EU AI Act: duties, deadlines and classification
Definition
The EU AI Act is the European regulation that governs the use of AI systems according to their risk. It sorts applications into classes, bans some practices entirely, and attaches concrete duties to high-risk systems. For a company it defines which role it holds, which evidence is required, and from which date a rule applies.
Why the Term Matters
The regulation affects not only AI makers but also firms that deploy purchased systems. Whoever checks the frame only after building risks a finished project stalling on a single obligation. As a neutral advisor we frame your role and your risk class before budget flows. A vague worry becomes a manageable list of concrete tasks that can be worked through before launch.
When It Is Relevant
- An AI system is about to go live and the legal classification is still missing.
- You buy an AI solution and want to know which duties remain with you as deployer.
- An existing system touches hiring, lending, access or safety.
- Management needs a defensible risk framing before a release.
When Not
When an application clearly falls into a low risk tier and supports only internal, uncritical tasks, short documentation is often enough instead of a large audit project. And when it is not yet decided which use case gets built, the regulation is best framed after prioritisation, not beforehand as an end in itself.
Industries That Use It
- Staffing providers: candidate pre-screening systems quickly fall into the high-risk area and need documented controls.
- Credit institutions: AI creditworthiness scoring is regulated, so clean mapping of role and duties matters.
- Medical technology: the regulation applies on top of existing product rules, and both layers must fit together.
- Education providers: exam and admission systems touch fundamental rights and require early framing.
Typical Use Cases
- An inventory of which in-house AI systems fall under the regulation at all.
- Mapping your own role as provider, deployer or importer per system.
- A risk-class framing with the resulting list of duties.
- A deadline plan translating transition periods into concrete milestones.
- A gap analysis between today's state and the required evidence.
Decision Guide
| Signal | EU AI Act framing fits | Alternative |
|---|---|---|
| System goes live soon | framing before rollout | starting without review is risky |
| Purchased solution in use | clarify deployer duties | blindly trust the vendor |
| Clearly uncritical case | short documentation suffices | a full audit would be too much |
| Use case still open | prioritise first | framing runs into a void |
Example
A staffing provider uses a purchased tool to pre-sort applications. We determine the deployer role, frame the system within the high-risk logic and list the required controls and notices. The vendor supplies the technical documentation, the company adds the deployer duties. This describes the method, not an asserted client metric.
Service Connection
The entry is usually EU AI Act consulting, often combined with an AI readiness check. When delivery is due, AI implementation follows.
Sources
This framing describes common practice around the EU AI Act. Statements on duties, roles and deadlines are general orientation and not legal advice; they must be checked case by case against the currently applicable legal texts and guidance.