EU AI Act: obligations and dates

Yes, as a "deployer" (Article 3(4)): since 2 February 2025 Article 4 applies to you, which asks you to take AI-literacy measures for your staff. High-risk obligations reach you only if you use AI for an Annex III use case, such as recruitment or creditworthiness assessment.

Using a third-party model does not make you a provider. Since Regulation (EU) 2026/1744, Article 4 asks for measures that support AI literacy, taking into account your staff's knowledge and the context of use, without requiring you to guarantee any individual's level. Article 50 adds transparency duties for deployers in specific cases: deep fakes, and AI-generated text published to inform the public without human review or editorial responsibility.

Reviewed: 28 September 2026Read the full guide →

Three have passed: prohibited practices and AI literacy since 2 February 2025, general-purpose AI models since 2 August 2025, and general application since 2 August 2026. Annex III high-risk obligations, originally due on that same date, apply from 2 December 2027: Regulation (EU) 2026/1744 (the "Digital Omnibus on AI"), adopted and in force since 27 July 2026, set that date.

The same Omnibus moves Annex I high-risk AI (AI inside Section A regulated products such as medical devices, lifts or toys; machinery moved to Section B and gets its AI requirements through delegated acts under Regulation (EU) 2023/1230 that must apply by 2 August 2028) from 2 August 2027 to 2 August 2028, and applies two new prohibited practices it adds to Article 5 from 2 December 2026. It was published in the Official Journal on 24 July 2026 and amends Article 113 of the Regulation.

Reviewed: 28 September 2026Read the full guide →

Usually not: answering enquiries is not listed in Annex III. What Article 50(1) does require is that the person knows they are talking to an AI, unless it is obvious; that duty falls on the system's provider, and if you put the chatbot into service under your own name or trademark, the provider may be you (Article 3(3)).

It becomes high-risk if the same system is used for one of the Annex III purposes, for example assessing people's creditworthiness or credit score, selecting candidates or deciding admission to an educational institution (points 3, 4 and 5). Article 50(5) requires the notice to be clear and distinguishable, at the latest at the first interaction.

Reviewed: 28 September 2026Read the full guide →

Article 99 sets three bands: up to EUR 35 million or 7% of worldwide turnover for prohibited practices; up to EUR 15 million or 3% for breaching the obligations listed in its paragraph 4, including those of deployers (Article 26) and the transparency duties (Article 50); and up to EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information to the authorities. For SMEs the lower figure of each pair applies. In Spain, the state agency for AI supervision is AESIA.

AESIA (the Spanish Agency for the Supervision of Artificial Intelligence) was created by Royal Decree 729/2023, which approves its statute, and is based in A Coruña. The 7% and 3% figures are calculated on the preceding financial year and, for larger companies, whichever is higher applies.

Reviewed: 28 September 2026Read the full guide →

The natural or legal person, public authority or body that uses an AI system under its authority, except in a personal non-professional activity (Article 3(4)). If you buy an AI service and use it in your business, with your customers or staff, that is you.

The provider is whoever develops the system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). A deployer's duties include AI literacy (Article 4), transparency in the cases of Article 50 and, for high-risk systems, assigning human oversight to people with the necessary competence, training and authority (Article 26(2)).

Reviewed: 28 September 2026Read the full guide →