Buying an AI tool does not, by itself, tell you which EU AI Act duties apply. A company must assess each system and use case, identify its legal role (such as provider or deployer), classify the use, and then apply the obligations and deadlines for that category. The same company can be a deployer for one application, a provider for a system it substantially modifies and supplies onward, and a user of a general-purpose AI model in another project.
This practical guide reflects the European Commission’s implementation timeline and guidance available in October 2026. It is general information, not legal advice. The AI Act operates alongside data-protection, employment, consumer, product-safety, cybersecurity and sector-specific rules.
As an Amazon Associate I earn from qualifying purchases.
The dates companies need on their implementation plan
The AI Act entered into force on 1 August 2024, but its requirements are phased. The Commission’s current timeline reflects amendments agreed through the Digital Omnibus process; older articles that describe August 2026 as the universal high-risk deadline are out of date.
| Date | What starts to apply | What an adopting company should do |
|---|---|---|
| 2 February 2025 | General provisions, including AI literacy and prohibited practices | Put an AI-literacy programme in place and screen uses for prohibited practices. |
| 2 August 2025 | Governance rules and obligations for general-purpose AI (GPAI) models | Ask vendors for the documentation and information needed by downstream users; assess whether your own modification or distribution changes your role. |
| 2 August 2026 | Most remaining provisions, including Article 50 transparency rules; enforcement begins for applicable prohibitions, GPAI obligations, transparency requirements and AI literacy | Have notices, content-marking processes, contracts, training and monitoring ready for covered uses. |
| 2 December 2026 | Additional prohibitions concerning generation or manipulation of non-consensual intimate material and child sexual abuse material; a transition deadline for specified marking or detection obligations affecting systems already placed on the market before 2 August 2026 | Recheck content-generation controls and any transition arrangement relevant to systems already marketed. |
| 2 December 2027 | Rules for high-risk use cases listed in Annex III | Complete impact, oversight, data and incident controls for covered employment, education, infrastructure, biometric, migration and other listed uses. |
| 2 August 2028 | Rules for high-risk AI embedded in regulated products covered by Annex I | Coordinate with product manufacturers, conformity processes and sector regulators where AI is part of a regulated product. |
These are legal application dates, not recommended target dates. A company may need controls earlier to test them, meet contractual commitments or comply with other law. Confirm the latest Commission materials and national requirements before relying on a transition.
Start with an inventory, not a vendor list
A spreadsheet of subscriptions is not enough. Record each AI system together with the business activity in which it is used. A single tool can present different regulatory questions when used for drafting internal notes, ranking job applicants or controlling a safety-related process.
Minimum fields for each use case
- Tool, model or vendor name and the internal owner.
- Intended purpose, users and the process in which the output is used.
- People or groups affected, including employees, applicants, students, customers or members of the public.
- Input data, output type, retention, confidentiality and whether personal or sensitive data is involved.
- Whether a human merely edits an output or whether the output influences a decision, access, ranking or safety function.
- Whether your company changes, fine-tunes, combines or rebrands the system, or supplies it to another organization.
- Provider instructions, stated limitations, performance information, update process and available logs.
- Applicable transparency notices, human-review points, escalation contacts and suspension criteria.
This inventory is a practical governance record, not a universal form imposed by the Act. Keep the evidence that supports your classification and update it when the purpose, model, data or deployment context changes.
Determine your role before assigning obligations
The Act distinguishes the organizations that place systems or models on the market from those that use them. A model provider’s duties do not automatically become every customer’s duties. The legal text governs the relationship, so contracts and marketing labels cannot replace a role analysis.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Provider
You are closer to the provider role when your company develops an AI system, places it on the EU market or puts it into service under its name. Substantial modification, a new intended purpose or distribution of a system to other users can also change the analysis. If you are integrating a model into a product and offering that product to customers, document which component you control and what obligations attach to the resulting system.
Deployer
A deployer uses an AI system under its authority for a professional activity. Most companies buying a hosted assistant, screening application or analytics service will begin by assessing themselves as deployers for that use. Deployer duties depend on the system category and context; they are not a blanket checklist for every software subscription.
Rank #2
Other roles and shared responsibilities
Importers, distributors, product manufacturers and downstream providers can have different duties. Ask the vendor to identify its role, the model or system involved, the intended purpose and any restrictions on downstream use. Preserve the answer and test it against what your company actually does. A contract that calls you a “customer” does not settle the statutory classification if your conduct is different.
Classify the use: prohibited, transparency-related, high-risk or other
Classification follows the use and its effects, not a product badge. The Commission describes high-risk uses as a limited set with potential effects on health, safety or fundamental rights. Listed areas include employment, education, critical infrastructure, biometrics, migration, asylum and border control, but the legal tests and exceptions matter.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Screen for prohibited practices first
Before a pilot, check whether the intended behavior falls within a prohibition. The general prohibitions applied from 2 February 2025, with additional prohibitions concerning non-consensual intimate material and child sexual abuse material applying on 2 December 2026. Do not assume that a general-purpose tool is safe simply because the vendor offers it for business use; examine the specific feature and output.
Identify high-risk uses
Map the process to the relevant Annex III category and its conditions. For example, an AI feature used in recruitment or worker management requires a different analysis from an internal writing aid. A biometric categorisation or emotion-recognition feature may trigger specific transparency duties and, depending on the context, high-risk rules. The Commission’s high-risk materials reviewed for this guide describe draft guidance and examples, so record uncertainty and verify the latest finalized interpretation before deployment.
Do not treat “not high-risk” as “no rules”
A system outside the high-risk list can still be subject to Article 50 transparency, AI-literacy requirements, data-protection law, consumer rules, employment law or contractual controls. Classification determines which AI Act duties apply; it is not a general permission to use the system without governance.
AI literacy is an existing organizational duty
Article 4 applies to providers and deployers. Companies must take measures to support the AI literacy of staff and other people dealing with systems on the company’s behalf. The measures should reflect each person’s technical knowledge, experience, education and training, the system and its context, and the people or groups affected.
The amended rule does not prescribe one literacy level, certificate or course for every individual. A customer-service employee using a drafting assistant needs different instruction from an engineer supervising a safety-related model or a manager reviewing automated employment recommendations.
A proportionate training programme
- Explain the system’s intended purpose, known limitations, failure modes and prohibited uses.
- Show staff how to protect confidential and personal information and how to verify outputs.
- Define when a human must review, reject, correct or escalate an output.
- Give supervisors practical exercises using the actual workflow, not only generic AI theory.
- Keep attendance, role coverage, training content and refresh dates so you can demonstrate what measures were taken.
Review training after a material model update, a new use case, an incident or a change in the affected population.
Transparency duties from 2 August 2026
Article 50 does not mean that every AI-generated sentence must carry the same label. The duty depends on the interaction or content type. In covered cases, people generally must be told when they are directly interacting with an AI system unless that is obvious from the circumstances. Separate rules address synthetic or manipulated content and disclosures for users of emotion-recognition or biometric-categorisation systems, subject to statutory qualifications.
Build a transparency decision for each feature
- Identify whether a person is interacting directly with the system, receiving generated or manipulated content, or being subjected to emotion recognition or biometric categorisation.
- Check whether an exception or contextual qualification applies.
- Place the notice where the person encounters the interaction or content, using language they can understand.
- For generated media, preserve the technical or process evidence needed to apply the relevant marking or disclosure.
- Test the notice on web, mobile, API and downstream channels; a label that disappears when content is exported is not an effective control.
Commission guidance published on 20 July 2026 explains the scope for providers and deployers. Treat that guidance as implementation help while relying on the Regulation itself for the binding requirement.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
Operational controls for high-risk systems
When your company deploys a high-risk AI system, Article 26 requires operational controls rather than a one-time approval. The exact duties depend on the system and context.
Use according to instructions
Follow the provider’s instructions for intended purpose, operating conditions and limitations. If the business wants to repurpose the system, stop and reassess the role, classification and contractual permissions before changing the workflow.
Assign meaningful human oversight
The Act states: “Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.” Oversight must be real: appoint named people, give them access to relevant information, allow them to pause or override the system where appropriate, and protect them from performance targets that make review purely nominal.
Monitor, log and manage data
- Monitor operation and define thresholds that trigger investigation or suspension.
- Where you control input data, check that it is relevant and sufficiently representative for the intended purpose.
- Keep automatically generated logs under your control for an appropriate period of at least six months, unless applicable law provides otherwise.
- Record model updates, configuration changes, overrides, complaints and corrective actions.
Escalate risks and incidents
Notify the provider or relevant authorities when required, suspend use in specified circumstances and report serious incidents through the applicable route. Workplace, public-service and fundamental-rights assessment duties are conditional on the system, deployer and context; determine whether your use triggers them instead of assuming that every high-risk deployment has identical paperwork.
What GPAI obligations mean for a customer relationship
Providers of general-purpose AI models have model-level duties from 2 August 2025, including technical documentation, a copyright policy and a sufficiently detailed public summary of training content. Providers of models with systemic risk have additional duties such as notification, risk assessment and mitigation, incident reporting and cybersecurity protections. Commission enforcement powers for these obligations apply from 2 August 2026.
A company merely using a third-party AI product does not automatically inherit every model-provider obligation. It should, however, obtain enough information to operate lawfully and safely. Ask for the model’s intended capabilities and limitations, documentation for downstream providers, update and withdrawal notices, security contacts, incident procedures, content-marking support and restrictions on your use of outputs.
If you fine-tune a model, combine it with other components, place a system under your own name or distribute it onward, reassess whether you have become a downstream provider or taken on additional responsibilities.
Procurement questions that support compliance
Use the following comparison axes when evaluating tools. They are management criteria derived from the Act’s duties, not an official Commission scoring framework.
| Question | Evidence to request |
|---|---|
| What is the intended purpose? | Defined use cases, excluded uses, user roles and known limitations. |
| What role will each party have? | Provider, deployer or other role analysis, including treatment of modifications and onward distribution. |
| How is the system classified? | Reasoned assessment against prohibited, transparency, high-risk and other categories; do not rely on a marketing label. |
| Can we exercise oversight? | Human-review controls, override authority, monitoring tools, logs and support contacts. |
| What transparency functions exist? | Interaction notices, synthetic-content marking, biometric or emotion-recognition disclosures and export behavior. |
| What documentation is supplied? | Instructions, limitations, data requirements, update history, incident process and GPAI information where relevant. |
| How are data and security handled? | Confidentiality, retention, access controls, security measures and the separate data-protection analysis. |
| How will deadlines be met? | Vendor roadmap, change notifications, testing windows and support for the dates applicable to your use. |
A practical rollout sequence
- Inventory. Capture every AI-enabled feature, including embedded functions in ordinary business software.
- Assign ownership. Name a business owner, technical owner, legal or compliance contact and incident route.
- Determine role. Record whether the company deploys, provides, modifies, imports, distributes or manufactures.
- Classify. Screen prohibitions, Article 50 scenarios, high-risk categories and other applicable law.
- Set controls. Implement training, human oversight, data checks, notices, logging, monitoring and escalation proportionate to the use.
- Contract and test. Obtain provider documentation, test updates and failure cases, and verify that notices and logs survive real workflows.
- Approve and monitor. Set a go-live decision, review triggers and a process to suspend or retire the system.
Common mistakes and their fixes
- “The vendor said it is compliant.” Ask what role and use the statement covers, then perform your own use-case classification.
- “We only use AI internally, so the Act does not apply.” Internal employment, worker-management and other high-impact uses can still be regulated.
- “One annual course covers AI literacy.” Match instruction to the person’s role, system and affected people, and refresh it after meaningful changes.
- “We label every output the same way.” Article 50 has interaction- and content-specific duties and exceptions; design notices feature by feature.
- “High-risk controls can wait until August 2026.” The current dates place Annex III high-risk rules on 2 December 2027 and Annex I product rules on 2 August 2028, but testing, contracts and other laws may require earlier work.
- “A human is in the loop, so oversight is solved.” Oversight requires competence, training, authority and support, not a nominal click-through review.
What to verify before launch
Before approving a deployment, confirm that the inventory identifies the actual use, the role analysis matches the company’s conduct, the classification has a written rationale, staff know the system’s limits, transparency notices work in every channel, and high-risk controls are operational where applicable. Recheck the Commission’s latest guidance, national authority expectations and all other applicable law when the system, purpose or deadline changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
