Document ID: REG-004
Document owner: Sebastian Windeck (DPO)
Classification:ConfidentialVersion: 1.0
Last updated: March 2026
Next review: March 2027
Frameworks: ISO 27001 (A.5.31, A.5.32, A.5.34) | SOC 2 (CC2.2, P1.1)
This register identifies all legal, statutory, regulatory, and contractual requirements applicable to CTW Data Solutions GmbH and the Quick-ID platform. It is maintained as part of ISO 27001 compliance (Clause A.5.31) and supports SOC 2 compliance requirements.
Quick-ID's primary function is OCR and data extraction from identity documents via API. It does not:
Make autonomous decisions about individuals
Perform biometric identification or categorisation
Fall under the Annex III high-risk categories
Operate as a general-purpose AI model
Recommended actions:
#
Action
Owner
Target Date
Status
1
Complete formal AI system risk classification with legal counsel
Malte Toetzke
June 2026
📋 Planned
2
Document Quick-ID AI system description (Art. 53 transparency)
Malte Toetzke
July 2026
📋 Planned
3
Prepare transparency notice for customers (Art. 50 — inform users they are interacting with AI-processed output)
Sebastian Windeck (DPO)
July 2026
📋 Planned
4
Establish AI system monitoring and logging (if classified as high-risk)
Sebastian Windeck (CTO)
August 2026
📋 Contingent
5
Review with legal counsel whether customer use cases could elevate Quick-ID to high-risk by context of use
Malte Toetzke
June 2026
📋 Planned
Important Note
The EU AI Act classification depends not only on the system itself but also on how it is deployed by customers. If a customer uses Quick-ID output for automated decision-making about individuals (e.g., KYC accept/reject), the customer's system as a whole may be classified as high-risk. CTW should clarify responsibility boundaries with customers.