EU AI Act paperwork for a San Diego company that sells into Europe

EU AI Act San Diego company work is an inventory of systems that touch the European Union, a risk note a person still owns, and artifacts counsel can read. Protectron at protectron.ai produces European Union (EU) Artificial Intelligence Act artifacts. This page is not legal advice. Dates and duties are widely reported public facts you must confirm. Nidrosoft is the San Diego studio of Cyriac Zeh, a design engineer who implements AI for small and mid-size businesses: audits, custom builds, phone and receptionist agents, training, and systems the team can own.

Key takeaways

• A San Diego company can still be in scope if it places an AI system on the EU market or its output is used in the Union. Confirm that sentence with counsel. Do not take it from a blog.
• Protectron is paperwork-shaped. A person still signs. The studio does not file with a European authority for you.
• La Jolla and University Town Center (UTC) sit next to biotech and still have 40-person product companies that need a file, not enterprise theater.
• Start with a system inventory: name, vendor, purpose, data, human gate. A slide titled “AI strategy” is not an inventory.
• Token spend and Act paperwork are different leftovers. TokenTra cuts bills. Protectron drafts artifacts. Do not merge them in one demo.
• Fit is companies roughly 30 to 250 people, plus a smaller shop if one product owner and one counsel contact are already clear.

Contents

• Why a San Diego company is in this conversation
• Inventory first, then a risk note
• What Protectron is and is not
• UTC, biotech neighbors, and the rest of the county
• How to stand up the file in one week
• Customer questionnaires and the next security packet
• Phone agents, HIPAA, and other gates
• How Nidrosoft handles this
• What counsel still owns
• Frequently asked questions
• Start with the system list you already have

Why a San Diego company is in this conversation

The EU Artificial Intelligence Act is widely reported as a risk-based law that entered into force in 2024, with duties that phase in over following years. Prohibited practices, general-purpose model duties, and high-risk system duties are public categories you will see on every official summary. This page will not invent a deadline for your product. Ask counsel for the date that matches your system class. Ask counsel whether your San Diego company is a provider, a deployer, or both.

Scope is the first argument in the room. Widely reported summaries say the Act can apply to providers and deployers outside the Union when the AI system is placed on the EU market or its output is used in the Union. Your facts change the answer: a UTC software team with EU customers, a La Jolla tool used by a European hospital, a Kearny Mesa dealer site that never sells into Europe. Do not copy a neighbor’s memo.

The leftover for most small companies is not a Brussels office. It is a file: what systems you run, what they do, what data they see, who can override them, and which vendor contracts already exist. A board that wants a portfolio narrative should hire a strategy firm. A product owner who wants a packet they can hand counsel should stay on this page.

AI implementation for San Diego small businesses is the county operating guide. Software companies is tickets, evals, bills, and renewals. This page is the Act packet. Token spend for San Diego software teams is the invoice. Keep those piles labeled.

Workshops have been run in La Mesa. A private sprint on your system list is a playbook. It is not a legal opinion. Public formats Cyriac already joins, including the San Diego Executive Roundtable and AI for the Rest of Us, are rooms for judgment. They are not attendance-stamped proof that your file is complete.

Inventory first, then a risk note

A useful inventory is a table the inheritor can open on Tuesday.

Do not let a model fill RiskNote as if it were the lawyer. The model can draft a description from the purpose sentence you already wrote. A person still classifies. Widely reported buckets include prohibited practices, high-risk systems, transparency duties, and systems with no extra Act load. Mis-classifying a hiring tool or a medical device-adjacent model as “just a chatbot” is how you earn a later rewrite. This page will not classify your tool.

General-purpose models you call via API have a vendor story and a deployer story. The vendor’s documentation is not your file. Keep VendorName and the contract exhibit. Keep your own purpose and your own human gate. Copying a provider’s blog into your packet without a purpose sentence is decoration.

Shadow systems belong on the list. The Encinitas designer’s Midjourney seat, the support agent that summarizes EU tickets, the dental-adjacent clinic tool a founder demoed once. If it can touch an EU user, it is a row. If you do not know, write “unknown” and assign an owner. Unknown is an honest state. Hidden is not.

NanoBrief briefs in under 2 minutes versus 3+ hours is a drafting habit for internal write-ups. Use it to turn the table into a memo counsel can skim. Do not use it to invent a conformity assessment.

What Protectron is and is not

Protectron is live at protectron.ai. It produces EU AI Act artifacts. We name it because unnamed logos teach nothing. We will not invent a San Diego exporter that uses it. Custom work starts when your inventory, your counsel’s template, or your group structure needs a path the product does not ship.

The product habit matches the rest of the studio: draft, review, accept. A person still signs. The studio does not file with the European Commission or a national authority. The studio does not issue a CE mark. The studio does not certify your model.

What Protectron proves is texture: paperwork a team can own. What it does not prove is that your first week completes high-risk documentation, or that a two-person Encinitas shop needs the same packet as a device company. Say which leftover you want on the first call.

TokenTra at tokentra.io is spend by feature. Teams have cut 10-30% of wasted AI spend. That is not an Act artifact. Nerlude holds infrastructure and keys. Eviction Wizard and Omnira Dental are other public systems with human gates. They are not conformity files. Nexuvo’s 3x inventory result is a dealer leftover.

AI consulting alternatives exist if you need a strategy pack or a large firm’s EU desk. Parsons AI and Applied Intelligence publish San Diego consulting. SideGuy in Encinitas builds custom software if you already have a spec. Score the leftover. A UTC team that needs a system list should not buy a year of opinions with no file.

UTC, biotech neighbors, and the rest of the county

La Jolla and UTC small companies sit next to biotech campuses and still ship software, not enterprise programs. Their EU story is often a handful of customers, a model API, and a support inbox. They need the inventory and a counsel letter, not a 200-page management system copied from a multinational.

Biotech-adjacent products that touch health data pick up extra gates that are not the Act alone: Health Insurance Portability and Accountability Act (HIPAA) conversations in the United States, vendor business associate agreements, and clinical claims the model must not make. Helia is a live health-guidance product. It is not an electronic health record. Do not treat a guidance demo as a medical device file. Ask counsel. This studio does not publish a HIPAA certification.

Kearny Mesa and Mission Valley service businesses that bought a receptionist agent have a thinner Act story if they have no EU users. Still write the row. “No EU users” is a fact you can defend only if sales agrees. Encinitas and Del Mar Coast Highway clinics that never take EU patients should still ask whether a vendor model stores prompts in Europe or trains on them. That is a contract question.

Chula Vista and South Bay shops with Spanish-first callers are usually a California phone leftover, not an Act leftover. East County and La Mesa workshops are useful when the leadership team has never listed their systems in one room. Carlsbad and Oceanside tourism companies that sell to EU visitors on a website may have a different fact pattern than a UTC SaaS team. Name the pattern. Do not copy a neighbor.

Military and dual-use work may forbid certain systems. Write the gate. Do not ask a model to classify export control.

How to stand up the file in one week

1. List every system that calls a model or that a vendor markets as AI, including SaaS receptionists such as FrontDesk, Rosie, Goodcall, Smith.ai, and Voksha if you use them.
2. For each row, fill Purpose, VendorName, and HumanGate. Leave RiskNote as “not yet classified” until counsel writes.
3. Ask sales whether EU accounts, EU users, or EU-hosted output exist. Write the answer on the row.
4. Export vendor contracts and data-processing exhibits. Park them next to the row. Do not summarize a contract with a model and call it the exhibit.
5. List keys and orgs. Put them in the vault you already pay for. Nerlude is the public product if that pile is the fire.
6. Draft one artifact Protectron’s shape matches, or a memo from the table. A person reviews.
7. Schedule counsel. Bring the table, not a vibe. If counsel is months away, buy the inventory now and stop calling it compliance.
8. Name the inheritor. If the only person who understands the systems is a contractor who leaves in thirty days, the first purchase is the list.

Feasibility includes whether security will allow a third-party artifact tool, and whether counsel will accept a draft. Payback is hours returned when the next customer sends a security questionnaire. A homepage chatbot loses this rank.

Fit is usually 30 to 250 people, or a smaller shop with one product and one counsel contact. A company that will not name an owner is not ready for a build.

Customer questionnaires and the next security packet

UTC and La Jolla product teams already lose hours to the same PDF with a new logo. A European customer, a reseller, or a hospital procurement desk sends a questionnaire: where do models run, who can see prompts, can a user stop the system, what happens when the vendor changes the model. The inventory table is the only honest source. A founder who answers from memory will contradict last quarter’s packet.

Write a reuse rule. The same SystemName row feeds the Act artifact, the security questionnaire, and the sales engineer’s appendix. If those three documents disagree on VendorName or HumanGate, the next auditor will find it. Do not let marketing rewrite the purpose sentence into a slogan. The customer-facing line can be shorter. It cannot be a different product.

Widely reported Act themes that show up on questionnaires are human oversight, logging, data used for training, and whether the system is high-risk. This page will not turn those themes into a checklist that pretends to be complete. Keep a log of who accepted a draft. Keep the vendor exhibit. Keep the stop button named. If the questionnaire asks for a conformity assessment, counsel answers. If it asks for a screenshot of the override, the product owner answers. If it asks for a certificate this studio does not have, say so.

A UTC SaaS with German tenants needs the inventory table, the eval sheet for the customer-facing agent, the accept log on refunds or contract drafts, and the disclosure line counsel approved. A Sorrento device exporter needs the same table plus a sentence that Protectron is not a CE mark. A downtown consumer app with a surprising EU download share needs the Europe-touch flag set to users even if no invoice is in euros.

Do not hide the support agent because it is only macros. Do not hide the contractor notebook that still has production data. Do not hide the voice agent on the sales number. Internal contract drafting on customer paper is often the row that surprises counsel. US state rules on healthcare, lending, employment, and housing can apply to the same San Diego company. This page does not cover them. Say if those are in play so we do not pretend one packet is the only packet.

TokenTra teams cut 10 to 30 percent of wasted spend once they can see the bill. A company that cannot name features for spend also cannot name systems for the Act. Do the inventory once. Use it for both. NanoBrief drafts a brief in under two minutes versus three-plus hours. Use it for the internal one-pager that kicks off the packet. Do not use it as the regulatory file.

Workshops in La Mesa are useful only after the table exists. A talk about the Act without a list of systems is a talk. Bring the engineer who added the key. Bring the person who answers procurement. Bring counsel if you have them. We will draft. We will not sign. Hosting and residency are available when a policy needs them. Azure, Amazon Web Services, Google Cloud, or the private infrastructure you already run. EU residency is a sentence we can put in scope. It is not a substitute for counsel.

Omnira Dental, Eviction Wizard, Nexuvo, and Helia are other public systems. They show how this studio treats queues and human gates. They are not your EU file. A dental group with EU-curious software still talks to healthcare counsel. A dealer group that also owns a software arm should keep Nexuvo and Protectron on separate calls. Professional services is the door if you are a firm that sells hours and the questionnaire landed on a partner.

Phone agents, HIPAA, and other gates

A California phone agent has a different packet: disclosure, recording, TCPA texts, and a transfer graph. That page is what an AI phone agent is allowed to say, book, and transfer in California. Do not file those sentences as EU Act artifacts unless counsel says the same system is in Act scope.

Dental and clinic agents that hear names and dates of birth need a written US path. Omnira Dental at omnira.dental is the public dental ops product. Coordinators still send. Clinicians still sign. Mixing a hygiene-recall queue with an Act file in one prompt is how you lose both owners.

Do not let an agent diagnose, quote an unapproved fee, or promise a legal outcome. Those refusals belong in the phone spec. They also belong in HumanGate on the inventory. The Act conversation and the California conversation can share a human gate without sharing a document title.

Quiet hours and Spanish transfer remain San Diego operating texture. They are not Brussels requirements. Keep them on the phone page.

How Nidrosoft handles this

Embed means we sit with the system list and the vendor exhibits, not with a slide about Europe. Diagnose costs the hours on questionnaires and the missing rows. Scope names Protectron, a custom inventory, training on your files, or a no if you wanted a legal opinion. Build happens in your tenant. Own names the person who updates the table when a vendor changes. The method is Embed, Diagnose, Scope, Build, Own.

Cyriac Zeh has 12+ years shipping products, 125 products shipped, and 16 public. He previously worked at Anthropic, Microsoft on Bing and Edge, Intuit, and Gap Inc. Public systems include Protectron, TokenTra, Nerlude, Omnira Dental, Eviction Wizard, Octana, and Guidera. Published results include TokenTra teams cutting 10-30% of wasted AI spend, Nexuvo dealers acquiring 3x more inventory with 80% less manual outreach, and NanoBrief briefs in under 2 minutes versus 3+ hours. Those figures are not an Act-approval claim.

We do not invent customer names, prices, or quotes. We do not classify your system as high-risk. How we work is the five steps. AI audits are two weeks in the work. Book a free audit if the questionnaire pile is the fire. Write cyriac@nidrosoft.com. The calendar is https://calendar.app.google/GCtfuTx3Ms6K7d579.

What counsel still owns

Classification, whether you are a provider or a deployer, whether a prohibition applies, whether a conformity assessment is required, and any filing stay with counsel. The studio will say no to “fully automate EU compliance.” The studio will say no to a model that tells a customer you are certified.

Local firms are public: Parsons AI, Applied Intelligence, SideGuy, San Diego AI under James Schlauch, AI Upside Group. Christian Johnston’s “Your AI Guy” phrase is his. Score the leftover. An EU desk at a global firm may be the right buy when the product is a high-risk system. This studio is the file and the build for a small or mid-size company that already knows the product.

The about page is the short studio version. The work archive is public systems. Do not ask for a confidential exporter case study this site will not invent.

This article will not list official EU journal citations as if they were your memo. Official text lives on EU sites. Your counsel will cite it. We will keep the table.

A questionnaire that asks whether you use “generative AI” is not a class. Answer with SystemName and Purpose. A questionnaire that asks for a risk score from a vendor blog is not counsel. Park it. A questionnaire that asks you to certify a model you do not control is a vendor exhibit problem. Write the vendor’s name and the date you last read their terms. Do not sign a sentence you cannot defend from the table.

San Diego companies next to biotech often mix a research notebook, a customer support summary, and a marketing site chatbot. Those are three rows. One Act memo that treats them as one system will fail the next German customer. Split the rows before you buy Protectron minutes.

Frequently asked questions

Is this legal advice for the EU AI Act?

No. It is an operations page about an inventory and a public artifact product. Confirm scope, class, and dates with counsel who knows your system.

Does Protectron file in Europe for us?

No. It produces artifacts. A person still signs. The studio does not file with an EU authority.

We have no EU customers. Do we still need a file?

Maybe not an Act file. Still list your systems. Sales can change. A one-page inventory is cheaper than a surprise questionnaire. Ask counsel if a vendor’s EU processing changes your story.

Can a model classify us as high-risk?

It can draft a description. Counsel classifies. A wrong self-class is worse than “not yet classified.”

How does this relate to token spend?

Different leftover. See the bill, then cut it, on the TokenTra page. See the systems, then draft artifacts, on this page. Same owner is fine. Same prompt is not.

Do you work with La Jolla and UTC teams?

The studio is San Diego. Those corridors are the common software texture. Remote is normal when accounts are reachable. Workshops have been run in La Mesa.

What should we bring if a German customer sent a questionnaire yesterday?

Bring the questionnaire, last quarter’s answers if they exist, the vendor list, and the name of the person who can grant org admin. We will map rows to questions. We will not invent a yes where the file says unknown.

Does EU residency of the model vendor finish the packet?

No. Residency is one sentence in a contract. Classification, purpose, and the human gate still need owners. Hosting can sit on Azure, Amazon Web Services, Google Cloud, or what you already run. Counsel still reads the Act.

Start with the system list you already have

Write the rows. Name the human gate. Ask sales about EU use. Bring counsel the table, not a slogan. Book a free audit if you want that inventory scored and a Protectron-shaped leftover named. Cyriac will say if the honest next step is counsel, seats, or a file in your tenant.