EU AI Act duties depend on how companies use and build systems

Companies using general-purpose AI tools are typically deployers under the EU AI Act, with duties to support staff AI literacy, avoid prohibited practices and meet applicable transparency requirements. Businesses that launch systems under their own name, including customer-facing bots built on external models, can become providers. Hiring and creditworthiness systems fall into the high-risk category.

The Digital Omnibus amendments entered into force on 27 July 2026. High-risk obligations for Annex III systems now apply from 2 December 2027, while rules for AI embedded in Annex I regulated products apply from 2 August 2028. Transparency duties, including chatbot disclosures and deepfake labeling, apply from 2 August 2026. Businesses developing high-risk systems should prepare data governance, logging and human oversight rather than suspend compliance work.

AI literacy requirements call for measures suited to staff knowledge and deployment context, not guarantees of individual proficiency. Prohibited practices include harmful manipulation, social scoring and certain biometric uses. Penalties reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, with lower caps for smaller businesses.

GDPR obligations remain separate and cumulative: personal data in prompts still requires a legal basis, minimization, appropriate contracts and transfer arrangements. The AI Act does not directly require data masking. Practical preparation includes inventorying tools, assigning provider or deployer roles, screening use cases, recording training and reviewing transparency requirements. System classification remains fact-dependent, with official guidance and national enforcement arrangements still developing.