VANDAMAI Act Deployer File
Every AI tool you useon one list, with what the law asks of each.
A register of every AI system in use at your company, each with a risk class under the EU AI Act and the duties that follow, written up as one file your works council, clients and auditors can read. Preparation and documentation, reviewed by a lawyer where the file needs it.
$8,000 three weeks
The AI Act has duties for companies that use AI.
Some already apply.
- 2 Feb 2025
- The AI literacy duty in
Article 4 applies to every deployer, amended in July 2026 to an obligation to take measures. - 2 Aug 2026
- Transparency duties under Article 50 apply: chatbots, deepfakes and published AI-generated text.
- 2 Dec 2027
- Deployer duties for high-risk uses in Annex III, including hiring and staff monitoring, apply under the Digital Omnibus.
Using AI tools makes you a deployer.
The AI Act has duties for deployers.
Most companies think of the AI Act as a law for the labs that build models. It also covers the companies that use them. The Act calls them deployers: anyone “using an AI system under its authority,” other than for personal use (Article 3). A company with 
ChatGPT seats, a support chatbot and a screening tool in its hiring software is a deployer three times over.
The first duty already applies. Since 2 February 2025, Article 4 asks deployers to look after the AI literacy of their staff. The Digital Omnibus amendment, in force since 27 July 2026, softened the wording: companies “shall take measures to support the development of AI literacy of their staff,” and the duty “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The European Commission’s Q&A adds that “there is no need for a certificate.” What remains is a plan that fits each role and the tools it uses, and the ability to show it.
Transparency came next. Since 2 August 2026, Article 50 requires that people are told when they talk to an AI system, that deepfakes are disclosed, and that AI-generated text published to inform the public on matters of public interest is labelled unless a person reviewed it and holds editorial responsibility.
The heaviest duties come with high-risk uses. Annex III lists AI used to recruit and select people, to decide on promotion or termination, to allocate tasks or to monitor and evaluate staff. For those, Article 26 asks deployers to assign human oversight to people with “the necessary competence, training and authority,” to keep the system’s logs for at least six months, and to inform workers’ representatives and affected workers before the system goes into use. After the Omnibus these duties apply from 2 December 2027 (Article 113).
None of this needs a compliance department. It needs a list of what you use, an honest look at each item and a few pages of decisions. The AI Act checker shows which duties apply to you, and from when. That is the file we build, in three weeks, with your people. We are not a law firm: the file is preparation and documentation, and where a classification or a notice needs legal judgment, your lawyer or one we work with reviews it before it is final.
What you keep after the three weeks.
The file opens with a one-page summary: how many AI systems you use, how many carry duties, what is done and what is still open, with dates. Then the register, one row per system with its owner, purpose, data, risk class and the reasoning behind it.
Behind the register sit the working documents: the literacy plan per role, the notice texts ready to publish, and for each high-risk use the oversight rule, the log retention and the note for the works council. When a client sends a vendor questionnaire about AI, the answers are already in it.
- CV screening · HRHigh-risk, from Dec 2027
- Support chatbot · ServiceTransparency notice
- ChatGPT Business · all staffMinimal, literacy plan
- Marketing images · MarketingLabel when published
- Meeting notes · personal accountsReplaced by company plan
What every deployer file covers.
Your tools differ. The file has the same parts each time.
AI register
Every AI system in use, bought, built or brought, with owner, purpose and data.
Risk classes
Prohibited, high-risk, transparency duties or minimal risk, with the reasoning.
Role check
Where you are a deployer, and where changes you make could make you a provider.
AI literacy plan
Measures per role under Article 4, with dates and a record of who did what.
Transparency notices
Texts for chatbots, generated content and other Article 50 cases.
High-risk duties
Human oversight, monitoring and log retention under Article 26, per system.
Works council note
What staff representatives and affected workers must hear, and when.
Legal review
Borderline calls and notices reviewed by a lawyer before the file is final.
How the three weeks run.
Find every AI system in use
We start from licences and invoices, then ask each team what they use and look at what the systems record: OAuth grants, browser extensions, AI features switched on inside the HR, CRM and support tools you already pay for, and the agents and apps staff built themselves. Each system gets an owner, a purpose and the data it touches.
Found in week one - ChatGPT Business · 60 seatsgeneral use
- Support chatbot · websitetalks to customers
- CV screening · inside the HR suiteswitched on by the vendor
- Meeting notes · personal accountsno owner
- Quote calculator · built in Lovablestaff-built
Give each one a risk class
For every system we record whether it is a prohibited practice, a high-risk use under Annex III, a system with transparency duties under Article 50, or minimal risk. We note your role, deployer or in some cases provider, and the reasoning, so anyone can follow the call. Borderline cases are marked for legal review.
Classification, CV screening - Use
- Ranks applicants for open roles
- Class
- High-risk, Annex III point 4(a)
- Our role
- Deployer
- Applies from
- 2 December 2027
- Legal review
- Marked, booked
Write the duties out
An AI literacy plan per role, based on the tools each role uses. Notice texts for chatbots, generated content and any emotion recognition. For high-risk uses: who oversees the system, what they check, where logs are kept and for how long, and the information for your works council and the affected staff.
Duties written out - AI literacy plan, 6 rolesdone
- Chatbot notice, websiteready to publish
- Oversight rule, CV screeningowner: HR lead
- Works council notemeeting on the 14th
Hand over one file
The register, the classifications, the plan, the notices and the oversight rules in one binder, with a named owner, a review date and a one-page summary for leadership. A lawyer reviews the parts that need it before the file is final.
The file - Summary for leadership1 page
- Register14 systems
- Literacy plan and record6 roles
- Notices and oversight rules5 documents
- Next reviewin three months
The file stays true when someone keeps it.
New tools arrive every month and vendors switch on AI features in software you already use. After the file is handed over, we can review it every quarter: add new systems, re-check classifications when the rules or the tools change, and update the literacy record.
New systems added
New tools and newly switched-on AI features found, classified and added to the register.
Classifications re-checked
Each class reviewed against changes in the tool, its use and the guidance.
Literacy record updated
New joiners and new tools added to the plan, with dates.
Review call
A quarterly session with the file owner on what changed and what is next.
What you
receive.
AI register
Every AI system in use, with owner, purpose, data and risk class.
Duties per system
AI literacy, transparency, oversight and logging, written out per use.
The file
One binder a works council, client or auditor can read, with an owner to keep it current.
Where the file leads.
Each next step has its own service.
100×worker Program
Training on each role’s own work, which is what the AI literacy plan asks for.
$8,000
Internal Apps Sweep
Tests the staff-built apps and agents the register found, and fixes what leaks.
$8,000
Agent Attack Audit
Red-teams the agents marked in the file before they reach more data.
$8,000
Team Harness
Rolls out the approved AI tools to every team, with the rules from the file built in.
$12,800
Before you ask.
Is this legal advice?
No. We are not a law firm. We do the inventory, the classification work and the writing, and we mark every call that needs legal judgment. Your own lawyer, or one we work with, reviews those parts before the file is final.
We only use ChatGPT and Copilot. Do we need this?
Then the file is short, and that is useful to know. You still have the Article 4 literacy duty, and it is worth checking for AI features switched on inside the HR, CRM and support software you already pay for.
Does this make us compliant?
It shows what you use, which duties apply and what you have done about each. Compliance is a continuing state, so the file has an owner and a review date. Where something is missing, the file says so and lists the next step.
We are a US company. Does the AI Act apply to us?
It can, when you use AI systems in the EU or their output is used in the EU, for example with European staff or customers. The inventory shows which systems that concerns.
How does this relate to GDPR?
They overlap. Where an AI system processes personal data, the file links to your records of processing, and Article 26 points deployers of high-risk systems to their data protection impact assessment. We note where a DPIA is needed and do not replace it.