EU AI Act.
The AI regulation for businesses: roles, use cases, applicable duties and the route to suitable evidence.
- Regulation (EU) 2024/1689 · as amended on 27 July 2026
- By Derya Altinay
- As of: 10/22/2026
- Reading time: 8 min.
Short answer.
The EU AI Act regulates artificial intelligence according to use case, risk and role. It distinguishes providers and deployers, prohibits certain practices and requires specific safeguards and evidence for high-risk AI. Transparency, AI literacy and model provider duties need separate examination; Article 113 determines phased application.
The AI regulation and its current status.
The EU AI Act is a directly applicable EU regulation, rather than a voluntary security standard. Regulation (EU) 2024/1689 sets out obligations for AI systems and general-purpose AI models. The familiar overview of AI Act risk classes offers a starting point; a specific decision also requires the company's role and intended use.
Regulation (EU) 2026/1744 amended the AI regulation and has applied since 27 July 2026. Its Article 1, point 40 amends the timetable in Article 113 of the AI regulation: for high-risk systems under Article 6(2) and Annex III, Chapter III, sections 1 to 3 generally apply from 2 December 2027; for the product route under Article 6(1) and Annex I, from 2 August 2028. Article 6(5) is excepted.
The general application date remains 2 August 2026. Prohibitions and AI literacy, as well as rules on general-purpose models, have their own earlier dates; certain newly added prohibitions apply only from 2 December 2026. Extending particular high-risk deadlines therefore does not postpone the AI regulation as a whole. For systems and models already provided, the transitional rules in Article 111 must also be examined.
Who the EU AI Act applies to.
Under Article 2, the EU AI Act particularly concerns providers placing AI systems on the EU market or putting them into service, and deployers established or located in the EU. Certain actors outside the EU are also covered where system outputs are used in the EU. Importers, distributors and product manufacturers have their own roles. Purely personal, non-professional use is treated differently from business use.
A company should clarify its role for each use case. Purchasing a third-party service does not conclusively determine its role for every application built on that service. A model and a finished system are also different reference points. Purpose, provision and actual use therefore belong in the assessment; company-wide classification based solely on the model name is too imprecise.
AI Act duties depend on role and use.
AI Act duties are not a uniform package of measures for every AI use. The following areas provide orientation; applicable articles and dates must be determined for each system and role.
Examine prohibitions and high-risk classification.
Article 5 describes prohibited practices; Article 6 addresses high-risk classification. The product route connects Annex I coverage with required third-party assessment; the second route concerns listed use cases under Annex III. Not every application in a listed industry is automatically high-risk. Exceptions require a reasoned assessment of the specific function.
Develop AI literacy.
Article 4, as amended, requires measures supporting the development of AI literacy. Existing knowledge, experience, tasks and operating context must be considered. Providers and deployers do not have to guarantee a particular individual competence level. A general course certificate therefore replaces neither selection of suitable measures nor engagement with the systems used.
Make high-risk AI secure and traceable.
The high-risk requirements in Articles 9 to 15 concern risk management, data, documentation, record-keeping, information, human oversight, accuracy, robustness and cybersecurity, among other matters. Provider duties and quality management under Article 17 organise this work. Which requirements apply when follows from the specific regime and application timetable.
Take responsibility in operation.
Deployer duties under Article 26 differ from provider tasks. Where high-risk rules apply, these include operating according to instructions, suitable human oversight and monitoring use. Oversight requires capable people with an actual ability to act; simply naming a responsible function does not demonstrate effective intervention in the workflow.
Implement targeted transparency.
Article 50 contains specific information and labelling duties for certain systems and outputs. These include recognisable interaction with AI and handling certain artificially generated content. Who must inform or label depends on the provision and role. This does not establish a blanket rule for every document internally processed using AI.
Consider model duties separately.
Chapter V contains separate duties for providers of general-purpose AI models, or GPAI. Additional requirements concern models with systemic risk. Using such a model does not automatically make a company a model provider; equally, model documentation does not settle every duty for a system built on it.
Implementation starts with the use case.
Record purpose and use.
As a practical starting point, describe the task an AI system performs, who uses it and which people or decisions its outputs affect.
Clarify role and scope.
Record your organisation's actor role and the assessment of the EU connection and possible exceptions supporting that decision.
Assess classification professionally.
Examine prohibitions, high-risk routes and transparency questions with business, technical and legal owners, and document the reasoning.
Determine duties and dates.
Assign specific owners and the applicable application date to relevant requirements, including separate transitional rules.
Connect evidence and operations.
Plan required documentation, assessments and oversight so that they reflect actual system use and the applicable evidence route.
Reassess changes.
As a practical recommendation, review decisions when purpose, functionality, operating environment or responsibilities change, and record the updated position.
Evidence follows the applicable procedure.
The AI regulation does not provide for every company to buy the same certificate. For high-risk AI, Article 43 determines the applicable conformity assessment procedure. Depending on the system, internal control or involvement of a notified body is provided for; product rules may help determine the procedure. Documentation and, where applicable, the EU declaration of conformity, CE marking and registration must each be considered in the appropriate legal context.
A certificate issued by a notified body is distinct from a voluntary management system certificate. Article 44(2) limits the validity governed there to a maximum of five years for Annex I systems and four years for Annex III systems; the stated period and procedure conditions are decisive. These limits are not a general validity period for all AI Act evidence. Operational duties must also continue to be observed.
Other frameworks support different tasks.
For AI products, the Cyber Resilience Act's product duties may also be relevant and require independent examination.
ISO 42001 structures an AI management system, while the NIST AI RMF provides a voluntary framework for AI risks. Both can support organisation of the work but do not demonstrate automatic conformity with the EU AI Act. The GDPR continues to apply independently to personal data processing; AI Act classification does not replace a data protection assessment.
In Secani.
Secani includes an editorial business catalogue for the EU AI Act with role and profile information, implementation guidance and evidence examples. Providers, deployers and other roles are recorded separately. The aid supports structured work; it replaces neither professional classification nor a legally required assessment procedure. The catalogue is not official conformity evidence.
Next step.
Select a specific live or planned AI use case and bring together its business and technical owners with the legal assessment. The first result should be a reasoned decision on role, use and applicable duties. This creates a manageable evidence plan; an unchecked list of every regulation article is less helpful.
Sources.
- European Commission: Cyber Resilience Act
- AI regulation: consolidated version of 27 July 2026
- Regulation (EU) 2026/1744: Digital Omnibus on AI, particularly Article 1, points 5 and 40
- European Commission: AI Act and application timetable
- Official AI Act Service Desk: Article 2, scope
- Official AI Act Service Desk: Article 4, AI literacy
- Official AI Act Service Desk: Article 6, high-risk classification
- Official AI Act Service Desk: Article 17, quality management
- Official AI Act Service Desk: Article 26, deployer duties
- Official AI Act Service Desk: Article 43, conformity assessment
- Official AI Act Service Desk: Article 44, certificates
- Official AI Act Service Desk: Article 50, transparency obligations
- Official AI Act Service Desk: Article 113, application
Frequently asked questions.
No. Article 6 ties classification to certain product situations or listed use cases with their prerequisites and exceptions. Using a powerful model alone does not determine classification.
No. The role depends on provision, your own application and possible changes. A contract with a model or service provider does not automatically clarify responsibility for the finished system.
No. An AI management system can organise responsibilities and processes, while statutory duties for the particular use require separate examination. A management system certificate is not blanket evidence of all EU AI Act requirements.
No. Required evidence follows from role, system and applicable provisions. Article 43 distinguishes several conformity assessment procedures; not every procedure involves an external body.
Turn AI responsibility into concrete work.
Connect requirements, responsibilities and evidence for your assessed use cases in Secani.
This page provides general context on the AI regulation. Applicable legal acts and assessment of the specific use case take precedence.