{"id":396,"date":"2026-10-29T09:00:00","date_gmt":"2026-10-29T08:00:00","guid":{"rendered":"https:\/\/solucom.si\/?p=396"},"modified":"2026-10-10T00:42:39","modified_gmt":"2026-10-09T22:42:39","slug":"deployer-ai-act-obligations","status":"publish","type":"post","link":"https:\/\/solucom.si\/en\/deployer-ai-act-obblighi\/","title":{"rendered":"Deployers under the AI Act: the obligations of companies that use AI"},"content":{"rendered":"<p><strong>Under the AI Act, the deployer is whoever uses an artificial intelligence system under their own authority, for a professional activity.<\/strong> A company that uses ChatGPT or Copilot for writing, a chatbot on its website, a CRM with AI features or software that pre-screens CVs is the deployer of each of those systems.<\/p>\n<p>So almost every company already is one. The good news is that for most uses the obligations are few and concrete. The heavy ones only apply to high-risk systems, and the Digital Omnibus adopted in 2026 has moved their dates.<\/p>\n<p>Here we explain who is a deployer, what they must already do today and what changes for high-risk systems. We cover the technical and operational side: for the legal assessment you need a lawyer.<\/p>\n<h2>Deployer or provider?<\/h2>\n<p>The AI Act distinguishes two main roles:<\/p>\n<ul>\n<li><strong>The provider<\/strong> develops an AI system, or has it developed, and places it on the market or puts it into service under its own name;<\/li>\n<li><strong>The deployer<\/strong> uses it under its own authority. Only personal, non-professional use is excluded.<\/li>\n<\/ul>\n<p>The same company can have both roles. If you build an internal tool that uses an AI model, for example an app that reads client documents and extracts the data, you are its provider even if only you use it, and its deployer at the same time.<\/p>\n<p>You can also become a provider without meaning to, with a high-risk system, in three cases: if you put your name or trademark on it, if you substantially modify it, or if you change the intended purpose of a system so that it becomes high-risk. Using a general-purpose assistant to assess job candidates, for example, changes its purpose.<\/p>\n<h2>What every deployer must already do today<\/h2>\n<h3>1. AI literacy<\/h3>\n<p>Since 2 February 2025, organisations using AI systems have had to look after the preparedness of the staff who use them. The Digital Omnibus (EU Regulation 2026\/1744, in force since 27 July 2026) has rewritten the obligation in a lighter form. Providers and deployers <strong>take measures to support<\/strong> the AI literacy of their staff, taking into account skills and the context of use. The obligation does not require guaranteeing a specific level.<\/p>\n<p>In practice this means a clear internal rule on what can and cannot be done with AI, plus short training for those who actually use it. It should be tailored to the role, and it is worth keeping a record.<\/p>\n<h3>2. Do not use AI for prohibited practices<\/h3>\n<p>Since the same date certain uses have been prohibited, whoever the provider is. For a company the most concrete case is <strong>emotion recognition in the workplace<\/strong>, allowed only for medical or safety reasons. The other prohibitions cover, among other things, manipulation, social scoring and certain forms of biometric identification.<\/p>\n<h3>3. Transparency towards people<\/h3>\n<p>Since 2 August 2026 the deployer has certain transparency obligations (Article 50):<\/p>\n<ul>\n<li>if it publishes <strong>deepfakes<\/strong>, i.e. AI-generated or manipulated images, audio or video that appear authentic, it must disclose this;<\/li>\n<li>if it publishes <strong>AI-generated text to inform the public on matters of public interest<\/strong>, it must disclose this, unless the text has been reviewed by a person who takes editorial responsibility for it;<\/li>\n<li>if it uses <strong>emotion recognition or biometric categorisation systems<\/strong>, it must inform the people exposed to them.<\/li>\n<\/ul>\n<p>The obligation to tell people they are talking to a chatbot falls instead on the provider of the chatbot. If you built the chatbot yourselves, you are the provider.<\/p>\n<h2>If the system is high-risk<\/h2>\n<p>High-risk systems include, among others, those used to <strong>recruit and evaluate staff<\/strong>, assess <strong>creditworthiness<\/strong>, decide access to <strong>education and essential services<\/strong>, and those acting as safety components of regulated products. The full list is in Annexes I and III of the regulation. In our article on the <a href=\"\/en\/ais-four-levels-of-risk\/\">four risk levels<\/a> we explain them with examples.<\/p>\n<p>For these systems the deployer has additional obligations (Article 26):<\/p>\n<ul>\n<li>use them <strong>in accordance with the instructions<\/strong> of the provider;<\/li>\n<li>assign <strong>human oversight<\/strong> to people with sufficient competence, training and authority;<\/li>\n<li>check that the <strong>input data<\/strong> it provides is relevant and representative;<\/li>\n<li><strong>monitor how they operate<\/strong>, report risks and incidents to the provider and the authorities, and suspend their use if necessary;<\/li>\n<li><strong>keep the logs<\/strong> generated by the system for at least six months, if they are under its control;<\/li>\n<li><strong>inform workers<\/strong> and their representatives before using them in the workplace;<\/li>\n<li><strong>inform the people<\/strong> about whom the system makes decisions, or helps to make them.<\/li>\n<\/ul>\n<p>Public bodies, providers of public services and those using AI for creditworthiness or for life and health insurance must also carry out a <strong>fundamental rights impact assessment<\/strong>. After the Omnibus it can refer to the parts already covered by the data protection impact assessment (DPIA).<\/p>\n<p><strong>The dates have changed.<\/strong> The Digital Omnibus has moved the application of these obligations to <strong>2 December 2027<\/strong> for Annex III systems and to <strong>2 August 2028<\/strong> for Annex I systems. Previously the date was 2 August 2026. The full calendar is in our article on the <a href=\"\/en\/ai-act-dates-that-matter\/\">dates that matter<\/a>.<\/p>\n<h2>What to do in practice<\/h2>\n<ol>\n<li><strong>Take stock<\/strong> of the AI tools you actually use, including those built into software you already have (CRM, management software, recruitment platforms). There are often more than you think. We cover this in <a href=\"\/en\/registration-for-ai-compliance-with-acts-containing-what\/\">what an AI system register should contain<\/a>.<\/li>\n<li><strong>Classify each use.<\/strong> Most are minimal or limited risk. Single out the cases that affect people: staff, credit, access to services.<\/li>\n<li><strong>Write an internal rule<\/strong> of one page: which tools are allowed, which data must not be entered, who is responsible for what. Then run short training and keep a record of it.<\/li>\n<li><strong>Label generated content<\/strong> that you publish when Article 50 requires it: deepfakes and unreviewed texts on matters of public interest.<\/li>\n<li><strong>Check the roles<\/strong> in in-house or customised tools: if you built or modified them, you may be their provider.<\/li>\n<li><strong>For high-risk systems<\/strong>, ask the provider for instructions for use, access to logs and guidance on human oversight. You have until December 2027, but contracts are being signed now.<\/li>\n<\/ol>\n<h2>Frequently Asked Questions<\/h2>\n\n\n\n<p class=\"sol-fonti\"><small><strong>Sources:<\/strong> <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/IT\/TXT\/?uri=CELEX:32024R1689\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2024\/1689 (AI Act)<\/a>, Articles 3, 4, 5, 25, 26, 27 and 50; <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/IT\/TXT\/HTML\/?uri=OJ:L_202601744\" target=\"_blank\" rel=\"noopener\">Regulation (EU) 2026\/1744 (Digital Omnibus on AI)<\/a>; <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-26\" target=\"_blank\" rel=\"noopener\">European Commission AI Act Service Desk<\/a>. Checked on 9 October 2026.<\/small><\/p>\n<p><strong>Do you want to know which AI tools you actually use, and with what obligations?<\/strong> We start with an audit of what is in the company, including the AI built into the software you already have. Find out more on our page <a href=\"\/en\/ai-act\/\">AI Act<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>Chi \u00e8 il deployer nell&#8217;AI Act, quali obblighi ha gi\u00e0 oggi e cosa cambia per i sistemi ad alto rischio dopo il Digital Omnibus.<\/p>","protected":false},"author":1,"featured_media":395,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"Deployer AI Act: gli obblighi di chi usa l'AI in azienda","_seopress_titles_desc":"Chi \u00e8 il deployer nell'AI Act, quali obblighi ha gi\u00e0 oggi, cosa cambia per i sistemi ad alto rischio dopo il Digital Omnibus e cosa fare in pratica.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"categories":[15],"tags":[],"class_list":["post-396","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-contenuti-ai-act-compliance"],"_links":{"self":[{"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/posts\/396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/comments?post=396"}],"version-history":[{"count":1,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/posts\/396\/revisions"}],"predecessor-version":[{"id":403,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/posts\/396\/revisions\/403"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/media\/395"}],"wp:attachment":[{"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/media?parent=396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/categories?post=396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solucom.si\/en\/wp-json\/wp\/v2\/tags?post=396"}],"curies":[{"name":"WP","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}