# The AI Act, for companies that use AI · VANDAM

> Which EU AI Act duties apply to a company that uses AI, and from when: AI literacy, transparency, high-risk uses in HR and credit. Dates after the Digital Omnibus, with a checker.

URL: https://vandam.ai/ai-act  
Contact: hendrik@vibelab.be

# The AI Act, for companies that use AI.

The EU AI Act is not only for the labs that build models. Any company that uses an AI system at work is a “deployer,” and the Act gives deployers duties of their own. Some apply already. Here is which, and from when.

1. 1 August 2024: The Act enters into force Nothing applies yet. The clock starts.
2. 2 February 2025: Bans and AI literacy Prohibited practices are banned, including emotion recognition at work. Companies take measures for the AI literacy of their staff.
3. 2 August 2025: Rules for model makers Duties for general-purpose models such as Claude, GPT and Gemini. These sit with the labs, not with you.
4. 27 July 2026: The Digital Omnibus The amendment softens the literacy duty and moves the high-risk deadlines back.
5. 2 August 2026: Transparency People must be told when they deal with an AI system, deepfakes are disclosed, and some published AI text is labelled.
6. 2 December 2026: Two new bans AI that makes non-consensual intimate images and child sexual abuse material is banned. Older image and text generators must mark their output.
7. 2 December 2027: High-risk uses Duties for AI used in hiring, managing staff, credit and insurance: oversight, logs, informing workers.
8. 2 August 2028: AI inside regulated products High-risk AI built into machines, medical devices and other regulated products.

## Using AI makes you a deployer

The Act defines a deployer as anyone “using an AI system under its authority,” other than for personal use ([Article 3](https://artificialintelligenceact.eu/article/3/)). A company with ChatGPT seats, a support chatbot and a screening feature in its hiring software is a deployer three times over, and each use carries its own duties.

Most of those duties are light: train your people, tell customers when they talk to an AI, label what needs labelling. The heavy ones come with high-risk uses, mostly AI that decides about people’s jobs, credit or insurance.

## What the Omnibus changed

The Digital Omnibus, Regulation (EU) 2026/1744, amended the Act on 27 July 2026. Three changes matter for companies that use AI.

- **AI literacy**
  Companies now “take measures to support the development of AI literacy of their staff.” The duty “does not require providers or deployers to guarantee any specific level of AI literacy.” The European Commission adds that “there is no need for a certificate.”
- **High-risk uses**
  The duties for AI in hiring, staff management, credit and insurance moved from 2 August 2026 to 2 December 2027 ([Article 113](https://artificialintelligenceact.eu/article/113/)).
- **Transparency**
  Not moved. The Article 50 duties apply since 2 August 2026. Only older generators got until 2 December 2026 to mark their output, and that duty sits with their makers.

## Which duties apply to you?

Tick what your company uses. This is a first sorting, not legal advice: a classification often depends on details, and borderline cases need a lawyer.

What does your company use?

Staff use AI tools such as

ChatGPT

,

Claude

or

Copilot

A chatbot or voice agent talks to customers or the public

You publish AI-made images, video or audio of real-looking people, places or events

You publish AI-written text to inform the public on matters of public interest

AI reads emotions or sorts people by biometric traits

AI helps recruit, promote, dismiss, assign tasks or monitor staff

AI scores creditworthiness or prices life or health insurance

You put your own name on an AI system, or change one substantially, and offer it to others

Tick what your company uses. The duties appear here, earliest first, marked by whether they already apply.

1. 2 February 2025: Applies now AI literacy Take measures so staff who use AI understand it well enough for their role. No certificate needed, but you should be able to show what you did. [Article 4](https://artificialintelligenceact.eu/article/4/)
2. 2 August 2026: Applies now Say it is an AI People must be told they are dealing with an AI system unless it is obvious. The duty sits with whoever built the system: you, if you built it, otherwise check that your vendor does it. [Article 50](https://artificialintelligenceact.eu/article/50/)
3. 2 August 2026: Applies now Disclose deepfakes Disclose that the content was generated or manipulated. For clearly artistic or satirical work, a lighter disclosure is enough. [Article 50](https://artificialintelligenceact.eu/article/50/)
4. 2 August 2026: Applies now Label the text Label it as AI-generated, unless a person reviewed it and someone holds editorial responsibility for it. [Article 50](https://artificialintelligenceact.eu/article/50/)
5. 2 February 2025: Applies now Banned at work and in schools Emotion recognition of staff or students is prohibited, except for medical or safety reasons. [Article 5](https://artificialintelligenceact.eu/article/5/)
6. 2 August 2026: Applies now Tell the people affected Where emotion recognition or biometric categorisation is allowed, inform the people exposed to it. [Article 50](https://artificialintelligenceact.eu/article/50/)
7. 2 December 2027: Not yet High-risk deployer duties Use the system as its instructions say, give oversight to people with the competence, training and authority to step in, keep its logs for at least six months, and tell workers’ representatives and affected staff before it goes into use. [Article 26](https://artificialintelligenceact.eu/article/26/)
8. 2 December 2027: Not yet High-risk deployer duties The same oversight, logging and monitoring duties as other high-risk uses. People affected by a decision made with it can ask for an explanation (Article 86). [Article 26](https://artificialintelligenceact.eu/article/26/)
9. 2 December 2027: Not yet Fundamental rights impact assessment Before first use, assess how the system could affect people’s rights and notify the market surveillance authority. [Article 27](https://artificialintelligenceact.eu/article/27/)
10. 2 December 2027: Not yet You may become a provider A company that rebrands or substantially modifies a high-risk system takes on the provider’s duties. Check the role before you ship. [Article 25](https://artificialintelligenceact.eu/article/25/)

## What to do this quarter

1. Make the list: Every AI system in use: bought, built or brought by staff. Include AI features switched on inside software you already pay for. Give each one an owner.
2. Sort it: Mark each use against the boxes above. Most land in literacy and transparency. Flag anything near hiring, staff decisions, credit or insurance.
3. Write it down: A literacy plan per role, the notices you need, and for high-risk uses who oversees the system and where its logs are kept. Keep it in one place, with a review date.

That is the AI Act Deployer File: we build it with your people in three weeks, and a lawyer reviews the parts that need legal judgment.

**AI Act Deployer File** Every AI system you use, classified and documented in one file. Three weeks.

[See the service](https://vandam.ai/ai-act-deployer-file)