# AI Act Deployer File by VANDAM: Every AI system you use, classified and documented in one file > A register of every AI system in use at your company, each with a risk class under the EU AI Act and the duties that follow, written up as one file your works council, clients and auditors can read. URL: https://vandam.ai/ai-act-deployer-file Contact: hendrik@vibelab.be # Every AI tool you use on one list, with what the law asks of each. A register of every AI system in use at your company, each with a risk class under the EU AI Act and the duties that follow, written up as one file your works council, clients and auditors can read. Preparation and documentation, reviewed by a lawyer where the file needs it. [Discuss the project](https://vandam.ai/contact?topic=AI%20Act%20Deployer%20File) **$8,000** three weeks ## The AI Act has duties for companies that use AI. Some already apply. - **2 Feb 2025** The AI literacy duty in [Article 4](https://artificialintelligenceact.eu/article/4/) applies to every deployer, amended in July 2026 to an obligation to take measures. - **2 Aug 2026** Transparency duties under [Article 50](https://artificialintelligenceact.eu/article/50/) apply: chatbots, deepfakes and published AI-generated text. - **2 Dec 2027** Deployer duties for high-risk uses in [Annex III](https://artificialintelligenceact.eu/annex/3/), including hiring and staff monitoring, apply under the [Digital Omnibus](https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/). ## Using AI tools makes you a deployer. The AI Act has duties for deployers. Most companies think of the AI Act as a law for the labs that build models. It also covers the companies that use them. The Act calls them deployers: anyone “using an AI system under its authority,” other than for personal use ([Article 3](https://artificialintelligenceact.eu/article/3/)). A company with ChatGPT seats, a support chatbot and a screening tool in its hiring software is a deployer three times over. The first duty already applies. Since 2 February 2025, [Article 4](https://artificialintelligenceact.eu/article/4/) asks deployers to look after the AI literacy of their staff. The Digital Omnibus amendment, in force since 27 July 2026, softened the wording: companies “shall take measures to support the development of AI literacy of their staff,” and the duty “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The [European Commission’s Q&A](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers) adds that “there is no need for a certificate.” What remains is a plan that fits each role and the tools it uses, and the ability to show it. Transparency came next. Since 2 August 2026, [Article 50](https://artificialintelligenceact.eu/article/50/) requires that people are told when they talk to an AI system, that deepfakes are disclosed, and that AI-generated text published to inform the public on matters of public interest is labelled unless a person reviewed it and holds editorial responsibility. The heaviest duties come with high-risk uses. [Annex III](https://artificialintelligenceact.eu/annex/3/) lists AI used to recruit and select people, to decide on promotion or termination, to allocate tasks or to monitor and evaluate staff. For those, [Article 26](https://artificialintelligenceact.eu/article/26/) asks deployers to assign human oversight to people with “the necessary competence, training and authority,” to keep the system’s logs for at least six months, and to inform workers’ representatives and affected workers before the system goes into use. After the Omnibus these duties apply from 2 December 2027 ([Article 113](https://artificialintelligenceact.eu/article/113/)). None of this needs a compliance department. It needs a list of what you use, an honest look at each item and a few pages of decisions. [The AI Act checker](https://vandam.ai/ai-act) shows which duties apply to you, and from when. That is the file we build, in three weeks, with your people. We are not a law firm: the file is preparation and documentation, and where a classification or a notice needs legal judgment, your lawyer or one we work with reviews it before it is final. ## How the three weeks run. 1. Find every AI system in use: We start from licences and invoices, then ask each team what they use and look at what the systems record: OAuth grants, browser extensions, AI features switched on inside the HR, CRM and support tools you already pay for, and the agents and apps staff built themselves. Each system gets an owner, a purpose and the data it touches. Found in week one - ChatGPT Business · 60 seatsgeneral use - Support chatbot · websitetalks to customers - CV screening · inside the HR suiteswitched on by the vendor - Meeting notes · personal accountsno owner - Quote calculator · built in Lovablestaff-built 2. Give each one a risk class: For every system we record whether it is a prohibited practice, a high-risk use under Annex III, a system with transparency duties under Article 50, or minimal risk. We note your role, deployer or in some cases provider, and the reasoning, so anyone can follow the call. Borderline cases are marked for legal review. Classification, CV screening - **Use** Ranks applicants for open roles - **Class** High-risk, Annex III point 4(a) - **Our role** Deployer - **Applies from** 2 December 2027 - **Legal review** Marked, booked 3. Write the duties out: An AI literacy plan per role, based on the tools each role uses. Notice texts for chatbots, generated content and any emotion recognition. For high-risk uses: who oversees the system, what they check, where logs are kept and for how long, and the information for your works council and the affected staff. Duties written out - AI literacy plan, 6 rolesdone - Chatbot notice, websiteready to publish - Oversight rule, CV screeningowner: HR lead - Works council notemeeting on the 14th 4. Hand over one file: The register, the classifications, the plan, the notices and the oversight rules in one binder, with a named owner, a review date and a one-page summary for leadership. A lawyer reviews the parts that need it before the file is final. The file - Summary for leadership1 page - Register14 systems - Literacy plan and record6 roles - Notices and oversight rules5 documents - Next reviewin three months ## The file stays true when someone keeps it. New tools arrive every month and vendors switch on AI features in software you already use. After the file is handed over, we can review it every quarter: add new systems, re-check classifications when the rules or the tools change, and update the literacy record. - New systems added: New tools and newly switched-on AI features found, classified and added to the register. - Classifications re-checked: Each class reviewed against changes in the tool, its use and the guidance. - Literacy record updated: New joiners and new tools added to the plan, with dates. - Review call: A quarterly session with the file owner on what changed and what is next. [Ask about the quarterly review](https://vandam.ai/contact?topic=AI%20Act%20Deployer%20File%20care) ## What you receive. - AI register: Every AI system in use, with owner, purpose, data and risk class. - Duties per system: AI literacy, transparency, oversight and logging, written out per use. - The file: One binder a works council, client or auditor can read, with an owner to keep it current. $8,000 three weeks An indication from past projects. The final price can move a little with the size and complexity of your company, and we agree it in writing before we start. For COOs, HR, legal and IT leads at 20–500 person companies that use AI tools in the EU. Useful when a client, works council or auditor asks which AI you use, or before AI touches hiring or staff decisions. [hendrik@vibelab.be](https://vandam.ai/contact?topic=AI%20Act%20Deployer%20File) ## Where the file leads. Each next step has its own service. ### [100×worker Program](https://vandam.ai/100x-worker-program) Training on each role’s own work, which is what the AI literacy plan asks for. **$8,000** ### [Internal Apps Sweep](https://vandam.ai/internal-apps-sweep) Tests the staff-built apps and agents the register found, and fixes what leaks. **$8,000** ### [Agent Attack Audit](https://vandam.ai/agent-attack-audit) Red-teams the agents marked in the file before they reach more data. **$8,000** ### [Team Harness](https://vandam.ai/team-harness) Rolls out the approved AI tools to every team, with the rules from the file built in. **$12,800** ## Before you ask. ### Is this legal advice? No. We are not a law firm. We do the inventory, the classification work and the writing, and we mark every call that needs legal judgment. Your own lawyer, or one we work with, reviews those parts before the file is final. ### We only use ChatGPT and Copilot. Do we need this? Then the file is short, and that is useful to know. You still have the Article 4 literacy duty, and it is worth checking for AI features switched on inside the HR, CRM and support software you already pay for. ### Does this make us compliant? It shows what you use, which duties apply and what you have done about each. Compliance is a continuing state, so the file has an owner and a review date. Where something is missing, the file says so and lists the next step. ### We are a US company. Does the AI Act apply to us? It can, when you use AI systems in the EU or their output is used in the EU, for example with European staff or customers. The inventory shows which systems that concerns. ### How does this relate to GDPR? They overlap. Where an AI system processes personal data, the file links to your records of processing, and Article 26 points deployers of high-risk systems to their data protection impact assessment. We note where a DPIA is needed and do not replace it.