You didn't build the AI. You still have obligations.

Most EU AI Act guidance is written for the companies that build AI systems. Most businesses don't build AI. They buy it — a support chatbot, a recruiting tool, a Copilot subscription, a transcription service — and use it on customers and staff. The Act has a name for that role, and its own set of duties for it. This guide covers those duties: which ones are already in force, which ones arrive later, and what to do about each.

Quick answer

• If you use AI in your business, you are most likely a "deployer" under the EU AI Act (Regulation (EU) 2024/1689). Deployers have their own obligations. Buying the tool from a vendor does not transfer them to the vendor.

• Already in force: the Article 5 list of prohibited practices and the Article 4 staff AI-literacy duty (both since 2 February 2025), and the Article 50 transparency duties (since 2 August 2026).

• Coming later: the heavier Article 26 duties for deployers of high-risk systems now apply from 2 December 2027 for standalone high-risk uses (Annex III) and 2 August 2028 for AI embedded in regulated products (Annex I). The 2026 Digital Omnibus moved those dates. It did not move the transparency duties.

• The Act reaches outside the EU. If your business is established in the EU, or your AI system's output is used in the EU, you can be in scope wherever your office is.

Deployer or provider: which one are you?

The Act splits the world into providers — organisations that develop an AI system or put it on the market under their own name — and deployers: any organisation "using an AI system under its authority," other than in a personal, non-professional capacity (Article 3(4)).

If your firm uses ChatGPT, a vendor's screening tool, or an AI feature inside your CRM, you are a deployer of those systems. The vendor carries the provider duties: building the system lawfully, documenting it, and giving you instructions for use. Your duties are about how the system is used inside your organisation — and they stay yours even though you bought the tool off the shelf.

One caution: the line can move. Put your own name on a high-risk system, substantially modify one, or repurpose a tool into a high-risk use, and the Act can treat you as the provider of that system, with the provider's much heavier obligations.

What applies to deployers now

The prohibited list (Article 5, since February 2025)

A short list of practices is banned outright — including social scoring of individuals, manipulative or deceptive techniques that distort behaviour and cause harm, and certain biometric uses. Most ordinary business tools are nowhere near this list, but it is worth one check against what you actually run, because breaches sit in the Act's highest penalty tier.

AI literacy (Article 4, since February 2025)

Providers and deployers must take measures to ensure their staff have a sufficient level of AI literacy — enough understanding of what the tools do, where they can go wrong, and when a human needs to step in. The 2026 Omnibus softened the wording of this duty; it is a measures-and-training obligation, not an exam. In practice: a short internal briefing, written down, repeated when tools change.

Transparency (Article 50, since August 2026)

If people interact with your AI, or consume content it generated, they generally have to be told. The duties are specific — chatbots, AI-generated content marking, and disclosure of deepfakes and AI-written public-interest text — and they have applied since 2 August 2026. This is the obligation most likely to touch an ordinary business today, and it is covered in full in our guide to AI disclosure requirements.

What's coming: Article 26 duties for high-risk use

The substantial deployer regime concerns high-risk systems — a defined list (Annex III) covering areas such as recruitment and worker management, creditworthiness checks, education access, and essential services. A support chatbot or a marketing copy tool is not, by itself, high-risk. If you do deploy a high-risk system, Article 26 will require you to:

• Use the system as instructed. Follow the provider's instructions for use, and be able to show you did.

• Assign human oversight. Named people with the competence, training and authority to intervene — not a mailbox.

• Control your inputs. Where you supply the data the system works on, it must be relevant and sufficiently representative for the intended purpose.

• Monitor and act. Watch how the system performs; if it presents a risk, tell the provider and the market surveillance authority, suspend use where needed, and report serious incidents.

• Keep the logs. Retain the system's automatically generated logs that are under your control for at least six months.

• Tell your workers. Before a high-risk system goes into service in the workplace, inform workers and their representatives.

• Tell affected people. Inform individuals when a high-risk system is used to make or assist decisions about them.

• Cooperate with competent authorities on request.

Some deployers also owe a fundamental rights impact assessment (Article 27) before first use: public bodies, private entities providing public services, and any deployer using AI for creditworthiness evaluation or for risk assessment and pricing in life and health insurance. Ordinary private companies in other sectors are not in that group, though their Article 26 duties still apply.

These duties now start on 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The later date is preparation time, not a reason to wait: the records, oversight arrangements and vendor paperwork Article 26 assumes take months to put in place, and enterprise customers are already asking for them in procurement.

Penalties, in proportion

Article 99 sets ceilings; Member States set the actual fines within them. Breaching the Article 5 prohibitions can be fined up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most other breaches — including the Article 26 deployer duties and the Article 50 transparency duties — sit at up to €15 million or 3%. Supplying incorrect or misleading information to authorities is up to €7.5 million or 1%.

For small and medium-sized enterprises, including start-ups, each ceiling is the lower of the fixed amount and the percentage — the reverse of the general rule. Fines also have to be proportionate to the case. The realistic exposure for a small deployer is not the headline number; it is a finding, a deadline, and a customer who asks what you fixed.

A practical order of work

1. List what you use. Every AI tool, feature and agent in the business, who owns it, and what it touches. You cannot classify what you have not listed.

2. Classify each use. Prohibited? High-risk under Annex III? Transparency duties under Article 50? Or none of the three — most tools land here, and the list is your evidence.

3. Cover the live duties first. Article 50 disclosures and Article 4 staff literacy are in force now.

4. Write the rules down. A short AI use policy: approved tools, data that must never be entered, where disclosure is required, who is responsible for AI-assisted decisions.

5. Prepare the high-risk file, if you have one. Oversight names, log retention, worker and customer notices, vendor instructions on file — ahead of December 2027, not during it.

Steps 2–4 are the same ground the Ethicality AI Use Standard (EAUS) assesses: disclosed AI use, a human responsible for important decisions, and confidential information kept out of tools that shouldn't hold it. If you want a starting measurement before you write anything, the free self-assessment takes about two minutes.

Frequently asked questions

We're not in the EU. Does any of this apply to us?

It can. The Act covers deployers established in the EU, and also providers and deployers elsewhere whose AI system's output is used in the EU. A Canadian or US firm whose tool screens EU applicants, or whose AI-generated content is published for an EU audience, should work through the same classification exercise. Our companion piece covers the EU AI Act for Canadian companies in more detail.

We only use our vendor's tool. Isn't compliance their problem?

Partly — the vendor carries the provider duties for the system itself. The deployer duties in Articles 4, 26 and 50 attach to your use of it: your disclosures, your oversight, your inputs, your logs. A contract clause does not move a statutory duty.

Is a normal chatbot high-risk?

No. A customer-service chatbot is a transparency case (Article 50), not a high-risk one. High-risk is a closed list — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice — and the use has to fall within it.

What does the December 2027 date change for us today?

Nothing about the duties that are already live: prohibitions, literacy and transparency. It changed only the start date for the high-risk provider and deployer obligations, from August 2026 to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Does getting certified make us compliant with the EU AI Act?

No, and be wary of anyone who says otherwise. Certification against a standard like EAUS is evidence that your working practices — disclosure, human accountability, data handling — are in place and independently checked. The legal duties remain yours. The two fit together: the Act sets the floor; certification shows your customers you meet a published standard above it.

Where to start

The classification exercise is the whole game: most businesses find they have one or two live duties, not twenty. Run the free readiness check to see where your current practices stand, or apply for certification if your rules are already written down — the assessment is free, and you pay only if you pass.