Published
Updated
This guide sets out, step by step, what the AI Act requires of a company that uses AI systems without selling them. The AI Act (in French) page presents the regulation. It follows the text consolidated as of 27 July 2026, after Regulation (EU) 2026/1744, known as the “Digital Omnibus”. This guide does not replace the advice of a lawyer.
Key takeaways
A company that uses an AI system under its own authority is a deployer. It becomes a provider if it develops the system, or in three cases set out in Article 25.
Prohibited practices and AI literacy have applied since 2 February 2025, transparency since 2 August 2026.
The obligations of the deployer of an Annex III high-risk AI system apply from 2 December 2027.
Where do you start with AI Act compliance?
Start with an inventory of all the AI systems in use, including shadow AI (in French): the tools employees have adopted without declaring them. For each system, record the provider, the purpose, the data processed and the people affected. The AI assessment guide describes this observation of actual use.
Are you a deployer or a provider?
You are a deployer if you use an AI system under your own authority, outside a personal activity (Article 3). The provider develops the system, or has it developed, and places it on the market or puts it into service under its own name. A mid-sized company that develops an AI tool for its own use is therefore its provider. For a tool it has bought, it remains in principle a deployer.
A deployer nevertheless becomes the provider of a high-risk AI system in three cases (Article 25):
it puts its name or trademark on a high-risk AI system already on the market;
it makes a substantial modification to such a system, which remains high-risk;
it changes the intended purpose of a system, even a general-purpose one, and thereby makes it high-risk.
How do you classify your uses by risk level?
Classify each use: prohibited, high-risk, subject to transparency obligations, or with no specific obligation. Article 5 lists the prohibited practices, including emotion recognition in the workplace, except for medical or safety reasons. Annex III lists eight high-risk areas, including employment: recruitment, promotion, dismissal, tasks allocated on the basis of behaviour or personal traits, performance monitoring. An Annex III system is not high-risk if it does not pose a significant risk, for example if it performs a narrow procedural task (Article 6). It remains high-risk if it performs profiling of natural persons.
Fictional exercise. A mid-sized company with 900 employees classifies four uses identified in its inventory.
Use | Role | Risk level | Decision |
|---|---|---|---|
General writing assistant | Deployer | No specific obligation | Train staff and set rules for use |
Website chatbot, bought from a software vendor | Deployer | Transparency | Check that the tool informs visitors |
Application pre-screening software | Deployer | High-risk (Annex III, point 4) | Prepare for Article 26 |
Analysis of call-centre agents’ emotions from their voice | Deployer | Prohibited (Article 5) | Stop |
Organisation and assessments
Make organisational decisions with a clear assessment
Our assessments identify practical changes to help your teams and processes work together.
What obligations apply to the deployer of a high-risk AI system?
The deployer of a high-risk AI system uses it in accordance with the instructions for use, keeps human oversight of it and informs the people affected (Article 26). In practice, the deployer must:
assign human oversight to people who have the necessary competence, training, authority and support (see the human in the loop (in French) page);
ensure that the input data it controls is relevant and representative, which limits bias (in French);
monitor the operation of the system and suspend its use in the event of a risk, informing the provider and the market surveillance authority;
keep the logs it controls for at least six months;
inform workers’ representatives and the affected workers before putting the system into service in the workplace;
inform the people affected that an Annex III system is being used for a decision that concerns them.
Some deployers also carry out a fundamental rights impact assessment before first use. Article 27 covers bodies governed by public law and private entities that provide public services. It also covers deployers that evaluate the creditworthiness of natural persons or price their life and health insurance. If the processing of personal data presents a high risk, the GDPR (in French) requires a data protection impact assessment (Article 35). Article 26, paragraph 9, provides for using the provider’s information for it. A person subject to an adverse decision based on an Annex III system can ask the deployer for an explanation (Article 86). An Annex III system placed on the market or put into service before 2 December 2027 falls within scope only in the event of a significant change in its design (Article 111).
What must you do right now?
Even without a high-risk AI system, several obligations already apply, in addition to the prohibitions in Article 5. Article 4 asks you to promote AI literacy (in French) among your staff, without requiring a precise level for each person. Article 50 requires you to disclose a deep fake, and AI-generated text published to inform the public on matters of public interest. For such text, the obligation lapses after human review or editorial control, if a natural or legal person holds editorial responsibility for it. Finally, Article 50 requires you to inform people exposed to an emotion recognition system.
What is the timeline, and what are the penalties?
The obligations apply in stages, under consolidated Article 113:
2 February 2025: prohibited practices and AI literacy;
2 August 2025: general-purpose AI models, governance, penalties;
2 August 2026: general application, including transparency;
2 December 2026: new prohibitions, on non-consensual intimate images and child sexual abuse material;
2 December 2027: Annex III high-risk AI systems;
2 August 2028: Annex I high-risk AI systems.
Fines reach €35 million or 7% of total worldwide annual turnover for a prohibited practice (Article 99). They reach €15 million or 3% for deployer obligations and transparency. The regulation applies the higher of the two amounts, except for SMEs: the lower one. The Omnibus extends this rule to small mid-cap enterprises, excluding prohibited practices. These companies are not SMEs and employ fewer than 750 people. Their turnover does not exceed €150 million, or their balance sheet €129 million (Recommendation (EU) 2025/1099).
What checklist should a deployer use?
Ten checks cover the essentials of the path. This list is a Spentia proposal, with no success statistics or client portfolio claimed:
Inventory of systems and uses, including undeclared ones.
Record for each system: provider, purpose, data, people affected.
Role qualified for each system (Article 25).
No prohibited practice (Article 5).
Annex III uses identified, provider documentation obtained.
AI literacy measures in place (Article 4).
Rules for disclosing generated content (Article 50).
For each high-risk AI system: human oversight, logs, information to employees (Article 26).
Impact assessments carried out where required: GDPR in the event of high risk, fundamental rights if you are covered.
A designated owner and an annual review of the inventory.
The AI governance (in French) page helps allocate these roles. The AI roadmap guide integrates these steps into the overall plan.
Frequently asked questions
Does the AI Act apply to mid-sized companies and SMEs?
Does the AI Act apply to mid-sized companies and SMEs?
Yes: the regulation provides no exemption based on size. It does, however, cap SMEs’ fines at the lower of the two amounts. The rule also applies, excluding prohibited practices, to small mid-cap enterprises: fewer than 750 people and below financial thresholds.
What AI Act obligations apply to an assistant such as ChatGPT or Copilot?
What AI Act obligations apply to an assistant such as ChatGPT or Copilot?
For everyday writing or research use, you are a deployer with no high-risk-specific obligation. You must promote AI literacy (Article 4) and disclose deep fakes and certain published texts (Article 50). If you divert the assistant to an Annex III purpose, such as sorting job applications, Article 25 can make you a provider: have your lawyer confirm this reading.
When do the high-risk obligations apply?
When do the high-risk obligations apply?
Since Regulation (EU) 2026/1744: on 2 December 2027 for Annex III and on 2 August 2028 for Annex I. Annex I systems are regulated products, or safety components of these products, subject to third-party conformity assessment (Article 6).
What is the difference between a DPIA and a fundamental rights impact assessment?
What is the difference between a DPIA and a fundamental rights impact assessment?
The DPIA (data protection impact assessment) falls under the GDPR and is required for high-risk processing of personal data (Article 35). The fundamental rights impact assessment falls under the AI Act and covers only certain deployers of high-risk AI systems (Article 27). Article 27 allows you to refer to the DPIA or reuse parts of it rather than redo everything.
Sources
Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ of 24 July 2026: amendments to the AI Act, including Articles 3, 4, 25, 27, 99, 111 and 113. French text read in full: EUR-Lex
AI Act consolidated as of 27 July 2026, Article 113: timeline for application: AI Act Service Desk
Consolidated AI Act, Article 3: definitions of provider, deployer and small mid-cap enterprises: AI Act Service Desk
Consolidated AI Act, Article 4: AI literacy, with no level imposed on each person: AI Act Service Desk
Consolidated AI Act, Article 5: prohibited practices, including emotion recognition in the workplace, and the Omnibus’s new prohibitions: AI Act Service Desk
Consolidated AI Act, Article 6: exceptions to high-risk classification for Annex III systems and the profiling rule: AI Act Service Desk
Consolidated AI Act, Article 25: cases in which a deployer becomes a provider: AI Act Service Desk
Consolidated AI Act, Article 26: obligations of deployers of high-risk AI systems: AI Act Service Desk
Consolidated AI Act, Article 27: fundamental rights impact assessment; paragraph 4 replaced by Regulation 2026/1744 (reference to the DPIA): AI Act Service Desk
Consolidated AI Act, Article 50: transparency obligations of deployers: AI Act Service Desk
Consolidated AI Act, Article 86: right to explanation of individual decision-making: AI Act Service Desk
Consolidated AI Act, Article 99: penalties, rules for SMEs (§ 6) and for small mid-cap enterprises (§ 6a): AI Act Service Desk
AI Act, Annex III: high-risk areas, including employment (point 4) and credit and insurance (point 5): AI Act Service Desk
Commission Recommendation (EU) 2025/1099 of 21 May 2025, Annex, point 2: small mid-cap enterprises (not SMEs, fewer than 750 people, at most €150 million in turnover or €129 million in balance sheet total): EUR-Lex
GDPR, Article 35: data protection impact assessment: CNIL
The fictional exercise and the checklist are a Spentia methodological construction, with no success statistics or client portfolio claimed.
