EU AI Act obligations: what companies using AI must do

Talk of the European regulation on artificial intelligence quickly prompts a familiar reaction: we don’t develop AI, we only use it, so it doesn’t apply to us. That is not accurate. The AI Act, formally Regulation (EU) 2024/1689 (the Artificial Intelligence Act), divides obligations between those who develop AI systems and those who use them. Users have fewer obligations, but they are not exempt.

Illustrative example: the same language model might write the newsletter in one company, where AI literacy is the main requirement, and screen job applicants in another, where the strict regime for high-risk systems may apply from 2 December 2027. That is because EU AI Act obligations depend not on the tool, but on the company’s role and the purpose for which AI is used. This article reflects the position as verified on 16 September 2026 and is not legal advice on any specific case.

Why “we don’t develop AI” does not mean “it doesn’t apply to us”

The first source of confusion lies in the rules for general-purpose AI models, the large models on which applications such as ChatGPT are built. Those rules apply to model providers. However, according to the Commission, anyone who integrates a model into their own AI system, such as a customer chatbot under their own brand, must comply with the relevant obligations for AI systems.

The second is an overlooked definition. A deployer is any person or organisation using an AI system under its authority, except in the course of a personal non-professional activity. As a rule, that includes a company whose employees use AI at work. This is a common situation: according to Eurostat, of EU enterprises with 10 or more employees outside the financial sector that used AI in 2024, almost 58% used ready-to-use commercial software and just under 22% used AI developed by their own employees.

What applies as of 16 September 2026, and from which date

The AI Act entered into force on 1 August 2024 and applies in stages. The timetable and some obligations were amended by Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, which has been in force since 27 July 2026. This is not a proposal but adopted law that is already in force. Key dates for companies:

2 February 2025: prohibitions on unacceptable practices and AI literacy, the latter in a softened form since 27 July 2026.
2 August 2025: rules for providers of general-purpose AI models.
2 August 2026: transparency rules and the start of enforcement of the Act by member state authorities and the Commission’s AI Office.
2 December 2026: new prohibitions on AI that generates child sexual abuse material, or intimate or sexually explicit content depicting an identifiable person without their consent, and the end of the transitional period for machine-readable marking of content by generative systems placed on the market before 2 August 2026.
2 December 2027: rules for high-risk systems in the sensitive areas listed in Annex III, such as recruitment or creditworthiness assessment.
2 August 2028: rules for high-risk systems in regulated products covered by Annex I.

Do not confuse the Digital Omnibus on AI with the separate Digital Omnibus Regulation proposal on data, the GDPR and cookies, which, according to the European Parliament, was still only at the proposal stage as of 1 August 2026 and therefore imposes no obligations on companies. At national level, oversight lies with the market surveillance authorities designated by each member state, and the national implementing rules differ from country to country, so check the current arrangements in the countries where you operate.

Provider, deployer and when the roles switch

A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. Illustrative example: the developer of a CV screening tool is the provider, and a business that subscribes to the tool is the deployer.

Your role, however, is not determined by the contract alone, but above all by what you do with the AI. Under Article 25, you also become the provider of a high-risk system if you put your name or trademark on it, make a substantial modification to it, or change the intended purpose of another system, including a general-purpose AI system, in such a way that it becomes high-risk. Illustrative example: the HR department starts systematically using a general-purpose chatbot to assess job applicants, which may put the company in the role of provider.

The four risk levels, with examples

EU AI Act obligations also depend on which of the four risk levels a specific use falls into.

Unacceptable risk, meaning prohibited practices. For example, inferring people’s emotions in the workplace is prohibited, except for medical or safety reasons. Illustrative example: a call centre deploys an add-on that assesses agents’ emotions from their voices.
High risk. A high-risk AI system can significantly affect people’s health, safety or fundamental rights. This includes, for example, AI used for recruitment, for allocating tasks based on behaviour or personal traits, for evaluating employee performance or for assessing the creditworthiness of natural persons. An exception may apply, for instance, to a narrowly defined procedural or preparatory task that poses no significant risk, but never to the profiling of natural persons. Illustrative example: an online shop uses AI to assess the creditworthiness of customers to whom it offers payment in instalments.
Transparency risk. In specified cases, people must be told that they are dealing with AI. Illustrative example: a corporate video in which AI imitates the managing director’s face and voice.
Minimal risk. The Act does not introduce specific rules for this category, although AI literacy applies here too. According to the Commission, the vast majority of AI systems used in the EU fall into this category, spam filters being one example.

What a typical company has to do

AI literacy: a duty to support, not to certify

AI literacy means the skills, knowledge and understanding needed to use AI in an informed way. Under Article 4, as amended with effect from 27 July 2026, providers and deployers “shall take measures to support the development of AI literacy” of their staff and other persons using AI on their behalf, without being required to guarantee any specific level. According to the Commission, this also applies to a company whose staff use ChatGPT to write advertising copy, and employees should be aware of, for example, the risk of hallucinations, meaning false outputs presented convincingly. This is not a mere formality: in a global survey by KPMG and the University of Melbourne, 66% of employees who use AI said they rely on its output without checking it, and 56% had made mistakes at work because of AI. According to the Commission, neither a certificate nor a role such as an AI officer is required, and a company can keep internal records of training.

Transparency towards people

The rules under Article 50 have applied since 2 August 2026. For chatbots, it is the provider that must ensure people are informed they are dealing with AI, so if you have bought a ready-made solution, check this with your supplier; if the chatbot is built under your own brand, the obligation is yours. A deployer must inform people exposed to emotion recognition or biometric categorisation and must label deep fakes, meaning AI-generated image, audio or video content that imitates real people or events and could pass as genuine. If AI generates or edits text published to inform the public on matters of public interest, this must be disclosed, unless the text has undergone human review or editorial control and someone holds editorial responsibility for its publication.

High-risk systems: recruitment and credit

For the high-risk systems listed in Annex III, the deployer obligations under Articles 26 and 27 apply from 2 December 2027. They apply to systems placed on the market or put into service before that date only once those systems undergo significant changes in their design. In particular, a deployer must:

use the system in accordance with the instructions for use and assign human oversight to people with the necessary competence and authority;
where it has control over the input data, ensure that the data is relevant and representative;
monitor the system’s operation, inform the provider and the market surveillance authority and suspend use if a risk arises, and report any serious incident;
keep the automatically generated logs under its control for at least six months, unless specific legislation provides otherwise;
inform workers’ representatives and the affected workers before putting the system into use in the workplace;
inform the people about whom the system makes decisions or helps to make decisions;
where the system is used to assess the creditworthiness of natural persons or for risk assessment and pricing in life and health insurance, or where the company provides public services, carry out a fundamental rights impact assessment before putting the system into use, meaning an analysis of the potential harm to people, and notify the market surveillance authority of the results.

Where the AI Act meets the GDPR

The AI Act does not replace the GDPR: if a system processes personal data, both regulations apply. Under the amended Article 27, the deployer of a high-risk system may, in its fundamental rights impact assessment, refer to the data protection impact assessment or reuse the parts of it through which it has already met its obligations. There is therefore no need to carry out the same analysis twice.

With everyday tools, keep an eye on inputs too: in the KPMG survey mentioned above, almost half of employees admitted using AI in ways that breach company policies, including uploading sensitive company information to free public tools. We discuss how to set permissions and limit the data sent to models in the article AI in business without chaos.

Penalties: caps, not fixed rates

Maximum fines are set in three tiers, and as a rule the higher of the two amounts applies:

breaches of the prohibitions: up to EUR 35 million or 7% of total worldwide annual turnover;
breaches of other obligations, such as those of deployers under Article 26 or the transparency obligations under Article 50: up to EUR 15 million or 3%;
supplying incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1%.

For small and medium-sized enterprises (SMEs), the lower of the two amounts applies, and in the second and third tiers this also holds for small mid-cap enterprises that are no longer SMEs. The Omnibus did not change the level of the caps. The amount of a specific fine is decided by the authority based on the circumstances, such as the gravity and duration of the infringement, the size of the company and its cooperation with the authorities (Article 99(7)). The Act does not set fine levels for AI literacy; penalties will be laid down in national law and, according to the Commission, are more likely where an incident occurs because of inadequate training.

A practical approach in four steps

Where the risk is minimal, you do not need specialist software or a major project; a spreadsheet, clear rules and a short training session are often enough. Initial guidance is available from the European Commission’s AI Act Service Desk and, according to the Commission, SMEs can also turn to the European Digital Innovation Hubs.

Inventory, including shadow AI. Shadow AI is the use of AI tools without the company’s knowledge or approval. The AI Act does not use this term, but shadow AI belongs in the inventory just as much as the AI features in software you already have. As 57% of employees who use AI said in the KPMG survey that they hide their use of it, an anonymous questionnaire can help. Retire tools you do not need before you start documenting them; we explain why AI should not speed up unnecessary steps in the article AI will not fix a broken process.
Classification and records. For each use, determine the role and risk level and record the purpose, the date of the assessment and the person responsible; otherwise the inventory will quickly go out of date. Switch off prohibited uses immediately and have high-risk ones assessed in detail.
Rules and training. Set out the approved tools, the data that must not be entered, and the situations in which output must be checked or labelled. Tailor training to each role and keep a record of it.
Supplier checks. Establish the system’s intended purpose, whether the supplier considers it high-risk, what instructions for use it will provide, and how it handles informing people and labelling content. Reflect the answers in the contract.

Key takeaways

If your company uses AI, you are generally a deployer, and some EU AI Act obligations already apply to you today, above all AI literacy and, in specified cases, transparency.
The scope of your obligations is determined by your role and the purpose of use, not by the brand of the tool. Your own brand, a substantial modification or a new purpose can turn a user into a provider.
Obligations for recruitment or creditworthiness assessment apply from 2 December 2027, but it pays to prepare your inventory, rules and training now, as AI literacy has applied since 2 February 2025.
Before you buy a compliance tool, find out what you actually use and for what purpose.
The position was verified as of 16 September 2026, so check the deadlines and the national supervisory arrangements that apply to you before making any decisions.