Does the EU AI Act apply to our use of AI, and are we a provider or a deployer?

Start

Where does the EU AI Act reach our use of AI?

Regulation (EU) 2024/1689 binds operators: providers, deployers, importers, distributors, product manufacturers and authorised representatives (Article 2(1)). Most organisations use other people's AI, so the usual questions are whether the deployer test fits and whether any use touches a prohibited practice or an Annex III area. This flow records your reasoning against the Act's text for counsel to confirm. It does not classify anything.

• Then: Take one use at a time from the inventory

Step

Take one use at a time from the inventory

Role and category depend on the facts of each use, so one answer for the whole organisation will be wrong for some uses. List the uses first, by their inventory IDs. Gather each supplier's instructions for use and anything it says about its own role. The supplier's statement is a fact for your reasoning and does not settle your role (ST-8).

• Then: Read the dates as the Act now has them

Step

Read the dates as the Act now has them

Article 113 as amended by Regulation (EU) 2026/1744, in force from 27 July 2026: the prohibitions in points (a) to (h) and AI literacy from 2 February 2025; the general date and Article 50 from 2 August 2026; two further prohibitions from 2 December 2026; Annex III high-risk systems from 2 December 2027; Annex I systems from 2 August 2028. Draft Commission guidelines and the proposal COM(2025) 837 are not law.

• Then: Is the use purely personal and non-professional?

Decision

Is the use purely personal and non-professional?

This is RQ-5. The Act does not apply to the obligations of deployers who are natural persons using AI in the course of a purely personal non-professional activity (Article 2(10)). Staff using AI for the organisation's work are not in that case. If not known, answer No and carry on.

• Yes: Record the personal-use reasoning, and ask Legal if unsure
• No, or not known: Did we build it, put our name on it, or change what it is for?

Outcome

Record the personal-use reasoning, and ask Legal if unsure

The worksheet's sentence for this answer is that the Act sets a purely personal, non-professional use outside the deployer obligations (Article 2(10)). Write down the facts that make the use personal, and ask Legal if you are unsure. If the same tool is also used for work, that use is a separate row.

Decision

Did we build it, put our name on it, or change what it is for?

These are RQ-1 to RQ-3. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name (Article 3(3)). A deployer that changes the intended purpose of a system so that it becomes high-risk, or modifies a high-risk one substantially, can be treated as its provider (Article 25(1)). Building for others, building an application or feature on a supplier's model API for staff or for customers, and selling another party's tool under your brand are the usual signals. A supplier's finished product used as supplied is not building. If not known, take the Yes branch.

• Yes, or not known: Ask Legal before the use starts
• No: Check what the Act means by 'distributor'

Outcome

Ask Legal before the use starts

The answers point away from the deployer test alone, towards the provider, importer, distributor or authorised representative tests or Article 25(1). Legal decides which role the organisation would hold before the use starts (AG-17) and records it. Intake holds a use with a provider signal until Legal has recorded the role. The record clears the hold (H-4) for a new use. If the role is deployer, the tier is set again from the answers. If it is provider or other, the use stays Tier 3, because it is outside the deployer governance of the pack. A use already running carries the hold as a condition with a date.

Step

Check what the Act means by 'distributor'

A business that distributes goods, such as a wholesale distributor, is not a distributor under the AI Act. The Act's distributor is in the supply chain, is neither the provider nor the importer, and makes an AI system available on the Union market (Article 3(7)). A reseller of AI products is the usual example. An organisation that uses AI in its own work is looking at the deployer test. Read this before the next question.

• Then: Do we import AI, pass it on to others, or act for a non-EU provider?

Decision

Do we import AI, pass it on to others, or act for a non-EU provider?

These are RQ-6 and RQ-7. An importer places on the market a system bearing the name of a person established in a third country (Article 3(6)). A distributor makes a system available on the Union market (Article 3(7)). An authorised representative holds a written mandate from a provider (Article 3(5)). The worksheet reads an organisation that only uses a tool in its own work as pointing to the deployer test instead (OR-4). If not known, take the Yes branch.

• Yes, or not known: Ask Legal before the use starts
• No: Do we use it under our own authority for our business?

Decision

Do we use it under our own authority for our business?

This is RQ-4. A deployer uses an AI system under its own authority, other than in a personal non-professional activity (Article 3(4)). Staff using an assistant, planners using a forecasting feature and a contact centre using a supplier's chatbot are the usual cases. If the answer is No or not known, no role is pointed to.

• Yes: The answers point to the deployer test; note what the supplier says
• No, or not known: No role is pointed to: record why and ask Legal

Outcome

No role is pointed to: record why and ask Legal

When no role question points to a role, the worksheet says to record why and ask Legal. Do not leave the row blank and do not assume a role. Legal's answer goes in the reasoning with a name and a date.

Step

The answers point to the deployer test; note what the supplier says

Write this as your reading with the facts behind it: 'we use the system under our own authority, so the answers point to the deployer test; the supplier says it holds the provider role'. Four parts of the Act matter most to an organisation that only uses AI: AI literacy (Article 4), the prohibitions (Article 5), the transparency duties (Article 50) and, for systems you read as in Annex III, Article 26 from 2 December 2027. Counsel confirms the reading.

• Then: Does any prohibited-practice question get a Yes or Unsure?

Decision

Does any prohibited-practice question get a Yes or Unsure?

PP-01 to PP-10 apply whatever the role. Examples: inferring the emotions of staff at work (the Commission's guidelines treat monitoring the emotional tone of staff video calls as prohibited), scoring people on social behaviour and, from 2 December 2026, generating intimate images of a real person without consent. Answer all ten. Any Yes or Unsure stops the use and takes it to Legal.

• Yes, or Unsure: Stop the use and take it to Legal
• No: Might it fall in an Annex III area, or is that unchecked?

Outcome

Stop the use and take it to Legal

A Yes or an Unsure on any of the ten stops the use until Legal has read the facts against Article 5. The pack takes no exception to the prohibitions (AG-20). This records a stop for counsel to settle. It does not say the use is prohibited.

Decision

Might it fall in an Annex III area, or is that unchecked?

HA-1 to HA-8 are biometrics, critical infrastructure, education, employment and workers' management, essential services and benefits, law enforcement, migration and border control, and justice and democratic processes. Employment covers recruiting, ranking applicants and monitoring the performance or behaviour of workers. Read the Annex's own wording. Judgement: an area you did not check takes the Yes branch, so a gap cannot pass as a No.

• Yes, unsure or unchecked: Tier 3: Legal confirms the reading before the use starts
• No: Might an Article 50 transparency duty apply?

Step

Tier 3: Legal confirms the reading before the use starts

The pack makes a use in an Annex III area Tier 3 whatever it does (AG-06). Legal confirms the reading, and the executive decision-maker your procedure names takes the decision before the use starts (executive management by default, or the board where your governance structure puts it). If that decision-maker owns the use, the board or its equivalent decides it. Article 26 duties apply to systems you read as in Annex III from 2 December 2027 (DD-1 to DD-9), including logs kept at least 6 months where you control them. Check whether an Article 27 impact assessment or a data protection impact assessment applies.

• Then: Might an Article 50 transparency duty apply?

Decision

Might an Article 50 transparency duty apply?

Article 50 applies from 2 August 2026. Providers carry the duty to tell people they are dealing with an AI system (TD-1) and to mark synthetic output (TD-2). Deployers carry the duties for emotion recognition or biometric categorisation (TD-3) and for deep fakes and AI text published on matters of public interest, unless a person reviewed it and holds editorial responsibility (TD-4). Ask whether customers deal with it, and whether you publish realistic generated images, audio, video or text. If not known, answer Yes.

• Yes, or not known: Note who carries each duty and how we check it
• No: Write the reasoning in your own words and cite the Articles

Step

Note who carries each duty and how we check it

For each duty that might apply, say in the reasoning who tells the people affected and how you check it. For a customer-facing system the pack puts the duty to tell people on the provider (TD-1), and asks whether the supplier does it and whether you keep the notice in place. Judgement: ask for the supplier's commitment in the contract and check the first message a customer sees. If you publish realistic generated content, name who labels it (TD-4).

• Then: Write the reasoning in your own words and cite the Articles

Step

Write the reasoning in your own words and cite the Articles

Record the role answers, what they point to, the checklist results, the areas you checked with your reading of each, the transparency duties and your reasoning against the Act's text. Add Legal's confirmation as a name and a date. The Check column reads Recorded when the row is complete. That does not say the reasoning is right: counsel confirms it.

• Then: Reasoning recorded for counsel to confirm; re-ask on change

Outcome

Reasoning recorded for counsel to confirm; re-ask on change

Put the worksheet row reference and the date of Legal's confirmation in the inventory (IF-14). Re-ask the questions on each trigger: a new purpose, a new feature, a change of supplier or a change in the law (AG-10). The inventory lists any review that has passed its date (IV-09). Keep the records for the period the policy sets (AG-12).