Key takeaways
- The Act applies to providers, deployers, importers, distributors and product manufacturers, and to non-EU companies whose AI output is used in the EU (Article 2).
- Using someone else's AI tool in your business makes you a deployer, which brings lighter duties than building a system, but not zero duties.
- Exemptions are narrow: military and national security, pre-market research, purely personal use and, with limits, free and open-source software.
- Since the Digital Omnibus (Regulation (EU) 2026/1744), Annex III high-risk duties apply from 2 December 2027. Prohibitions, AI literacy and most transparency duties already apply.
Does the EU AI Act apply to your business?
Your business does not need to train an AI model to fall under the EU AI Act. Article 2 covers providers, deployers and other operators in defined circumstances, including some outside the EU. Identify your role for each system, then assess its intended purpose and risk. Company size affects some relief, not a general exemption.
Which role do you play?
Article 3 defines the roles, and Article 2 says who is covered. Work out which of these describes you for each AI system you touch, because one company can hold several roles for different systems.
| Role | Who it is | Example | Heaviest duties |
|---|---|---|---|
| Provider | Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark | A software company selling a recruitment-screening tool, or a company that commissions a custom system and runs it under its own brand | Risk management, data governance, technical documentation, conformity assessment for high-risk systems |
| Deployer | Uses an AI system under its own authority in a professional setting | A clinic using an AI scribe, a bank using a credit-scoring tool, a shop running a support chatbot | Use as instructed, human oversight, logging and informing affected people for high-risk systems. Transparency where Article 50 applies |
| Importer | Brings a system from a non-EU provider onto the EU market | An EU reseller of a US-built tool | Check the provider's conformity work before selling |
| Distributor | Makes a system available on the market without being the provider or importer | A reseller or marketplace | Verify required documentation and marking |
| Product manufacturer | Places an AI system on the market together with its own product | A medical device maker that builds AI into the device | Treated as the provider of that AI system |
You can become a provider without writing any code. Putting a high-risk system on the market under your own name, or changing its purpose or substantially modifying it, makes you the provider under Article 25.
Does it apply to companies outside the EU?
Article 2 covers providers placing AI systems on the EU market regardless of their location. It also covers certain providers and deployers outside the EU where system output is used in the Union. Assess the actual use and the Article 2 exceptions. An overseas address is not an exemption.
Who is exempt?
- Military, defence and national security uses (Article 2(3)).
- Research and development before a system is placed on the market or put into service, and systems built solely for scientific research. Testing in real-world conditions is not covered (Article 2(6) and 2(8)).
- Natural persons using AI in a purely personal, non-professional activity (Article 2(10)).
- Free and open-source AI, unless it is offered as a high-risk system or falls under the prohibitions or the transparency rules in Article 50 (Article 2(12)).
What applies to you today, and what comes later?
The Act phases in. On 24 July 2026 the Official Journal published Regulation (EU) 2026/1744, the Digital Omnibus on AI, which moved the high-risk dates. It entered into force on 27 July 2026. Always confirm the current dates on EUR-Lex before you plan around them.
| Date | What applies | Who is affected |
|---|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) | Every provider and deployer |
| 2 August 2025 | Rules for general-purpose AI models | Providers of those models |
| 2 August 2026 | Transparency duties in Article 50, with a grace period to 2 December 2026 for the marking duty on systems already on the market | Providers and deployers of chatbots, generative AI and deepfakes |
| 2 December 2026 | Two new prohibitions added by the Omnibus (non-consensual intimate imagery and child sexual abuse material) | Everyone |
| 2 December 2027 | High-risk systems listed in Annex III (employment, credit, education, essential services and similar) | Providers and deployers of those systems |
| 2 August 2028 | High-risk AI embedded in products covered by Annex I safety law | Product manufacturers and providers |
Do small businesses get any relief?
Some, though not an exemption. For SMEs including start-ups, an Article 99 fine is capped at the lower of the fixed amount and the percentage of turnover, instead of the higher. The headline ceilings are €35 million or 7% for prohibited practices and €15 million or 3% for most other obligations. The Omnibus also created a new category of small mid-cap companies, with fewer than 750 employees and turnover up to €150 million, which gets similar simplifications. Simplified documentation and priority access to regulatory sandboxes help too.
How can you find your own role in an afternoon?
- List every AI system or AI feature in use, including features inside software you already pay for.
- For each one, write down who built it, whose name is on it and who decides how it is used.
- Mark your role for each system: provider, deployer, importer or distributor.
- Check each use against Article 5 (prohibited) and Annex III (high-risk). If it appears in neither, it most likely falls under transparency or minimal-risk rules.
- Record the result in one table with an owner for each row. That is the start of your compliance file.
Describe whether you build, commission or use the AI system. We can map its architecture and data flows to support your role and risk assessment.
Discuss your AI systemFAQ
Does the AI Act apply if we only use ChatGPT or a similar tool?
Yes, as a deployer, if you use it professionally. Your duties are then the ones for deployers: AI literacy, no prohibited uses, transparency where Article 50 applies, and the heavier deployer duties only when your use is high-risk.
Does the AI Act apply to freelancers and one-person companies?
Yes, when the AI use is professional. Only purely personal, non-professional use by a natural person is excluded.
What are the fines for small companies?
The same tiers as for everyone, but for SMEs and start-ups each fine is capped at the lower of the fixed amount and the percentage of turnover (Article 99(6)).
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 2, 3, 25 and 99, Official Journal of the EU
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the EU, 24 July 2026
- AI Act Service Desk, European Commission
- Consejo de Ministros, press note on the draft organic law for the good use and governance of artificial intelligence, 26 May 2026
About the author
Artem Synytskyi · Co-founder · AI
Artem runs AI at ESADEX, building LLM, RAG and speech-to-text systems for regulated environments.