VANDAMLet’s talk

The AI Act, for companies
that use AI.

The EU AI Act is not only for the labs that build models. Any company that uses an AI system at work is a “deployer,” and the Act gives deployers duties of their own. Some apply already. Here is which, and from when.

Check what applies to you

  1. The Act enters into force

    Nothing applies yet. The clock starts.

  2. Bans and AI literacy

    Prohibited practices are banned, including emotion recognition at work. Companies take measures for the AI literacy of their staff.

  3. Rules for model makers

    Duties for general-purpose models such as Claude, GPT and Gemini. These sit with the labs, not with you.

  4. The Digital Omnibus

    The amendment softens the literacy duty and moves the high-risk deadlines back.

  5. Transparency

    People must be told when they deal with an AI system, deepfakes are disclosed, and some published AI text is labelled.

  6. Two new bans

    AI that makes non-consensual intimate images and child sexual abuse material is banned. Older image and text generators must mark their output.

  7. High-risk uses

    Duties for AI used in hiring, managing staff, credit and insurance: oversight, logs, informing workers.

  8. AI inside regulated products

    High-risk AI built into machines, medical devices and other regulated products.

Using AI makes you a deployer

The Act defines a deployer as anyone “using an AI system under its authority,” other than for personal use (Article 3). A company with ChatGPT seats, a support chatbot and a screening feature in its hiring software is a deployer three times over, and each use carries its own duties.

Most of those duties are light: train your people, tell customers when they talk to an AI, label what needs labelling. The heavy ones come with high-risk uses, mostly AI that decides about people’s jobs, credit or insurance.

What the Omnibus changed

The Digital Omnibus, Regulation (EU) 2026/1744, amended the Act on 27 July 2026. Three changes matter for companies that use AI.

AI literacy
Companies now “take measures to support the development of AI literacy of their staff.” The duty “does not require providers or deployers to guarantee any specific level of AI literacy.” The European Commission adds that “there is no need for a certificate.”
High-risk uses
The duties for AI in hiring, staff management, credit and insurance moved from 2 August 2026 to 2 December 2027 (Article 113).
Transparency
Not moved. The Article 50 duties apply since 2 August 2026. Only older generators got until 2 December 2026 to mark their output, and that duty sits with their makers.

Which duties
apply to you?

Tick what your company uses. This is a first sorting, not legal advice: a classification often depends on details, and borderline cases need a lawyer.

What does your company use?

Tick what your company uses. The duties appear here, earliest first, marked by whether they already apply.

  1. Applies now

    AI literacy

    Take measures so staff who use AI understand it well enough for their role. No certificate needed, but you should be able to show what you did. Article 4

  2. Applies now

    Say it is an AI

    People must be told they are dealing with an AI system unless it is obvious. The duty sits with whoever built the system: you, if you built it, otherwise check that your vendor does it. Article 50

  3. Applies now

    Disclose deepfakes

    Disclose that the content was generated or manipulated. For clearly artistic or satirical work, a lighter disclosure is enough. Article 50

  4. Applies now

    Label the text

    Label it as AI-generated, unless a person reviewed it and someone holds editorial responsibility for it. Article 50

  5. Applies now

    Banned at work and in schools

    Emotion recognition of staff or students is prohibited, except for medical or safety reasons. Article 5

  6. Applies now

    Tell the people affected

    Where emotion recognition or biometric categorisation is allowed, inform the people exposed to it. Article 50

  7. Not yet

    High-risk deployer duties

    Use the system as its instructions say, give oversight to people with the competence, training and authority to step in, keep its logs for at least six months, and tell workers’ representatives and affected staff before it goes into use. Article 26

  8. Not yet

    High-risk deployer duties

    The same oversight, logging and monitoring duties as other high-risk uses. People affected by a decision made with it can ask for an explanation (Article 86). Article 26

  9. Not yet

    Fundamental rights impact assessment

    Before first use, assess how the system could affect people’s rights and notify the market surveillance authority. Article 27

  10. Not yet

    You may become a provider

    A company that rebrands or substantially modifies a high-risk system takes on the provider’s duties. Check the role before you ship. Article 25

What to do this quarter

  1. Make the list

    Every AI system in use: bought, built or brought by staff. Include AI features switched on inside software you already pay for. Give each one an owner.

  2. Sort it

    Mark each use against the boxes above. Most land in literacy and transparency. Flag anything near hiring, staff decisions, credit or insurance.

  3. Write it down

    A literacy plan per role, the notices you need, and for high-risk uses who oversees the system and where its logs are kept. Keep it in one place, with a review date.

That is the AI Act Deployer File: we build it with your people in three weeks, and a lawyer reviews the parts that need legal judgment.

AI Act Deployer FileEvery AI system you use, classified and documented in one file. Three weeks.

See the service