Free consultation

Deployers under the AI Act: the obligations of companies that use AI

Edited by Solucom · 29 October 2026

Under the AI Act, the deployer is whoever uses an artificial intelligence system under their own authority, for a professional activity. A company that uses ChatGPT or Copilot for writing, a chatbot on its website, a CRM with AI features or software that pre-screens CVs is the deployer of each of those systems.

So almost every company already is one. The good news is that for most uses the obligations are few and concrete. The heavy ones only apply to high-risk systems, and the Digital Omnibus adopted in 2026 has moved their dates.

Here we explain who is a deployer, what they must already do today and what changes for high-risk systems. We cover the technical and operational side: for the legal assessment you need a lawyer.

Deployer or provider?

The AI Act distinguishes two main roles:

  • The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name;
  • The deployer uses it under its own authority. Only personal, non-professional use is excluded.

The same company can have both roles. If you build an internal tool that uses an AI model, for example an app that reads client documents and extracts the data, you are its provider even if only you use it, and its deployer at the same time.

You can also become a provider without meaning to, with a high-risk system, in three cases: if you put your name or trademark on it, if you substantially modify it, or if you change the intended purpose of a system so that it becomes high-risk. Using a general-purpose assistant to assess job candidates, for example, changes its purpose.

What every deployer must already do today

1. AI literacy

Since 2 February 2025, organisations using AI systems have had to look after the preparedness of the staff who use them. The Digital Omnibus (EU Regulation 2026/1744, in force since 27 July 2026) has rewritten the obligation in a lighter form. Providers and deployers take measures to support the AI literacy of their staff, taking into account skills and the context of use. The obligation does not require guaranteeing a specific level.

In practice this means a clear internal rule on what can and cannot be done with AI, plus short training for those who actually use it. It should be tailored to the role, and it is worth keeping a record.

2. Do not use AI for prohibited practices

Since the same date certain uses have been prohibited, whoever the provider is. For a company the most concrete case is emotion recognition in the workplace, allowed only for medical or safety reasons. The other prohibitions cover, among other things, manipulation, social scoring and certain forms of biometric identification.

3. Transparency towards people

Since 2 August 2026 the deployer has certain transparency obligations (Article 50):

  • if it publishes deepfakes, i.e. AI-generated or manipulated images, audio or video that appear authentic, it must disclose this;
  • if it publishes AI-generated text to inform the public on matters of public interest, it must disclose this, unless the text has been reviewed by a person who takes editorial responsibility for it;
  • if it uses emotion recognition or biometric categorisation systems, it must inform the people exposed to them.

The obligation to tell people they are talking to a chatbot falls instead on the provider of the chatbot. If you built the chatbot yourselves, you are the provider.

If the system is high-risk

High-risk systems include, among others, those used to recruit and evaluate staff, assess creditworthiness, decide access to education and essential services, and those acting as safety components of regulated products. The full list is in Annexes I and III of the regulation. In our article on the four risk levels we explain them with examples.

For these systems the deployer has additional obligations (Article 26):

  • use them in accordance with the instructions of the provider;
  • assign human oversight to people with sufficient competence, training and authority;
  • check that the input data it provides is relevant and representative;
  • monitor how they operate, report risks and incidents to the provider and the authorities, and suspend their use if necessary;
  • keep the logs generated by the system for at least six months, if they are under its control;
  • inform workers and their representatives before using them in the workplace;
  • inform the people about whom the system makes decisions, or helps to make them.

Public bodies, providers of public services and those using AI for creditworthiness or for life and health insurance must also carry out a fundamental rights impact assessment. After the Omnibus it can refer to the parts already covered by the data protection impact assessment (DPIA).

The dates have changed. The Digital Omnibus has moved the application of these obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems. Previously the date was 2 August 2026. The full calendar is in our article on the dates that matter.

What to do in practice

  1. Take stock of the AI tools you actually use, including those built into software you already have (CRM, management software, recruitment platforms). There are often more than you think. We cover this in what an AI system register should contain.
  2. Classify each use. Most are minimal or limited risk. Single out the cases that affect people: staff, credit, access to services.
  3. Write an internal rule of one page: which tools are allowed, which data must not be entered, who is responsible for what. Then run short training and keep a record of it.
  4. Label generated content that you publish when Article 50 requires it: deepfakes and unreviewed texts on matters of public interest.
  5. Check the roles in in-house or customised tools: if you built or modified them, you may be their provider.
  6. For high-risk systems, ask the provider for instructions for use, access to logs and guidance on human oversight. You have until December 2027, but contracts are being signed now.

Frequently Asked Questions

Who is the deployer under the AI Act?

It is the natural or legal person, including public bodies and authorities, that uses an AI system under its own authority, except for personal non-professional activity. A company that uses AI tools in its work is the deployer of those tools.

If I use ChatGPT at work, am I a deployer?

Yes. For general use, such as writing, summarising or translating, the main obligations are AI literacy for staff and, if you publish generated content, the transparency rules of Article 50. High-risk obligations only apply if you use it for a high-risk purpose, for example to assess job candidates.

When do the obligations for deployers of high-risk systems apply?

After the Digital Omnibus, from 2 December 2027 for Annex III systems (for example staff, credit, education) and from 2 August 2028 for Annex I systems, i.e. safety components of regulated products.

What is the difference between provider and deployer?

The provider develops the system and places it on the market or puts it into service under its own name. The deployer uses it. A company that builds an AI tool for internal use is both.

Does the deployer have to register anywhere?

Generally not. Registration in the EU database of high-risk systems concerns providers and, among deployers, public authorities and Union bodies.

Sources: Regulation (EU) 2024/1689 (AI Act), Articles 3, 4, 5, 25, 26, 27 and 50; Regulation (EU) 2026/1744 (Digital Omnibus on AI); European Commission AI Act Service Desk. Checked on 9 October 2026.

Do you want to know which AI tools you actually use, and with what obligations? We start with an audit of what is in the company, including the AI built into the software you already have. Find out more on our page AI Act.