Watching Conformly audit Novello
Novello is a marketing platform putting AI into production, sure the EU AI Act doesn't apply to them. Scroll down to see what a two-minute audit actually finds — and what each finding means, without the legal jargon.
Novello
Ads that convert. · Retail marketing & ads platform
“It's just marketing software — recommendations and ad images. No way the AI Act touches us.”
- Ad Creative GenGenerates ad images from a promptdeclared
- Support botHandles customer questionsdeclared
- npm:@face-segment/instoreIn-store camera audience analysisundeclared
- AI SpokespersonSynthetic video presenter for campaignsundeclared
- RecommenderSuggests products to shoppersundeclared
The founder named 2. A read-only scan of the code found 5. Here is what each one means — in plain words.
In-Store Audience Analysis
Uses shop cameras to sort shoppers by inferred traits — like ethnicity or beliefs — to target offers.
Banned. Using face data to guess sensitive things about people — their ethnicity, religion or politics — is one of the practices the Act outright forbids. It has to be turned off.
In plain words: You can't scan faces to guess someone's race or religion and sell to them on that basis. The law bans it.
Art. 5Article 5(1)(g) prohibits biometric categorisation that infers race, political opinions, religious beliefs, sex life or sexual orientation from biometric data. In force since 2 February 2025.
Switch off inferring sensitive attributes from camera data. Aggregate, anonymous footfall counting is a different thing.
Conformly classifies it as a prohibited practice with the article and the reason, so it's caught internally.
An inspector would open with: "Explain every use of camera or biometric data and what you infer from it."
Support Bot
Answers customer questions in chat.
Tell customers it's an AI. One clear sentence.
In plain words: A helpful bot is fine — as long as it admits it's a bot.
Art. 50Article 50(1) requires people to be told they're interacting with AI. Applies from 2 August 2026.
Add "You're chatting with Novello's AI assistant" to the chat.
Conformly hosts the transparency page and the disclosure chip.
Ad Creative Gen
Generates ad images from a text prompt.
AI-made ad images have to carry a machine-readable 'AI-generated' mark.
In plain words: If a computer drew the ad, it needs an invisible 'made by AI' tag.
Art. 50(2)Article 50(2) requires machine-readable marking of synthetic images, transition to 2 December 2026 for existing systems.
Enable content credentials (C2PA) on generated images.
The obligation lands on your task list; the watermark checker confirms whether output carries provenance metadata.
AI Spokesperson
A realistic synthetic video presenter that fronts campaigns.
A realistic AI-generated person has to be labelled as artificial — visibly, because it looks like a real human — and the video must carry a machine-readable mark too.
In plain words: If the person in your ad is a deepfake, viewers have to be told it isn't real.
Art. 50(4)Article 50(4) requires a visible disclosure for deepfakes resembling real people, from 2 August 2026; Article 50(2) adds machine-readable marking (transition to 2 December 2026).
Add a visible "AI-generated" label to the presenter and provenance metadata to the video.
Both duties land on your task list, and the watermark checker verifies the marking.
Product Recommender
Suggests products a shopper might like.
Nothing owed. A recommendation nudges; it doesn't decide anything binding about the person. Minimal risk.
In plain words: 'You might also like…' doesn't affect anyone's rights. It's fine.
—Not high-risk and outside Article 50 — minimal-risk only.
No action required. Keep it listed.
Conformly keeps it in your inventory so the record is complete.
The verdict
Novello was sure marketing software was out of scope. The audit found a camera feature they had to kill immediately and three honesty fixes for their AI-made ads and presenter — while the recommendation engine was fine.
That startup was made up. Your AI isn't.
The same deterministic engine can classify your real systems in two minutes — no sign-up, no sales call. Or drop the read-only scanner into your codebase and see what it finds.
npx conformly-scan --dry-run
An example audit — a realistic walkthrough of how Conformly's deterministic engine classifies this kind of AI product. Not legal advice.