Deployer obligations under the EU AI Act

Article 3(4) defines a deployer as a natural or legal person, public authority, agency or other body using an AI system under its authority, except in a personal, non-professional activity. A company that licenses an HR screening tool, embeds a third-party chatbot on its website or lets staff use a generative AI assistant at work is a deployer of those systems. The provider develops the system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)).

Roles can shift. Under Article 25(1), a deployer is treated as the provider of a high-risk AI system, with the provider obligations in Article 16, if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to one, or changes the intended purpose of a system that was not high-risk so that it becomes high-risk. Using a general-purpose AI system to rank job applicants is a case to check against Article 25(1)(c).

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk timeline. Articles 26 and 27 sit in Chapter III, Section 3. For high-risk systems listed in Annex III they apply from 2 December 2027, and for high-risk systems under Annex I from 2 August 2028. They did not start to apply on 2 August 2026.

Other duties that concern deployers are already in force. AI literacy under Article 4 and the prohibitions in Article 5 have applied since 2 February 2025. The transparency duties for deployers in Article 50(3) and (4) apply from 2 August 2026. Anyone planning on the assumption that nothing applies before December 2027 should revisit these points first.

Article 27 requires a fundamental rights impact assessment (FRIA) before a high-risk system under Article 6(2) is deployed, but only from certain deployers: bodies governed by public law, private entities providing public services, and deployers of systems that evaluate the creditworthiness or credit score of natural persons (Annex III, point 5(b)) or assess risk and pricing for life and health insurance (Annex III, point 5(c)). A private employer using an HR screening tool is not required to carry out a FRIA for that reason alone.

The assessment describes the processes in which the system is used, the period and frequency of use, the categories of people likely to be affected, the specific risks of harm, the human oversight measures, and the steps to take if those risks materialise, including internal governance and complaint mechanisms (Article 27(1)). The deployer notifies the market surveillance authority of the results (Article 27(3)). Where a data protection impact assessment already covers some of these points, the FRIA complements it (Article 27(4)).

Article 50(3) requires deployers of emotion recognition or biometric categorisation systems to inform the people exposed to them. Article 50(4) requires deployers of AI that generates or manipulates image, audio or video deep fakes to disclose that the content is artificially generated or manipulated. AI-generated text published to inform the public on matters of public interest must also be disclosed, unless it has undergone human review or editorial control and someone holds editorial responsibility.

The chatbot disclosure in Article 50(1) is addressed to providers. If you build your own assistant, for example on top of a model API, and put it into service under your own name, check whether you are its provider under Article 3(3). Separately, AI literacy measures under Article 4 apply to every deployer, whatever the risk level of the tools used.

Start with an inventory of every AI system in use, who is responsible for it and what it is used for. Flag uses that fall under Annex III, such as recruitment, performance evaluation or credit scoring. Ask each vendor for the instructions for use and for information on logging and human oversight. Record who supervises each high-risk system and which training they received.

Then close the gaps that already carry deadlines: disclosures under Article 50 and AI literacy measures under Article 4. For high-risk systems, plan what will be needed by 2 December 2027: log retention of at least six months, information for workers' representatives and affected workers, notices for people subject to decisions, and a FRIA where Article 27 applies.