EU AI Act Obligations for Companies Using AI

The EU AI Act is Regulation (EU) 2024/1689, the European law governing the development, placing on the market and use of artificial intelligence systems. For a company using generative assistants bought from third parties, the main obligations depend on the role it holds (normally deployer) and the risk level of the use case. Some obligations, such as staff AI literacy, apply to almost everyone.

This article is informational and is not legal advice.

How the EU AI Act works: the risk-level approach

The regulation does not treat all AI the same way. It scales obligations according to the risk a system, in its concrete use, poses to health, safety and fundamental rights. The starting point is always the use case, not the technology itself.

In short, the risk classification distinguishes:

• Prohibited practices (article 5): uses considered unacceptable, which cannot be carried out.
• High-risk systems: uses in sensitive areas, subject to strict requirements for providers and deployers.
• Transparency obligations: for some systems, for example those interacting directly with people or generating synthetic content, the people concerned must be informed.
• Minimal risk: most uses, with no specific obligations beyond the general ones.

There is also a dedicated regime for general-purpose AI models, which concerns first of all those who develop them and make them available.

Provider and deployer: which role does your company have?

The EU AI Act assigns different responsibilities depending on role.

The provider is whoever develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. The deployer is whoever uses an AI system under its own authority, except for personal non-professional use.

A company that buys licenses of a generative assistant and assigns them to employees is, for that use, a deployer. The provider remains the party that developed the system. Roles are not fixed, however: if the company builds an internal agent, customizes a system to the point of changing its purpose or markets it under its own brand, it may also take on provider obligations. It is therefore worth checking case by case, not tool by tool.

What a company using generative assistants must do in practice

For most organizations, there are five operational obligations.

1. Record tools and use cases. You cannot classify what you do not know. You need an up-to-date list of which AI systems are in use, in which departments and for which purposes. Unauthorized use is covered in shadow AI, risks and how to manage it.
2. Classify each use case by risk level. An assistant summarizing internal documents is not in the same category as a system supporting decisions on hiring or staff evaluation.
3. Exclude prohibited practices. Verify that no use falls under article 5 and that policies and controls prevent it.
4. Ensure AI literacy (article 4): staff using AI systems must have skills suited to their role. The details are in AI literacy and article 4 of the EU AI Act.
5. Meet transparency obligations and, where relevant, those for high-risk systems. Deployers of high-risk systems have their own obligations, for example on use in line with the provider's instructions, human oversight and log retention. If the use case falls in this area, an in-depth assessment is needed.

These obligations add to those already in force on personal data and security. The relationship with data protection is explored in GDPR and generative AI at work.

Which uses are prohibited and which are high-risk?

Article 5 lists the prohibited practices. They include, for example, subliminal or deceptive manipulation techniques that impair people's choices, social scoring and, in workplaces and schools, emotion inference, with limited exceptions. The full list and its conditions should be read in the text of the regulation.

High-risk systems concern specific areas identified by the regulation, including employment and worker management, education, access to essential services and other sensitive sectors. A generative assistant used in a recruitment or staff evaluation process can therefore change category depending on use, even if it is the same tool used to write an email.

The practical point is this: classification follows the use case. That is why a use case register is the prerequisite of any compliance analysis.

The application timeline: what is already in force

The EU AI Act entered into force with phased application. On this point, caution is advisable:

• Article 4 on AI literacy and the bans in article 5 apply from 2 February 2025.
• For the other obligations (general-purpose models, transparency, high-risk systems), the timeline sets later dates and may be subject to updates. Before planning internal deadlines, check the official sources for the dates in force at the time.

Planning only around the more distant deadlines is a frequent mistake: obligations already applicable require action now, and the work of recording and classification serves all later phases anyway.

Example: the same tool in three departments

Suppose a company has a generative assistant used across three functions. In marketing it drafts texts: risk is minimal, and staff AI literacy and data rules remain relevant. In customer service it powers a conversational assistant facing the public: transparency obligations come into play, because people interacting with it must be able to know they are talking to an AI system. In human resources it is proposed for sorting applications: here the use case may fall among the high-risk ones and must be analyzed carefully before launch.

The tool is the same, the obligations are not. This is why a list of licenses is not enough: you need a list of use cases, with owner, purpose and data involved.

How to set up a compliance path in three moves

A sustainable approach for a large organization follows three steps.

First, visibility: know which AI tools exist, including those adopted without going through IT. Second, classification and roles: for each use case, establish the risk level and the company's role (deployer, possibly provider). Third, continuous oversight: updated internal policies, tracked training, periodic review of the register when tools or uses change.

One limit to declare: a mapping of obligations helps to see where the gaps are, but the legal qualification of doubtful cases, for example whether a system is high-risk, requires a case-by-case legal assessment. A clear company AI policy helps translate these principles into usage rules employees can understand.

Where Delphis fits

Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. For the EU AI Act, it helps maintain a register of tools and use cases, associate the applicable obligations with each and highlight gaps in a checklist, with data on people always aggregated by role or department. The mapping is an operational aid and not legal advice. For more on the regulatory area: AI compliance with Delphis.

Sources

• Regulation (EU) 2024/1689 (AI Act)
• Regulation (EU) 2016/679 (GDPR)