There is a widespread and genuinely dangerous misconception about the EU AI Act circulating in organizations right now. It goes something like this: the EU AI Act is a problem for AI companies. We just use AI systems. We buy them from vendors. The vendors are the ones who have to comply.
This misconception is going to cause real problems for real organizations in the near future. Because the EU AI Act does not distinguish between the organizations that build AI systems and the organizations that deploy them. It assigns distinct and substantial obligations to both. And if your organization uses AI systems that process data of EU residents, in EU member states, or in any context that brings you within the Act's scope, you are a deployer under the EU AI Act whether you have thought about it that way or not.
This post is about what deployer obligations actually mean in practice, what the enforcement timeline looks like, and what privacy teams need to have in place before the Dec 2, 2027 Annex III high-risk deadline (proposed under the EU Digital Omnibus). Whether your organization deploys ChatGPT Enterprise, Epic, Salesforce Einstein, or another AI-powered application, the deployer framework is the same.
Who Counts as a Deployer
The EU AI Act defines a deployer as any natural or legal person, public authority, agency, or other body that uses an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.
Read that definition carefully. It does not say organizations that build AI systems. It does not say organizations that sell AI systems. It says organizations that use AI systems. If your organization has deployed a third-party AI system that affects individuals in the EU, you are a deployer. The obligations that flow from that designation are yours, not the vendor's, regardless of what the vendor's marketing materials say about their own compliance.
This matters enormously for how privacy teams need to think about AI Tool Intelligence Reports. The question is not only "is this vendor compliant with the EU AI Act?" The question is "what are our obligations as a deployer of this system in this specific use case, and have we met them?"
The Enforcement Timeline You Actually Need to Know
The EU AI Act came into force in August 2024. Its requirements are being phased in over time, and understanding the timeline is essential for prioritizing your compliance work.
February 2025: Prohibited practices under Article 5 became enforceable.
This is the category of AI uses that the EU has decided should simply not exist. Subliminal manipulation, exploitation of vulnerabilities, social scoring by public authorities, individual criminal risk profiling from unrelated data, untargeted scraping of facial images, emotion recognition in workplace and educational settings, and biometric categorization that infers sensitive characteristics. Any AI system your organization uses that does any of these things has been illegal under EU law since February 2025. If you have not assessed your AI system portfolio against Article 5, this is the place to start.
August 2025: GPAI model obligations became applicable.
General-purpose AI models, the large foundation models that underpin most of the AI systems organizations use today, became subject to provider-tier obligations. This primarily affects the vendors building on top of these models. But as a deployer using tools built on GPAI models, you need to understand that the GPAI classification affects your own obligations. A system built on a GPAI model is assessed differently under the Act than a system using a narrow purpose-built model.
December 2027: High-risk AI system obligations apply to deployers (Annex III standalone).
Under the EU Digital Omnibus proposal, the compliance deadline for standalone high-risk AI systems under Article 6 and Annex III is 2 December 2027 (extended from 2 August 2026). This is the deadline that most organizations with any serious AI system portfolio need to be focused on. High-risk AI systems cover a significant range of enterprise use cases including employment and worker management, education and vocational training, access to essential private and public services, administration of justice, and management of critical infrastructure.
If your organization uses AI systems in any of these categories, deployer obligations under the high-risk framework apply from that date. Plan compliance and evidence collection well ahead of it - the statutory deadline remains August 2026 until the Omnibus is formally enacted.
August 2027: Remaining obligations for general-purpose AI systems embedded in products.
The full framework is in effect by this point. But organizations waiting until 2027 to start thinking about EU AI Act compliance are already behind.
What Deployer Obligations Actually Require
The EU AI Act assigns deployers a specific set of obligations that exist independently of whatever the provider has done to comply with their own obligations. These are not optional enhancements. They are legal requirements.
Human oversight under Article 26.
Deployers of high-risk AI systems must implement appropriate human oversight measures. This means ensuring that natural persons to whom human oversight is assigned have the competency, authority, and resources to actually exercise that oversight. A checkbox that says "human reviewed" is not human oversight. A process in which the human review is perfunctory or in which the reviewer lacks the context to meaningfully evaluate the AI output is not human oversight.
For practical purposes, this means that for any high-risk AI system your organization uses, you need a documented process describing who reviews AI outputs, what they are reviewing for, what authority they have to override the AI recommendation, and how overrides are recorded.
AI literacy training under Article 4.
Deployers must ensure that staff operating or relying on AI systems have sufficient AI literacy, taking into account the technical knowledge, experience, education, and training of those staff members, as well as the context in which the AI system will be used.
This is not a one-time training requirement. It is an ongoing obligation to ensure that the people using AI systems understand what those tools can and cannot do, where they are likely to fail, what the consequences of errors are, and when to escalate or override. For high-risk systems, the AI literacy requirement is particularly substantive.
Most organizations have not yet implemented AI literacy programs that meet this standard. Many have provided general awareness training about AI. That is not the same thing as ensuring that the specific people operating a specific AI system in a specific context have the specific competencies the Act requires.
Monitoring and logging obligations.
Deployers must monitor the operation of high-risk AI systems and keep logs of system operation to the extent that these are under their control. This means that if you are using a high-risk AI system, you need to be capturing and retaining records of how the system is being used, what outputs it is producing, and what decisions are being made on the basis of those outputs.
For organizations that have deployed AI systems without any logging or monitoring infrastructure, this is a significant gap to close before the Dec 2, 2027 high-risk deadline.
Transparency to affected individuals.
Where AI systems interact with natural persons or produce outputs that affect natural persons, deployers must inform those individuals that they are subject to AI-assisted processing. For limited-risk systems this is primarily a transparency disclosure requirement. For high-risk systems it is more substantive, including the obligation to provide meaningful information about the system's logic and the significance of its outputs.
Fundamental rights impact assessment for certain public sector deployers.
Public bodies and organizations providing public services using high-risk AI systems in certain categories must conduct a fundamental rights impact assessment before deployment. This is separate from and in addition to a DPIA under GDPR.
The Use Case Classification Problem
Here is where deployer compliance under the EU AI Act becomes genuinely complex, and where most organizations are most exposed.
The EU AI Act does not classify tools. It classifies use cases. The same tool can be minimal-risk in one deployment and high-risk in another, depending entirely on what the deployer is using it for and in what context.
Consider a large language model used for text generation. If your marketing team uses it to draft social media posts, it is minimal-risk. If your HR team uses it to generate candidate assessments that feed into hiring decisions, it is high-risk under Annex III, which explicitly covers AI systems used for employment and worker management including recruitment, selection, and evaluation. If your financial services team uses it to generate credit risk summaries that inform lending decisions, it is high-risk under the provision covering access to essential private services including credit.
The implications of this for your AI Tool Intelligence Report workflow are significant. You cannot assess a system once and apply that assessment to all uses of the system across your organization. You need to assess each material use case. A system approved for marketing use is not automatically approved for HR use. The compliance obligations, and your responsibilities as a deployer, are different.
This is why the intake process needs to capture use case with specificity at the point of request, and why assessments need to be tied to specific deployments rather than to AI systems in the abstract.
What the Article 5 Prohibited Practices Mean for Your Portfolio
Before worrying about the high-risk framework, every organization should have completed a review of their current AI system portfolio against the Article 5 prohibited practices. This is not a future obligation. It became enforceable in February 2025.
The prohibited practices are worth understanding in detail because some of them are more expansive than they might initially appear.
The prohibition on AI systems that deploy subliminal techniques beyond a person's consciousness to materially distort behavior in a way that causes harm covers AI systems used in persuasion, engagement optimization, or behavioral nudging contexts. If your organization uses AI to optimize content for maximum engagement in ways that exploit psychological vulnerabilities, this provision warrants careful analysis.
The prohibition on emotion recognition systems in workplace and educational settings is broad. It covers AI systems that infer or classify emotions, not just those explicitly marketed as emotion recognition tools. If any AI system your organization uses in a workplace context analyzes facial expressions, voice patterns, or physiological signals to infer emotional states, it falls within this prohibition.
The prohibition on biometric categorization that infers sensitive characteristics including political opinions, religious beliefs, and sexual orientation from biometric data covers a range of AI systems that go beyond obvious face recognition applications.
If you have not reviewed your current AI system portfolio against Article 5, that review should happen now.
Connecting EU AI Act Compliance to Your GDPR Assessment Process
The good news for privacy teams is that EU AI Act compliance for deployers does not require building an entirely new compliance program from scratch. It requires extending the compliance program you already have.
The DPIA process you use for GDPR high-risk processing is the natural foundation for the EU AI Act fundamental rights impact assessment. The data mapping you do for GDPR purposes gives you the data flow visibility you need to assess EU AI Act classification. The vendor assessment process you use for GDPR DPA compliance is the right process to extend for EU AI Act provider documentation review.
The most important extension is the use case classification step. Every AI Tool Intelligence Report needs to include an EU AI Act classification determination based on the specific use case, not just the system category. That classification then determines which deployer obligations apply and whether the Dec 2, 2027 high-risk deadline is relevant to that specific deployment.
Organizations that integrate EU AI Act classification into their existing AI Tool Intelligence Report workflow, rather than treating it as a separate compliance workstream, will find this significantly more manageable than those approaching it as a standalone project.
The deadline is real. The obligations are yours. The assessment work is the path through.
This article is for informational purposes only and does not constitute legal advice. AI regulatory intelligence and compliance requirements vary by organization, jurisdiction, and use case. Consult qualified legal counsel before making compliance determinations or relying on this content for any legal, regulatory, or business purpose.