Is your company a deployer? Five questions
28 October 2026 · Sources checked on 28 October 2026.
The EU AI Act (Regulation (EU) 2024/1689) does not impose the same obligations on everyone: it allocates them by each party's role in the value chain. The two roles that matter most to an SME are in Article 3: the **provider** (point (3)), which develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark; and the **deployer** (point (4)), which uses it. Most companies that use other people's AI tools are in the second role, but not always, and the role decides which articles apply to them.
The five questions below go through the official text, in the current consolidated version (as of 27 July 2026, after Regulation (EU) 2026/1744). They summarise what each article says; they do not interpret a specific case and they do not constitute legal advice.
1. Is what you use an AI system?
Article 3, point (1), defines an AI system as "a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments". What sets an AI system apart in that definition is that it infers, from the input it receives, how to generate its outputs. The definition refers to the tool, so the first source is its provider's documentation.
If the answer is no, the AI Act does not come into play for that tool. If it is yes, read on.
2. Do you use it under your authority?
Article 3, point (4), defines a deployer as "a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". The definition does not require having developed anything or paying for the system: using it under one's authority is enough. A company that contracts an AI tool and decides to use it in its business fits that description, also when the tool comes inside another product (the CRM assistant, the switchboard filter).
3. Is it a professional use?
The same definition leaves out use "in the course of a personal non-professional activity", and Article 2(10) repeats it from the scope: the Regulation "does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity". The exception is about natural persons and personal uses: a company that uses AI in its business is not in that case.
4. Are you established in the Union, or is the output used here?
Article 2(1) sets out to whom the Regulation applies. For those who use AI, two points:
- point (b): "deployers of AI systems that have their place of establishment or are located within the Union";
- point (c): providers and deployers established or located in a third country, "where the output produced by the AI system is used in the Union".
An SME established in Spain, or anywhere else in the Union, falls under point (b).
5. Have you developed the system, put your brand on it or changed it?
This is where the line with the provider role runs:
- **Developing it or having it developed.** Under Article 3, point (3), a provider is whoever develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. "Putting into service" (Article 3, point (11)) includes the supply "for own use in the Union for its intended purpose": a system built for the company's own use also counts.
- **Putting your name or trademark on a high-risk system** already placed on the market or put into service (Article 25(1), point (a)), without prejudice to contractual arrangements that allocate the obligations otherwise.
- **Making a substantial modification to a high-risk system** so that it remains high-risk (Article 25(1), point (b)). Article 3, point (23), defines a substantial modification as a change after placing on the market or putting into service which is not foreseen or planned in the provider's initial conformity assessment and which affects the requirements of Chapter III, Section 2, or modifies the intended purpose for which the system was assessed.
- **Changing the intended purpose** of a system that was not high-risk, including a general-purpose one, so that it becomes high-risk under Article 6 (Article 25(1), point (c)). When a use is high-risk is set out in Article 6 and the eight areas of Annex III (among them, employment and workers' management).
In those three cases of Article 25(1), the distributor, importer, deployer or other third party "shall be considered to be a provider of a high-risk AI system" and is subject to the obligations of Article 16; the initial provider is no longer considered a provider of that specific system (Article 25(2), as worded by Regulation (EU) 2026/1744). Article 25 is in Chapter III, Section 3, so it applies from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c)).
If you are a deployer: what the Regulation asks and from when
| What | Article | Applies from |
|---|---|---|
| Taking measures to support the AI literacy of staff who operate the systems | Article 4 | 2 February 2025 |
| Not using systems for the prohibited practices | Article 5 | 2 February 2025 (points (ba) and (bb): 2 December 2026) |
| Informing people exposed to an emotion recognition or biometric categorisation system, and disclosing deep fakes and AI-generated text published to inform the public | Article 50(3) and (4) | 2 August 2026 |
| The obligations of deployers of high-risk systems (instructions for use, human oversight, input data, monitoring, logs, informing workers) | Article 26 | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
| The fundamental rights impact assessment, for the deployers the Article names | Article 27 | 2 December 2027 |
The dates come from Article 113. The table summarises; the text that counts is the official one, linked below.
How to keep a record of it
The five questions are answered system by system: the same company can be the deployer of its customer service chat and the provider of a tool it developed for its own use. It helps to record, for each system, who the provider is, what it is used for, who looks after it inside the company and whether its brand, the system or its purpose has been changed, and to look at it again when the use changes.
The AI Inventory template is designed for the deployer role: the "AI systems" database records each third-party system with its "Provider", "Purpose", "Department" and "Internal owner", and the "Deployer obligations" database comes preloaded with Articles 4, 26, 27 and 50(3) to (5), each with its summary, the date from which it applies, the link to EUR-Lex and the date it was checked, with the "Already in force" and "Upcoming" views: AI Inventory.
Sources (opened on 28 October 2026)
- Regulation (EU) 2024/1689, consolidated text as of 27 July 2026, the current consolidated version given by EUR-Lex (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 — Articles 2, 3, 4, 5, 6, 16, 25, 26, 27, 50 and 113.
- Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ L of 24 July 2026): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744 — Article 1 (amendment of Article 25).
Document organisation tool based on official texts; it does not constitute legal advice.