Most organisations do not build AI models. They buy them, license them or switch them on inside software they already use. Under the EU AI Act, that makes them deployers: any person or organisation using an AI system under its own authority, except for purely personal, non-professional use.
The AI Act entered into force on 1 August 2024 and applies in stages. Several obligations already apply to deployers today, and the high-risk rules now have fixed dates. Six steps help you get from awareness to a defensible position.
1. Build an AI inventory
You cannot classify or control what you do not know about. Start with a list of every AI system in use, including AI features inside existing SaaS tools and tools that employees adopted on their own.
- System name, vendor and version
- Business owner and technical owner
- Purpose and the decisions or processes it supports
- Users and the people affected by its output
- Data it receives, especially personal data
2. Check your role for each system
Your obligations depend on your role. Using a third-party system makes you a deployer. You become a provider, with much heavier duties, if you develop a system yourself or place it on the market under your own name. Under Article 25, a deployer can also take on provider obligations for a high-risk system: by putting its name or trademark on it, by making a substantial modification, or by changing its intended purpose so that it becomes high-risk. Record the role per system and review it when the use case changes.
3. Rule out prohibited practices
The prohibitions in Article 5 have applied since 2 February 2025. Violations carry fines of up to EUR 35 million or 7 % of worldwide annual turnover, whichever is higher. Check each use case against the list, in particular:
- Manipulative or deceptive techniques, or exploitation of vulnerabilities, that cause significant harm
- Social scoring that leads to unjustified or disproportionate treatment
- Emotion recognition in the workplace or in education, except for medical or safety reasons
- Biometric categorisation to infer sensitive characteristics such as political opinions or sexual orientation
- Untargeted scraping of facial images to build facial recognition databases
- Predicting criminal offences based solely on profiling or personality traits
4. Put AI literacy in place
Article 4 has also applied since 2 February 2025. The AI Omnibus amended the wording: providers and deployers must take measures to support the development of AI literacy among the people who operate or use AI systems on their behalf, without having to guarantee a specific level for each individual. In practice, that means role-based training, clear usage rules and a record of what you have done. Staff who approve or oversee AI use need more depth than occasional users.
5. Prepare for transparency duties
The transparency rules in Article 50 apply from 2 August 2026. As a deployer, you must inform people when you expose them to an emotion recognition or biometric categorisation system. You must disclose deep fakes, and AI-generated or manipulated text published to inform the public on matters of public interest, unless it has undergone human review and someone holds editorial responsibility. If you build your own customer-facing chatbot, you may be its provider and must make sure people know they are interacting with AI.
6. Prepare for high-risk obligations
The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk deadlines. The rules for high-risk use cases listed in Annex III, such as recruitment and HR decisions, education, creditworthiness and access to essential services, apply from 2 December 2027. For AI in products covered by Annex I, they apply from 2 August 2028.
Deployers of high-risk systems will have to use them according to the instructions, assign human oversight to competent people, monitor operation, keep logs, inform workers and affected people, and in some cases carry out a fundamental rights impact assessment. Identify likely high-risk use cases in your inventory now and align the work with your existing GDPR data protection impact assessments.
Fidempli supports these steps through consulting and professional services, and from December 2026 the Fidempli platform will help maintain the inventory, pre-classification and evidence over time.