EU AI Act: Which obligations apply to companies that only use AI?

Many companies assume that the EU AI Act only affects businesses that develop AI themselves. That is a mistake. The AI Act distinguishes between providers, who develop AI systems and place them on the market, and deployers, who use AI systems under their own authority. Anyone in a company who uses ChatGPT, Microsoft Copilot, an AI-powered recruiting tool or their own chatbot is a deployer – and therefore has obligations of their own.

In July 2026, the so-called Digital Omnibus also came into force, postponing some deadlines and adjusting obligations. This article summarises the current status for companies that use AI but do not develop it themselves.

Provider or deployer? The decisive question

Which obligations apply to you depends first on your role. A provider is anyone who develops an AI system (or has one developed) and places it on the market under their own name. A deployer is anyone who uses an AI system professionally under their own authority. Most mid-sized companies are deployers: they license an AI application or use a cloud service and integrate it into their processes.

The role is determined per AI system. A company can be a deployer of a purchased AI assistant and a provider of a chatbot it has developed itself for its website.

The timeline after the Digital Omnibus

The AI Act entered into force on 01.08.2024 and becomes applicable step by step. Regulation (EU) 2026/1744, the Digital Omnibus, postponed the deadlines for high-risk AI because the necessary technical standards were not yet ready. For deployers, this means:

• 02.02.2025: prohibited AI practices and the AI literacy obligation
• 02.08.2026: transparency obligations under Art. 50 and penalty provisions
• 02.12.2026: end of the transition period for machine-readable marking of AI-generated content for systems already on the market; ban on AI used to generate non-consensual intimate content
• 02.12.2027: obligations for high-risk AI under Annex III, e.g. employment, creditworthiness, education
• 02.08.2028: obligations for high-risk AI in regulated products under Annex I, e.g. machinery or medical devices

Obligation 1: AI literacy – applies to everyone

Article 4 requires providers and deployers to promote the AI literacy of their staff – regardless of how risky the AI in use is. Anyone who gives employees access to ChatGPT or Copilot is therefore affected.

The Digital Omnibus has softened this obligation: originally, companies had to ensure, to their best extent, a sufficient level of AI literacy. Now they must take measures to support the development of AI literacy – a specific level of competence for each individual no longer has to be guaranteed. An obligation of result has become an obligation of effort. Doing nothing is still not an option: you should be able to show that you have taken appropriate measures.

What is appropriate depends on who uses AI for what. For most companies, a combination of the following works well:

• a short introductory training on how AI works, its limits and risks – not as a one-off compulsory programme, but as a starting point
• an internal AI policy: which tools are allowed and which data may be entered?
• in-depth training for teams that use AI for important decisions or with sensitive data
• simple documentation of who was trained and when

Obligation 2: Avoid prohibited AI practices

Since 02.02.2025, certain AI applications have been prohibited in the EU (Art. 5). Particularly relevant for companies are:

• emotion recognition in the workplace and in educational institutions – except for medical or safety reasons
• biometric categorisation to infer sensitive characteristics such as political opinions, religion or sexual orientation
• social scoring, i.e. evaluating people based on their social behaviour with detrimental consequences in other contexts
• manipulative techniques that lead people to harmful decisions
• untargeted scraping of facial images from the internet or video footage to build facial recognition databases

From 02.12.2026, a ban on AI systems that generate non-consensual intimate content or child sexual abuse material will be added. For most companies, this mainly means checking whether the tools they use – for example for employee or customer analysis – contain such functions.

Obligation 3: Transparency for AI-generated content

The transparency obligations under Article 50 have applied since 02.08.2026. Deployers must disclose when they:

• create deepfakes, i.e. AI-generated or manipulated images, audio or video that appear real
• publish AI-generated text intended to inform the public on matters of public interest – unless a human has reviewed the text and holds editorial responsibility
• use emotion recognition or biometric categorisation, where this is permitted at all

Anyone running a chatbot on their website should also take a close look: people must be able to recognise that they are communicating with an AI. This obligation is addressed to the provider – and if a company builds the chatbot itself, that is exactly what it is.

Obligation 4: High-risk AI – only in certain cases

The most extensive obligations concern high-risk AI systems. For deployers in mid-sized companies, the following areas from Annex III are particularly relevant:

• Employment: AI for screening applications, evaluating candidates, decisions on promotion or dismissal, allocating tasks based on behaviour or monitoring performance
• Creditworthiness assessment of natural persons
• Risk assessment and pricing in life and health insurance
• Education and vocational training, e.g. evaluating exam results

If you use such a system, the deployer obligations under Article 26 apply from 02.12.2027. These include in particular:

• using the system in accordance with the provider's instructions for use
• assigning human oversight to people who are competent, trained and authorised to do so
• ensuring that input data – to the extent you control it – is relevant and sufficiently representative for the purpose
• monitoring operation and informing the provider and authorities of risks or serious incidents
• keeping automatically generated logs for at least six months
• informing employees and their representatives before use in the workplace
• informing affected persons when the system makes or supports decisions about them

The postponement is a breathing space, not a free pass. Anyone introducing an AI-powered recruiting tool today should plan for oversight, logging and informing employees from the outset – retrofitting this later is considerably more effort.

Watch out: when deployers become providers

Under certain circumstances, deployers take on the much more extensive obligations of a provider (Art. 25). For high-risk AI, this is the case in particular if you

• offer a high-risk AI system under your own name or brand, for example as part of your own product
• substantially modify a high-risk AI system
• change the intended purpose of an AI system so that it becomes a high-risk system – for example, when a general-purpose AI assistant is used specifically to screen job applications

Who supervises – and what are the penalties?

In Germany, the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) has been in force since 29.07.2026. It designates the Federal Network Agency (Bundesnetzagentur) as the central market surveillance authority and point of contact for the AI Act.

The fines are substantial: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for breaches of other obligations – including the deployer and transparency obligations. For small and medium-sized enterprises, the lower of the two amounts applies in each case. The AI literacy obligation is not directly subject to fines under the regulation itself; however, a lack of training can carry significant weight in liability questions and with supervisory authorities.

And the GDPR?

The AI Act does not replace data protection law but applies in addition to it. As soon as AI processes personal data, you still need a legal basis, a data processing agreement with the provider and, where applicable, a data protection impact assessment. For automated decisions with legal effect – for example on job applications – the limits of Art. 22 GDPR must also be observed. In practice, both sets of rules can be tackled together: the AI inventory is also a good basis for the record of processing activities.

Checklist: what you should do now

1. Create an AI inventory: which AI systems and tools are used – including those without official approval (shadow AI)?
2. Clarify your role per system: are you a provider or a deployer?
3. Classify the risk: prohibited, high-risk, subject to transparency obligations or minimal risk?
4. Promote AI literacy: plan, deliver and document training.
5. Set up an internal AI policy: approved tools, handling of data, approval process for new applications.
6. Check transparency: is AI-generated content published or are chatbots used?
7. Prepare high-risk cases by 02.12.2027: human oversight, logging, informing employees and the works council.
8. Involve data protection: bring in the data protection officer early and align the AI inventory with the record of processing activities.

Conclusion

For most companies that use AI, the EU AI Act is manageable: promote AI literacy, rule out prohibited applications, ensure transparency and prepare in good time for the few high-risk cases. The most important first step is a complete overview of which AI is actually used in the company – because only what is known can be governed.