If you are building AI for the European market, where your retrieval happens and how it treats sources are compliance questions, not just engineering ones. ODEN is built to be the retrieval layer a European AI application can defend in a review.
Not legal advice. This page explains how ODEN is built. Your obligations depend on your application; consult a qualified advisor for your specific case.
EU-hosted by default#
ODEN runs on Cloudflare's infrastructure and is operated from Sweden. It is EU-native rather than a US service with an EU region added on, which simplifies the data-transfer story for European teams under GDPR.
Honors the TDM opt-out at the source#
The EU DSM Directive (Article 4) lets rights holders reserve their works from text-and-data mining with a machine-readable opt-out. Many retrieval APIs ignore this. ODEN checks robots.txt and the machine-readable TDM opt-out before a page is read, and skips sources that have opted out. Compliance is enforced at crawl time, not promised in a policy.
Citations, not reproduction#
ODEN returns citations as metadata — title, URL, relevance score, and at most one attributed sentence per source — rather than reproducing full article text. Your application gets attributable links to verify against, without redistributing source content.
How it can support an AI Act review#
The EU AI Act applies different duties according to the system, provider, deployer, and use case. ODEN can contribute technical evidence to a wider review:
- Traceable answers. Every response carries the sources behind it, so your system can show its provenance.
- Respecting opt-outs. Using a retrieval layer that honors TDM reservations is part of a defensible data-sourcing story.
- Data minimisation. ODEN keeps only minimal, short-lived operational data; the website uses cookieless analytics with no third-party trackers. See the privacy policy.
Practical transparency checklist#
The exact legal duties depend on the AI system and how it is deployed. Independently of that classification, teams can improve reviewability by:
- telling users when they are interacting with an AI system where required;
- preserving source URLs and retrieval timestamps for important outputs;
- separating operational identifiers from sensitive prompt content;
- documenting how robots.txt and supported TDM reservation signals are handled;
- defining when a human must review an answer before it is published or acted upon.
Compliance verification workflow#
To verify your retrieval pipeline's compliance status during internal architecture reviews:
- Verify that OdenBot user-agent headers are transparent and unmasked.
- Confirm that pages containing
X-Robots-Tag: noaiortdm-reservation: 1return 403 or are excluded from retrieval sets. - Validate that your application displays citation attribution links directly to end users.
What ODEN does not do#
ODEN is a retrieval tool, not a model provider or a compliance product. It does not classify your AI system's risk level, generate documentation, or make you compliant on its own. It is one well-behaved building block: an EU-hosted, opt-out-respecting, citation-returning search layer.
FAQ#
Is ODEN GDPR-compliant?#
ODEN processes queries only to fulfil requests and keeps minimal, short-lived operational data, hosted in the EU, with no third-party trackers. See the privacy policy for the field-by-field detail.
Does ODEN respect the TDM opt-out?#
Yes. It checks robots.txt and the machine-readable TDM opt-out (DSM Article 4) before reading a page, and skips sources that have reserved their rights.
Where is ODEN hosted?#
On Cloudflare's infrastructure, operated from Sweden. It is EU-native. See about.
Does using ODEN make my AI system EU AI Act compliant?#
No single tool does that. ODEN provides retrieval controls and traceable source links that may support transparency work; your obligations depend on your system, role, and use case.