What does the EU AI Act require of companies that use AI?

WHAT WAS ASKED

What obligations does the EU AI Act place on companies that use AI? The question applies to companies in a deployer role, those using AI systems rather than building them from scratch. That is the question deliberated on.

WHERE THE PANEL DISAGREED

The panel reached substantial agreement on the core structure. Disagreements were narrow and mostly matters of emphasis or omission rather than conflicting positions.

On emotion recognition in workplaces. One response listed workplace emotion recognition as a prohibited use. Another placed it in the high-risk category rather than the banned category. This is a genuine tension. The Act's text bans emotion recognition in workplaces and educational institutions as a general rule, with narrow exceptions. The distinction matters operationally: a company using such a system cannot treat it as merely subject to compliance requirements, it is presumptively banned. This disagreement holds up under scrutiny and affects the verdict.

On who bears what. Some responses blurred the line between provider obligations (developers who place AI on the market) and deployer obligations (companies that use AI systems). A company that fine-tunes or substantially modifies a general-purpose AI model can cross from deployer into provider status, inheriting heavier obligations. This point was raised but not consistently emphasised. It is material for any company integrating and customising foundation models.

On General-Purpose AI obligations for deployers. One response suggested deployers of GPAI systems largely rely on their providers to meet compliance requirements. Another indicated deployers face direct obligations around copyright labelling and content disclosure. For most deployers using GPAI tools as-is, the lighter treatment is correct. For those publishing AI-generated content or fine-tuning models, direct obligations apply. This is a condition-dependent split, not a genuine contradiction.

No response produced a position that overturns the shared framework. The disagreements are real but resolve under closer examination.

HOW STRONG THE AGREEMENT IS

The agreement on the risk-based tier structure, the deployer/provider distinction, and the core high-risk obligations is strong. These are grounded in the Act's text.

What would overturn this conclusion. The implementing acts and delegated regulations expected through 2025 - 2026 will add specificity, and in some areas may narrow or expand the categories. Annex III, which lists high-risk use cases, can be updated by the Commission. If a company's AI use case sits near a category boundary, that guidance could change its compliance classification without any change in how the company uses the system.

Whether the agreement is independent. All four responses draw from the same source: the Act's text and the Commission's published guidance. Agreement here traces substantially to a shared source rather than independent reasoning from different evidence bases. That is appropriate for a legal compliance question, the source is the authority, but it means the panel's consensus reflects interpretation of one document, not cross-validated evidence. Where the Act is ambiguous, the panel's agreement does not resolve the ambiguity.

The strongest counter-argument the panel underrepresented. Compliance burden falls unequally on SMEs and mid-size deployers, who face the same obligations as large enterprises but without equivalent legal and technical resources. The Act contains some provisions acknowledging this, but the compliance framework is not materially lighter for smaller companies. None of the responses addressed this directly. It does not change what the Act requires, but it changes what "compliance" costs in practice and is material for any company assessing feasibility.

WHAT THIS MEANS

This question has a clear, well-evidenced answer. The Act's structure is established and the core obligations are not contested. The areas of uncertainty are at the edges, category boundaries, implementing guidance not yet finalised, and the provider/deployer line for companies modifying foundation models. Those uncertainties do not affect the core answer; they affect how a specific company applies it.

One pattern across the responses: all four treated the risk tiers as cleaner than they are in practice. The tiers are legally defined, but classifying a specific system into one tier requires judgment about how the system is used, who is affected, and in what sector. The Act provides the framework; compliance requires applying that framework to facts that the framework itself does not resolve.

BOTTOM LINE

The EU AI Act places obligations on companies as users of AI according to a four-tier risk structure. The tier determines the obligation.

Prohibited uses. A small set of AI applications cannot be deployed at all. Social scoring, real-time biometric identification in public spaces (outside narrow law enforcement exceptions), manipulation of behaviour causing harm, and, as a general rule, emotion recognition in workplaces and educational settings. These are not compliance questions. They are prohibitions.

High-risk systems. These carry the heaviest obligations for deployers. If a company uses AI in recruitment, credit, insurance, law enforcement, critical infrastructure, education assessment, or similar sensitive domains, it must: operate the system per the provider's instructions; assign human oversight by staff with the competence to intervene; monitor performance and report serious incidents; maintain logs; and, for public bodies and certain regulated entities, conduct a Fundamental Rights Impact Assessment before deployment. Workers subject to high-risk AI in the workplace must be notified.

Limited-risk systems. Chatbots, deepfakes, emotion recognition outside the prohibited contexts, and biometric categorisation systems carry transparency obligations. Users must know they are interacting with AI. Synthetic or manipulated content must be labelled.

Minimal-risk systems. Spam filters, recommendation engines, inventory tools, no new obligations under the Act. Existing EU law, including GDPR, applies.

Across all tiers. Every company deploying AI must take measures to ensure appropriate AI literacy among staff who operate or oversee AI systems. This is not sector-specific. It applies regardless of risk tier.

The provider line. A company that fine-tunes, substantially modifies, or rebrands an AI model for a new purpose may cross from deployer to provider status. Provider obligations are heavier. Any company customising foundation models should assess this question before assuming it sits in the deployer category.

The decisive factor is risk classification. Everything else follows from it. A company that misclassifies its AI system, placing a high-risk use in a minimal-risk category, faces both material compliance gaps and the penalties that attach to them. Fines reach €35 million or 7% of global turnover for prohibited-use violations; €15 million or 3% for high-risk obligation failures.

What would change this verdict: finalised implementing acts or Commission guidance that reclassifies specific use cases, or a judicial or supervisory ruling interpreting the provider/deployer line differently than the Act's text suggests. Neither has occurred as of the current state of the regulation.

The immediate action is an AI inventory. List every AI system in use. Classify each by risk tier and by the company's role, deployer or, in any case of customisation, potentially provider. High-risk classifications require a compliance programme before mid-2026. Prohibited uses require cessation now.