What the AI Act Requires of a Company That Uses AI

“We buy AI from a large vendor that declares AI Act compliance. Isn’t that enough?” It is not. Regulation (EU) 2024/1689, known as the AI Act, has been in force since August 2024, and its requirements apply in stages. Some already do. For executives in banking, pharma, energy and other regulated industries the question today is how ready the organization is for the obligations that already apply and for those whose deadlines are still ahead.

An organization’s specific obligations should be confirmed with legal counsel.

Timeline of obligations

In November 2025 the European Commission proposed, in the Digital Omnibus package, to postpone the deadlines for high-risk systems to no later than 2 December 2027 for Annex III and 2 August 2028 for Annex I.¹ The proposal is being negotiated by the Council and the European Parliament. Until it is adopted, the dates in the table apply. A compliance plan built on a postponement that has not yet happened is a bet, not a plan.

The Commission has already published guidelines on prohibited practices and on the definition of an AI system. Further guidance, including on the classification of high-risk systems, is in preparation. The enforcement infrastructure is being built now and the debate about deadlines is not stopping it.

The penalty mechanism resembles GDPR: a fine is calculated as a fixed amount or a percentage of global annual turnover, whichever is higher, with more serious infringements at the harsher end of the scale. For SMEs and startups the cap is the lower of the two values (Article 99(6)).

Provider and deployer

The regulation distinguishes providers, which build AI systems, from deployers, which are organizations using those systems in their professional work. A deployer’s obligations exist independently of the provider’s and cannot be transferred to anyone else by contract.

Buying a compliant tool from a reputable vendor does not release the deploying organization from its own obligations on oversight, monitoring, incident reporting and risk management. Accountability rests with whoever actually uses the system, not only with whoever built it. This is the most common mistaken assumption in board-level conversations about the AI Act and also the most expensive one, because it surfaces only at the first incident or inspection.

Risk categories

The regulation sorts AI systems by risk instead of treating every use the same way.

For regulated industries the high-risk category matters most. It covers systems used in employment decisions, creditworthiness assessment, the operation of critical infrastructure and other situations where a system’s output affects people’s rights or the company’s safety obligations. Which systems in a given organization qualify, and from when specific obligations apply, depends on the system and how it is used.

Classification is a formal, documented exercise involving technical and legal people. Done informally, for example in one team’s spreadsheet, it will not hold up before an auditor or a supervisory authority, because it does not show who made the decision and on what basis.

AI literacy (Article 4)

Article 4 gets far less attention than the risk categories. Providers and deployers are to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and other persons operating systems on their behalf, taking into account their knowledge, experience, education and context of use.² The Digital Omnibus proposal would soften this provision, but until it is adopted the current wording applies.¹

The obligation has applied since 2 February 2025, is not limited to high-risk systems and covers the whole organization. The regulation does not prescribe the form of the measures, so the evidence that they were taken remains a documented training program matched to role and to the specific system: who was trained, when and in what scope.

Five steps to start

The first steps require neither a finished compliance program nor waiting for a final legal opinion. They require an owner for the topic and a working inventory.

1. Inventory of AI systems. Every system used in the organization, including tools adopted informally by individual teams.
2. Risk classification. Each system assigned to a category under the regulation, with a person accountable for that decision.
3. Documentation from providers. A review of the transparency information supplied by providers of general-purpose models used in production.
4. Audit trail. Documenting AI-supported decisions wherever the system’s output affects people, money or safety.
5. Literacy program. Training for staff who work with AI systems, matched to their role.

The organizations furthest along treat this as a standing operational function, not a one-off legal project. They come to an inspection with a clear inventory, a classification they can defend and documentation that holds up to scrutiny. We prepare the inventory, classification and compliance plan as part of the AI Strategy package.

Frequently asked questions