Code may not be, but opening a Merge Request undercover may be unlawful:

> Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system

Then in that case you wouldn't be a provider. You are at best a deployer, and even then the definition doesn't exactly match using AI services.

That should be obvious considering an MR is not providing AI services.

That merge request would be AI generated content. You wouldn't be interacting directly with the AI system that opened it.

Depends if it's a closed loop agent. If the agent opens the request, writes the body and is triggered by an answer on the MR, then I'd expect the law to cover this.

What AI service are you providing with said MR?

Good question. Actually, i was assuming that at least source code is treated as text under the legal regime (there is typically special rules in copyright law, but provision applying to text should apply). Furthermore I would think pull requests, etc are all text. So I would think this applies.

But it's not just text. Once again, it's explicitly defined as:

> which is published with the purpose of informing the public on matters of public interest

There is no "informing public on matters of public interest" in source code nor an MR. It's clearly meant to prevent "deepfake" news, like the image and video ones explicitly call that out.

You are absolutely right. However, the recitals point clearly beyond only protection against fake news. IMHO running such an agent in stealth mode can easily be illegal, Articl 50 (1) states : > Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use.

But you aren't a provider of AI services by using AI. There's a clear difference already called out between "provider" and "deployer". An AI user could barely be called a "deployer" as is, let alone a "provider".

In other words, what AI service are you providing by creating a PR?

I would argue that the person reading an AI generated pull request is if there is no human oversight with an Ai. And are you sure that you get out of this definition (at least as a company):

> provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

I would argue that an MR does none of those things.