Deployers have obligations, not just providers. Many organisations assume the Act applies to whoever built the model. If you deploy a high-risk system, you carry duties of your own: use it in accordance with instructions, ensure input data is relevant and representative, assign competent human oversight with authority to intervene, monitor operation, and retain logs.
Recruitment is the common surprise. AI used to screen CVs or rank candidates is listed as high-risk in Annex III. A great many companies have quietly adopted such tooling without recognising which tier it sits in.
Credit and insurance decisioning too. Creditworthiness assessment for individuals, and risk assessment and pricing in life and health insurance, are explicitly listed.
GPAI obligations are separate. General-purpose model providers carry their own duties around documentation, copyright policy and training-data summaries. If you fine-tune and distribute a model, consider whether you have become a provider yourself.
Timelines are staged. The Act entered into force on 1 August 2024. The prohibited practices applied from 2 February 2025 and the GPAI obligations from 2 August 2025. Most Annex III high-risk obligations and the Article 50 transparency obligations were scheduled for 2 August 2026, with Annex I product-embedded systems following on 2 August 2027. In late 2025 the Commission proposed, in its digital omnibus package, delaying some of the high-risk deadlines, so the timetable should be checked against the Official Journal and confirmed with counsel at the time you read this. Anything you are building now with a multi-year life should be designed for the end state rather than the current one — retrofitting logging and human-oversight mechanisms is considerably more expensive than including them.
