The rules apply in stages, and several of them already bind any company that uses chatbots, AI assistants, automated screening or AI-generated content in the European Union. We turn the obligations into working systems and a paper trail, together with your legal advisers where a legal interpretation is required.
02Adoption and readiness in numbers
AI use in European companies rises every year. Readiness lags: in the 2026 assessments of a European compliance advisory firm, most of the companies assessed had no AI inventory and no compliance owner. Each figure below names its source and its scope.
03The first question
The Act assigns most duties by role, not by company size. Most of our clients are deployers, and some become providers without noticing.
A chatbot on your website, an AI receptionist on your phone line, a screening tool in recruitment, AI features inside your CRM. You must use the system as instructed, make sure people know when they deal with AI, train the staff who operate it, keep the logs the system produces and assign human oversight to anything high-risk.
You develop an AI system, or you sell, rebrand or substantially modify one, including a fine-tuned model behind your own product. Providers carry the design duties: risk management, technical documentation, machine-readable marking of generated content, and conformity assessment for high-risk systems.
When we build AI features for you, the documentation states which role you hold for each system, so the question is answered before anyone asks it.
04What the law asks of you
Not every rule applies to every system. These are the ones that reach a typical company using AI in sales, service, marketing or HR, with their current status.
Article 4. You must take measures so that everyone who operates or relies on an AI system on your behalf has a sufficient level of AI literacy: what the system does, where it fails and when to step in. Since the Digital Omnibus this is a duty of effort, judged on the measures you take: role-based training, written instructions, a named contact. Keep records of the training; they are your evidence.
Article 5. Ten practices are banned outright, among them manipulative or deceptive techniques that cause harm, exploiting vulnerable groups, social scoring, emotion recognition in the workplace and in schools, and untargeted scraping of facial images. Two bans on generating non-consensual intimate content and child abuse material were added by the Digital Omnibus and apply from 2 December 2026.
Article 50(1). Chatbots, voice agents and avatars must make clear at the first interaction that they are AI, unless it is obvious to a reasonably attentive person. The design duty sits with the provider; as the deployer you must run the system so that the disclosure actually reaches your customers, and if you rebrand or substantially modify the tool, the provider duty becomes yours. A discreet line in the footer is not enough: the disclosure has to be clear, distinguishable and accessible.
Article 50(2) and 50(4). Providers must give generated text, images, audio and video a machine-readable mark, and deployers must visibly label deepfakes and AI-written text published on matters of public interest without human review; artistic works and text under editorial responsibility have their own exceptions. Systems that were already on the market get until 2 December 2026 for the machine-readable marking.
Article 50(3) and Article 5. If a system reads emotions or sorts people by biometric traits, the people concerned must be informed and their personal data handled under GDPR. In the workplace and in education, emotion recognition is banned altogether, except for medical or safety reasons.
Articles 14 and 26. For high-risk uses such as recruitment and HR decisions, credit scoring, insurance pricing, education and access to essential services, a competent and trained person must be able to understand the output, monitor it, and override or stop the system. Deployers keep the logs for at least six months, follow the provider's instructions and inform workers before use. The Digital Omnibus set these duties for 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products; the preparation takes most of that time.
The AI Act does not prescribe a hosting location. GDPR restricts moving personal data outside the EU, and prompts, transcripts and CRM records in sales, service and HR almost always contain personal data. EU-hosted models and storage, a processing agreement that rules out training on your data, and a data protection impact assessment where the risk warrants it, are the controls we recommend: they avoid transfer assessments for that data and answer the questions that enterprise clients and tenders ask first.
An inventory of every AI system, including the ones inside your SaaS tools, with its role and risk class, instructions of use, training records, logs, incident notes and the assessments you performed. When a client, an auditor or the market surveillance authority asks, the answer is a document, not a meeting.
05How we work
We are engineers, not a law firm. We build the controls into your systems and produce the evidence; where a legal interpretation is needed we work with your legal advisers.
We list every AI system you use or sell, including the AI features inside your CRM, marketing and HR tools, decide the role you hold for each one, assign the risk class and map the articles that apply. You receive a gap report and a prioritised plan.
AI disclosure in chat, voice and email. Labels and marking for generated content. Human approval steps and a stop switch in automated workflows. Logging with retention rules. EU hosting and processing agreements. Instructions of use and technical documentation. AI literacy training per role.
A compliance dashboard that shows the status per system, an incident procedure, a regulatory watch for guidelines, standards and delegated acts, quarterly reviews, board-level reporting and training for new staff.
06Compliance & Governance
A free assessment covers your AI systems, your role for each one, the rules that apply and the gaps. You receive a written summary you can share with your management and your legal advisers.
