EU AI Act Deployer Obligations: What Companies Using AI Must Do

What are the steps for a deployer to get ready for the EU AI Act?

The job is the same whatever your size. Do it in this order, because each step feeds the next.

• 1. Decide whether the Act reaches you and in which role: provider, deployer, importer or distributor.
• 2. Build an inventory of every AI system and AI feature you use, including features inside software you already have.
• 3. Screen every system for prohibited practices and stop anything that matches.
• 4. Classify each system: high-risk, transparency duty, minimal, or needs review, with a written reason.
• 5. Put AI literacy measures in place that fit each role.
• 6. Disclose chatbots and voice assistants, and label deepfakes and AI text on public-interest matters.
• 7. For each high-risk system, meet the deployer duties: instructions for use, human oversight, input data, logs, monitoring, informing workers and affected people, explanations, DPIA and, where required, a fundamental rights impact assessment.
• 8. Get the information you need from providers through a questionnaire and contract clauses.
• 9. Set up incident handling, including the serious-incident test.
• 10. Keep an evidence register and review the programme every quarter.

Who counts as a deployer under the EU AI Act?

The Act defines a deployer as a natural or legal person, public authority or other body using an AI system under its authority, except in a purely personal, non-professional activity. In practice that is almost every organisation that has bought a recruitment platform with ranking, switched on a chatbot or given staff an approved AI assistant.

The Act applies to deployers established or located in the EU, and to providers and deployers in third countries where the output of the AI system is used in the EU. A staffing firm in Denver whose AI-ranked shortlists go to a client in Amsterdam can therefore be in scope.

A deployer can become a provider. Under the Act, a deployer is treated as the provider of a high-risk system if it puts its name or trademark on one already on the market, makes a substantial modification, or changes the intended purpose of a system so that it becomes high-risk. Check before you white-label anything.

How do you classify AI systems by risk?

Classify by purpose, not by product. The Act forbids a short list of practices, treats systems used for listed purposes as high-risk, adds transparency duties for some systems, and leaves the rest as minimal risk. Listed high-risk uses include recruitment and selection, decisions about work such as promotion, termination and task allocation, monitoring and evaluating workers, credit scoring of people and life or health insurance pricing.

A system on the list may escape the high-risk class if it only does a narrow procedural task, improves work a person has already finished, detects patterns without replacing human review, or does preparatory work. Those exceptions never apply where the system profiles people. A tool that ranks applicants profiles them, so a human review step does not change its class. The Commission published draft guidelines on high-risk classification in May 2026; check whether a final version exists.

Which prohibited AI practices matter most to ordinary companies?

Most organisations will never touch real-time biometric identification for policing or predictive policing. The one they actually find is emotion inference. The Act prohibits AI that infers the emotions of people in the workplace or in education, except for medical or safety reasons. The Commission's guidelines on prohibited practices give examples including tracking employees' emotions in call centres and using emotion recognition during recruitment. These features are often sold as optional extras inside call-quality, interview and meeting software, so screen every new feature, not only new products.

The Digital Omnibus on AI added a ban on AI that generates non-consensual intimate images of real people or child sexual abuse material. According to the Commission's AI Act page, it takes effect in December 2026.

What do deployers have to disclose to people?

The transparency duties in Article 50 apply whatever a system's risk class. Systems that interact directly with people must be designed so people know they are dealing with AI, unless that is obvious; this is a provider duty, but if you configured a chatbot on a vendor platform and run it under your brand, it is sensible to act as if the duty is yours. Deployers who generate or manipulate deepfakes must disclose that the content is artificial, with a lighter-touch notice for evidently artistic, creative or satirical work. Deployers who publish AI-generated text to inform the public on matters of public interest must disclose it unless a person reviewed it and took editorial responsibility. Deployers of emotion recognition or biometric categorisation must inform the people exposed.

The information must be clear, distinguishable and accessible, and given at the latest at the first interaction or exposure. The Commission's quick facts on transparency describe optional EU icons for labelling AI-generated content. Write the exact words you use, offer a route to a person, and check each touchpoint live every quarter.

What must deployers of high-risk AI systems do?

The deployer duties sit in Article 26, with the fundamental rights impact assessment in Article 27 and the right to explanation in Article 86. In plain words: use the system according to the provider's instructions for use; assign human oversight to people with the competence, training and authority to do it; make sure input data you control is relevant and representative; monitor the system and, if it may present a risk, inform the provider and the authority and suspend use; keep the logs under your control for at least six months unless other law says otherwise; inform workers and their representatives before workplace use; inform people subject to decisions; use the provider's information in your DPIA; and cooperate with authorities.

The fundamental rights impact assessment is required of public bodies, private bodies providing public services, and deployers of systems that assess the creditworthiness of people or price life and health insurance. Others may choose a lighter rights check, and the GDPR DPIA may well apply anyway. Ireland's Data Protection Commission lists scoring, profiling and automated decisions with significant effects among the criteria that point to a DPIA.

When do the obligations apply after the Digital Omnibus?

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal and entered into force on 27 July 2026. According to the European Commission's AI Act page, the prohibitions and AI literacy have applied since February 2025, the transparency rules from August 2026, and high-risk obligations for listed uses start on 2 December 2027, with 2 August 2028 for AI in regulated products. The Omnibus also reworded the AI literacy duty: providers and deployers must take measures to support literacy, without having to guarantee a level for each person.

These dates are correct at November 2026. Check the official sources each quarter, because guidance and codes of practice are still arriving.

What does a deployer programme look like in a real firm?

Take a fictional 140-person recruitment and payroll firm in Dublin. Leadership guessed it used four or five AI tools. A no-blame call-out and a 90-minute workshop found 14 systems and features: one prohibited feature (an agent emotion score inside call-quality software, switched off on day 14), two high-risk systems (CV ranking and a temp worker rating module), three with transparency duties (a website chatbot, a phone voice assistant, a marketing image generator), seven minimal and one needing a decision.

The firm scored 24 practices from 0 to 4 at the start and again at day 90, and used its own estimates to compare the cost of the programme with the cost of doing nothing.

What are the most common mistakes deployers make?

• Assuming the Act is only for AI developers.
• Assuming that having no EU office settles it.
• Counting products instead of AI features inside them.
• Classifying from a vendor's sales page instead of the instructions for use.
• Believing a human review step makes a hiring tool low risk.
• Keeping a prohibited feature 'for training only' or 'with consent'.
• A chatbot that never says it is a bot.
• Oversight by people with no time or authority to override.
• Fixing an incident quietly instead of logging it and telling the provider.
• Telling clients 'we are compliant' instead of showing what you do.

How do you keep the programme current?

Treat the specifics as perishable. Keep dates, article references and thresholds in one dated place, re-check the Commission's AI Act page, the AI Act Service Desk, EUR-Lex and your national authority every quarter, and log every change you make. In Ireland, the AI Office of Ireland was established in August 2026 to coordinate a distributed model of sectoral regulators.

Make the checks habits by writing them as if-then plans; Jobulary's guide to if-then plans explains the method. If you want to test your own judgement first, AssessAll's Signing It Off: AI Governance Judgment assessment is a useful starting point. The EU AI Act Deployer Compliance Kit turns every step in this guide into a workbook, forms, templates and a 90-day plan.