Regulation (EU) 2024/1689, known as the AI Act, distinguishes several categories of obliged party. The largest, and the one least likely to consider itself concerned, is the deployer: the company using an AI system under its own authority. Which is to say, almost anyone.
The approach: risk, not technology
The Regulation does not regulate algorithms, it regulates uses, and classifies them by level. There are prohibited practices: harmful manipulation, social scoring, certain uses of biometric identification; there are high-risk systems, which carry the bulk of the obligations; there are systems subject to transparency duties, such as those interacting with people or generating synthetic content; and there is a separate regime for general-purpose models.
Where most companies get it wrong
In assuming their use is low risk. Annex III covers areas found in any mid-sized company: employment (CV screening, promotion decisions, task allocation), access to essential services, creditworthiness assessment and certain insurance decisions. If your HR department uses a tool that ranks or filters applications, you are very probably deploying a high-risk system, regardless of who programmed it.
What binds the user, not the maker
The deployer of a high-risk system must, in summary: use it in accordance with the provider's instructions, ensure effective human oversight by people with real competence and authority, ensure the relevance of input data under their control, keep the logs the system generates, inform affected workers before putting it into service, and suspend use and report the incident on detecting a risk. In the employment context it also intersects with data protection rules and with workers' representatives' information rights.
There is one cross-cutting obligation that is both the cheapest to meet and the most overlooked: AI literacy. The Regulation requires staff using these systems to have sufficient training to understand what the tool does and does not do. A documented session and a written procedure cover much of the file.
The timetable
The Regulation entered into force on 1 August 2024 and applies in stages: first the prohibited practices and the literacy duties; then the obligations for general-purpose models; and subsequently the bulk of the high-risk regime, with additional periods for systems embedded in products already regulated. Given that the European timetable in this area has been the subject of proposed adjustments, the date applicable to your specific case should be checked before fixing an internal plan.
A realistic four-step plan
- Inventory. Which AI-enabled tools are already in use, including those a department has contracted without going through management. There are usually more than appear in the budget.
- Classification. For each one: what decision it supports and about whom. The test is not the power of the model, it is the effect on people.
- Contracts. Review what the provider declares, what documentation they deliver and how liability is allocated. It is the point with the most negotiating room and the one almost nobody negotiates.
- Governance. A named owner, a human oversight procedure and an incident log. Without that, the rest does not hold up in an inspection.
This article contains general information for informative purposes and does not constitute legal advice or an investment recommendation. The rules cited may have been amended after publication; always check the text in force before taking a decision.