By Laas NuryMost companies will never build an AI model. They use one: a chatbot on the website, Copilot in Outlook, a tool that reads invoices, a planning system with a forecast inside. The EU AI Act has a name for that role, the deployer, and a much shorter list of duties for it than for the companies that build AI.
This article is that shorter list. What applies to you today, what changed when the EU amended the Act in July 2026, and what you need in place before December 2027. It is written for the person in a company who has to answer the question "are we compliant?", not for lawyers.
The short answer
If your company uses AI tools but does not build or sell them, four things matter:
- Some uses are banned, and have been since February 2025. Most companies are nowhere near them, but one of them (emotion recognition at work) catches people out.
- AI literacy is a duty today. You take measures so your people understand the AI they use.
- Transparency duties apply since 2 August 2026, if you publish AI-generated images, video, audio or text of certain kinds, or if you built the chatbot your customers talk to.
- High-risk uses (hiring, credit, insurance pricing and a few more) carry real obligations, now from 2 December 2027.
Everything else in the Act's 113 articles is mostly for the companies that build and sell AI.
Provider or deployer: which one are you?
The AI Act gives different duties to different roles. The two that matter for most companies:
- Provider: the company that develops an AI system and puts it on the market or into service under its own name. OpenAI, Microsoft and the vendor of your invoice-reading software are providers.
- Deployer: the company that uses an AI system under its own authority, in its own work. That is you, when your team uses Copilot or your planners use a forecasting tool.
Two situations turn a deployer into a provider, and both are common:
- You build something yourself. A customer chatbot your team assembled on top of a large language model, released under your company's name, makes you its provider, even if the model underneath is someone else's.
- You change what a tool is for. If you take a general tool and use it for a high-risk purpose, such as ranking job applicants with a general chatbot, Article 25 treats you as the provider of a high-risk system. The tool did not change. The use did.
Keep that second point in mind. It is the most common way an ordinary company walks into the heavy part of the Act without noticing.
What already applies: the bans and AI literacy
The banned practices (since 2 February 2025)
Article 5 bans a short list of uses. Most are far from everyday business (social scoring by governments, predictive policing of individuals, real-time face recognition in public spaces for law enforcement). The ones a company can actually run into:
- Emotion recognition in the workplace or in education, except for medical or safety reasons. A tool that reads your call-centre staff's mood from their voice or face is banned.
- Manipulation that pushes people into decisions they would not otherwise take and that harms them, and exploiting people's vulnerabilities (age, disability, economic situation).
- Scraping face images from the internet or CCTV to build a face-recognition database.
- Biometric categorisation that infers sensitive traits such as ethnicity, political views or sexual orientation.
The July 2026 amendment added two bans from 2 December 2026: AI systems that generate non-consensual intimate images, and AI-generated child sexual abuse material.
AI literacy (since 2 February 2025, softened in July 2026)
Article 4 originally required providers and deployers to ensure a sufficient level of AI literacy among their staff. The amendment rewrote it into a duty to take measures that support AI literacy. It is now an obligation of effort rather than of result, but it still binds every company that uses AI, and you still need to be able to show what you did.
The Dutch regulator's advice is practical: know which AI systems your people use, work out what each group needs to know about them, and plan how you build that knowledge over time. Individual certificates are explicitly not the only way to comply. We cover this step by step in a separate article on AI literacy.
What applies since 2 August 2026: transparency
Article 50 was not postponed. Its duties are about people knowing when they are dealing with AI. For a company, three of them matter:
| Situation | Who carries the duty | What you do |
|---|---|---|
| Customers chat with an AI system (a support bot, a sales assistant) | The provider: whoever built and released it. If your team built it, that is you. | Make clear the person is talking to an AI, unless that is obvious from the context. |
| You publish AI-generated or altered images, video or audio that look real (a "deepfake") | The deployer: you, as the publisher | Disclose that the content is AI-generated or manipulated. Lighter rules apply to clearly artistic or satirical work. |
| You publish AI-generated text to inform the public about matters of public interest | The deployer | Disclose it, unless a human reviewed it and your company takes editorial responsibility. |
There is also a duty for providers of generative AI to mark their output in a machine-readable way. Systems already on the market before 2 August 2026 have until 2 December 2026 to comply. That duty sits with the vendors, not with you, but it is worth asking your suppliers about.
What moved: the high-risk obligations
The biggest change in the July 2026 amendment (Regulation (EU) 2026/1744, in force since 27 July 2026) is timing:
- High-risk uses listed in Annex III (the list below): from 2 December 2027, instead of 2 August 2026.
- AI that is a safety component of products already covered by EU product law, such as machinery or medical devices: from 2 August 2028, instead of 2 August 2027.
It was a deferral, not a cancellation. The obligations themselves are unchanged. Of the Annex III areas, these are the ones an ordinary company can run into:
| Area | Examples of a high-risk use |
|---|---|
| Employment | Screening or ranking CVs, placing targeted job ads, deciding on promotion or dismissal, allocating tasks based on behaviour or personal traits, monitoring and evaluating staff performance |
| Credit | Assessing creditworthiness of individuals or setting their credit score |
| Insurance | Risk assessment and pricing for life and health insurance of individuals |
| Essential services | Deciding on access to public benefits and essential private services |
| Critical infrastructure | Safety components in the management of water, gas, heating, electricity or road traffic |
| Education | Admissions, grading and monitoring students during tests |
Using AI to plan deliveries, read invoices, forecast demand or draft quotations is not on this list. For most operations work, the high-risk regime simply does not apply.
If you do use high-risk AI: what deployers must do
From 2 December 2027, a company that deploys a high-risk AI system (and did not build it) must, under Article 26:
- Use the system according to the provider's instructions.
- Assign human oversight to people who have the competence, training and authority to do it.
- Make sure the input data it controls is relevant and representative for the purpose.
- Monitor the system in operation and report serious incidents to the provider and the regulator.
- Keep the logs the system generates for at least six months.
- Inform workers and their representatives before putting a high-risk system into use at work.
- Tell people when a high-risk system is used to make or support decisions about them.
Public bodies, and private companies doing credit scoring or life and health insurance pricing, must also carry out a fundamental rights impact assessment before first use (Article 27).
Fourteen months sounds like a lot. In practice, the first step (finding out whether you have any high-risk use at all) takes an afternoon, and the rest depends on the answer.
Fines
| Breach | Maximum fine |
|---|---|
| Using a banned practice | EUR 35 million or 7% of worldwide annual turnover, whichever is higher |
| Breaking most other obligations (including deployer duties) | EUR 15 million or 3% of turnover |
| Giving incorrect or misleading information to authorities | EUR 7.5 million or 1% of turnover |
For SMEs the lower of the two amounts applies, and the July 2026 amendment extended that relief to small mid-cap companies. Regulators are also told to weigh the size of the company and whether it cooperated.
Who checks this in the Netherlands, and does it reach the UK?
The Netherlands. In April 2026 the cabinet published the implementing law for consultation (it ran until 1 June 2026). The model is hybrid: existing supervisors keep their own domain (the AFM and DNB for financial institutions, product-safety regulators for products), and the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur take the central role, with the AP supervising where no sector regulator exists. The two are also setting up a regulatory sandbox where companies can test AI with guidance from the supervisor.
The UK. The AI Act follows the output, not the office. A UK company that places an AI system on the EU market, or whose AI output is used in the EU, is in scope. A UK firm serving Dutch or German clients with an AI-driven service should read this article as written for them.
What to do this quarter
A practical order for a company that uses AI and wants to be able to answer "are we compliant?":
- Make a list of the AI you use. Tools, features inside existing software (your ERP, CRM and HR system probably have some), and anything your team built. One spreadsheet: tool, owner, what it is used for, what data goes in.
- Mark each line: banned (should be none), high-risk use (Annex III), transparency duty (Article 50), or ordinary use.
- Put AI literacy measures in place for the people who use each tool. Short, specific, recorded.
- Check the transparency duties on anything customer-facing: your chatbot, AI-generated images in marketing, published texts.
- Ask your suppliers two questions: which of their features use AI, and how they meet their provider duties. Put the answers in the same spreadsheet.
- Give it an owner. One person who keeps the list current and brings a new AI use to it before it goes live.
None of this requires a consultant. If you find a high-risk use in step 2, or you are building AI into your own operation and want it done in line with the Act from the start, that is where we can help.
