. Nothing in the Agreement effects a transfer of these, including where the Methodology has been configured or adapted specifically for the Client and irrespective of the price paid for the Assignment.
12.2 Following payment in full, the Client obtains in respect of the DataNerds deliverables a non-exclusive, non-transferable, worldwide and perpetual right of use, for its own internal purposes and for the purposes of its own compliance file, including disclosure to its auditor, insurer, board, financiers and to a supervisory authority that requests them.
12.3 The risk assessments are subject solely to the more restrictive regime of articles 5.8 and 5.9. In the event of a conflict between article 12.2 and article 5.8, article 5.8 prevails. DataNerds expressly draws the Client's attention to the fact that it is not entitled to grant rights in the risk assessments that are wider than those it has itself obtained from the affiliated lawyers.
12.4 The Client may not commercialise the deliverables, offer them as its own product, distribute them publicly or use them to develop a competing service. Any disclosure to a third party outside articles 5.9 and 12.2 requires the prior written consent of DataNerds.
12.5 Where a deliverable is disclosed to a third party with consent, DataNerds accepts no liability whatsoever towards that third party and the Client undertakes to indemnify DataNerds against claims from that third party relating to the use of the deliverable.
12.6 DataNerds retains the right to use general know-how, experience and anonymised and aggregated insights from the Assignment to improve its Methodology and its services, provided that the Client is not identifiable from them.
12.7 Suggestions and feedback from the Client concerning the Methodology or the software may be used freely by DataNerds, without compensation.
12.8. Protected rights
● The Benelux trade mark "DataNerds" (figurative mark with word elements), filed with the Benelux Office for Intellectual Property on 27 February 2026 under file number 1543527.
● The service catalogue "DataNerds: Sovereign AI Solutions" and the audit methodology described in it, including its phased structure and the development plans for Thor, filed as an i-DEPOT with the Benelux Office for Intellectual Property.
● The software, dashboards, configurations and documentation offered under the name Thor, in all versions.
● The product and service designations "The AI Fort", "Sovereign Business", "AI Discovery & Prototype", "Digital Guard" and "DataNerds Seal of Approval".
● The Website and all parts of it.
12.9 The Client shall not use the Marks without the prior written consent of DataNerds, save for a simple factual reference to the collaboration. The Client shall refrain from any act liable to affect the Marks, including the filing, registration or use of identical or similar signs, domain names, trading names, product names or social media account names.
12.10 The entire content of the Website is protected by copyright. © 2026 LOOX BV — DataNerds. All rights reserved. Any reproduction, distribution, adaptation, publication or communication to the public of the content of the Website, in whole or in part and on any medium, is prohibited without the prior written consent of DataNerds. Hyperlinking to the homepage is permitted. Framing, deep linking to restricted sections and the incorporation of content into a third-party environment are not.
12.11. Reservation regarding text and data mining. DataNerds expressly reserves rights in the sense of Article 4, paragraph 3 of Directive (EU) 2019/790 and of the Belgian implementation thereof. Automated text and data mining, scraping or crawling of the website or of the deliverables, and the use thereof as input for training, fine-tuning, evaluating or benchmarking artificial intelligence models, is not permitted. This reservation is also made machine-readable via the robots.txt and the metadata of the website.
12.12 Decompilation and reverse engineering of the software and of the guardrail configurations are prohibited, save in the cases where the law mandatorily permits them.
12.13 In the event of any breach of articles 12.1, 12.4, 12.9, 12.10, 12.11 or 12.12, the party in breach owes DataNerds fixed damages of EUR 100,000 per breach, automatically and without prior notice of default. In the case of a continuing breach, a further EUR 1,000 per day is owed from the eighth calendar day following the notice of default, for as long as the breach continues.
12.14 The parties expressly acknowledge that this amount constitutes a reasonable pre-estimate of the loss suffered by DataNerds in the event of such a breach. That estimate takes account of the development cost and the confidential nature of the Audit and of Thor, the limited size of the market in which DataNerds operates, the contract value per assignment, the cost of redevelopment and repositioning, and the reputational damage within a regulated market in which confidence in the confidentiality of the services is decisive.
12.15 The fixed compensation is without prejudice to the right of DataNerds to claim the loss actually suffered where this is higher and is proven, or to its right to seek an injunction, to apply for a descriptive seizure in counterfeiting proceedings or to take any other measure under Book XI of the Belgian Code of Economic Law and the Benelux Convention on Intellectual Property. The compensation under articles 12.13 to 12.15 falls outside any limitation of liability or maximum amount referred to in article 15.
Article 13. Confidentiality
13.1 Each party shall treat the confidential information of the other party as confidential, use it solely for the performance of the Agreement, and make it accessible only to staff, subcontractors and advisers who need to know it and who are bound by equivalent confidentiality obligations.
13.2 This obligation does not apply to information that is public without breach, that the receiving party lawfully obtained from a third party, that it developed independently, or the disclosure of which is required by law or by a court. In the latter case, the receiving party shall notify the other party in advance in so far as this is legally permitted.
13.3 The confidentiality obligation continues for five years after the end of the Agreement, and without limit in time for information protected as a trade secret within the meaning of article I.17/1 of the Belgian Code of Economic Law.
Article 14. Processing of personal data
14.1 In respect of personal data that DataNerds processes for its own purposes (contact management, client administration, prospecting, accounting), DataNerds acts as controller. The DataNerds privacy policy applies.
14.2 Where DataNerds processes personal data on behalf of the Client in the context of the Assignment, it acts as processor and the parties shall conclude a data processing agreement in accordance with article 28 GDPR in advance. That data processing agreement forms an integral part of the Agreement.
14.3 The Client, as controller, warrants that it has a valid legal basis for disclosing personal data to DataNerds and that it has complied with its information obligations.
14.4 The Client shall not provide DataNerds with personal data that are not necessary for the Assignment, and in particular shall not provide special categories of personal data or data relating to criminal convictions, unless this has been agreed in writing in advance and is regulated in the data processing agreement.
Article 15. Liability
15.1 DataNerds is liable only for loss that is the direct and foreseeable consequence of a breach of its obligations.
15.2 The total liability of DataNerds arising from or in connection with an Assignment is limited to the amount paid out by its professional indemnity insurer in the case concerned. In the absence of cover from the insurer, liability is limited to the amount, excluding VAT, paid by the Client for the Assignment concerned in the twelve months preceding the loss, subject to an absolute maximum of EUR 45,000.
15.3 DataNerds is not liable for indirect loss, including loss of profit, loss of turnover, loss of clientele, loss or corruption of data, reputational damage, and the costs of staff or external advisers incurred by the Client.
15.4 DataNerds is not liable for administrative fines, penalty payments or sanctions imposed on the Client by a supervisory authority, save in the cases referred to in article 15.6.
15.5 DataNerds is not liable for loss arising from inaccurate, incomplete or late information from the Client, from a failure to follow the recommendations in the deliverables or from following them inadequately, from decisions taken independently by the Client, from the services of the affiliated lawyers or of other third parties engaged by the Client, or from changes in the legislation or in its interpretation after the date of reporting.
15.6 Any claim by the Client lapses if it is not brought in writing and with reasons within six months after the Client became aware, or ought reasonably to have become aware, of the event giving rise to the loss.
15.7 The limitations of liability also operate for the benefit of the directors, partners, employees and subcontractors of DataNerds, who may rely on them directly.
15.8 This article does not limit the claims of DataNerds under article 12.
15.9 By way of derogation from article 15.6, the Client shall notify DataNerds in writing of any claim relating to the legal component of the Assignment within thirty calendar days after it discovered, or ought reasonably to have discovered, the loss, and in any event within six months of the event giving rise to the loss. This period reflects the limitation periods applied by the affiliated lawyers in their own terms, which DataNerds must be able to observe in order to exercise recourse. In the absence of timely notification, the claim lapses.
Article 16. Force majeure and unforeseen circumstances
16.1 Neither party is liable for the non-performance of its obligations resulting from force majeure, including war, strike, epidemic, fire, flood, failure of telecommunications or electricity networks, cyber attack, and default by an essential supplier. Payment obligations are not suspended by force majeure.
16.2 Where the force majeure continues for more than sixty calendar days, either party may terminate the Agreement in writing without compensation, subject to payment for the services already provided.
16.3 Where circumstances change in an unforeseeable manner such that performance becomes excessively onerous, the parties shall negotiate in good faith an adjustment of the Agreement.
Article 17. Non-solicitation
17.1 During the Assignment and for twelve months after its completion, the parties shall refrain from actively approaching staff or subcontractors of the other party who were directly involved in the Assignment with a view to employment or collaboration, save with prior written consent.
17.2 In the event of a breach, fixed compensation of EUR 25,000 per person concerned is payable. This clause does not preclude a publicly advertised vacancy to which the person concerned responds on their own initiative.
Article 18. Subcontracting and assignment
18.1 DataNerds may engage subcontractors for the performance of the Assignment and remains responsible for their performance, without prejudice to article 5.
18.2 Neither party may assign the Agreement without the written consent of the other party, save for an assignment to an affiliated company or in the context of a merger or transfer of a business unit.
Article 19. References
19.1 Unless the Client objects in writing, DataNerds may state the name and logo of the Client as a reference on its website and in commercial documentation, without disclosing substantive details of the Assignment.
Article 20. Miscellaneous
20.1 The invalidity or unenforceability of a provision does not affect the validity of the remaining provisions. The parties shall replace the provision concerned with a valid provision that approximates the original intention as closely as possible. Where the fixed compensation under article 12.13 is reduced by a court, it remains payable in the amount determined by the court.
20.2 DataNerds may amend these general terms and conditions. For current Assignments, the version applicable at the time the Agreement was concluded continues to apply.
20.3 Notices in the context of the Agreement are valid if sent by email to the addresses designated by the parties. Notices of default and notices of termination are given by registered post or by email with acknowledgement of receipt.
20.4 The Agreement does not create a partnership, agency or employment relationship between the parties.
Article 21. Governing law and jurisdiction
21.1 The Agreement is governed exclusively by Belgian law, to the exclusion of the Vienna Sales Convention (CISG) and of conflict-of-law rules.
21.2 The parties shall first seek to settle any dispute amicably and in good faith. Where those discussions do not succeed within thirty calendar days, the courts of the judicial district of Leuven shall have exclusive jurisdiction, without prejudice to the right of DataNerds to bring proceedings against the Client before the court of the Client's registered office.