Compliance with the AI Act Part 3: Who must comply and what are the obligations?

Updated July 2026 

The EU AI ActThe EU Artificial Intelligence Act was approved by the EU Council on 21 March 2024. A world-first comprehensive AI law, intended to harmonise rules for the development, deployment, and use of artificial intelligence systems across the EU. has extra-territorial reach, which means it can apply to organisations both inside and outside the EU. Obligations depend on the AI system, its risk level, and your organisation’s role. 

Some requirements already apply, with most remaining provisions except those relating to high-risk systems taking effect from 2 August 2026. Following the Digital Omnibus on AI, detailed high-risk requirements will apply from 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in certain regulated products. 

Key takeaway: Your role must be assessed for each AI system. You could be a deployer when using one system and a provider when developing, rebranding or significantly changing another. Provider status brings greater responsibilities. 

Who does the EU AI Act apply to?

The AI Act has wide geographical reach and, like the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR), an organisation does not need physical offices in the EU to fall within its scope.  

This makes it a significant law with global implications and means that its provisions apply to any organisation marketing, deploying, or using an AI system in the EU, even if the system is developed or operated outside the EU.  

What determines your obligations?

Compliance obligations are determined by two main factors: 

• The AI system’s classification 
• Your organisation’s role 

Read Compliance with the AI act part 2: What is high risk activity? for details on AI system classification 

The same organisation can hold different roles for different AI systems, so a single organisation-wide label is unlikely to be sufficient. 

General-purpose AI model providers are subject to a separate set of requirements, which we cover later in this blog. 

How to define your organisation’s role under the AI Act

Roles are determined by what your organisation does with each AI system. You may therefore hold different roles across your AI use. 

The AI Act defines six main roles:  

Why your AI role matters

Most organisations using third-party AI tools will be Deployers. However, your role can change. Rebranding or substantially modifying a high-risk system or changing an AI system’s purpose so that it becomes high-risk, could mean taking on Provider responsibilities.  

Your role should therefore be assessed for each AI system, rather than applying to your organisation as a whole. 

What are the main obligations for providers and deployers?

All six roles carry responsibilities under the AI Act. However, most organisations developing or using AI systems will likely act as a Provider or Deployer. 

Most obligations fall on Providers because they control how systems are developed and supplied, while deployers have certain obligations as they are responsible for how systems are used. 

Both roles must take appropriate steps to support AI literacy and meet any transparency requirements that apply to the systems. This includes informing people when they are interacting with AI and labelling certain AI-generated content. 

Additional obligations apply to high-risk systems

Providers of high-risk AI systems must: 

• Register applicable Annex III high-risk systems in the EU database 
• Manage risks and apply appropriate data governance 
• Maintain documentation, event logging, and human oversight 
• Meet accuracyIn data protection terms, the concept of ensuring data is not incorrect or misleading., cybersecurity, conformity, and registration requirements 
• Monitor performance, report incidents and correct problems 
• Appoint an EU authorised Representative if based outside the EU 

Deployers of high-risk AI systems must: 

• Follow the Provider’s instructions and provide effective human oversight 
• Monitor system performance and keep records 
• Check input data (where under organisation’s control) 
• Report serious risks or incidents and suspend use where necessary 
• Inform staff or affected individuals where required 
• Complete relevant impact assessments where required 

What are the requirements for general-purpose models?

Providers of general-purpose AI (GPAI) models have separate obligations covering technical documentation, copyright, transparency and information for organisations using their models. Additional requirements apply to models with systemic risk. Organisations using tools built on these models should still understand the provider, intended use and limitations. 

Checklist to prepare for AI Act compliance

This checklist provides a starting point for reviewing each AI system your organisation develops or uses. The specific steps will depend on the system, your role, and the obligations that apply. 

• Map your AI use: record each system, its purpose and who uses it 
• Confirm your role: identify whether you are a Provider, Deployer, or other operator 
• Classify each system: assess whether it is prohibited, high-risk, or subject to transparency requirements 
• Identify your obligations: confirm which requirements and deadlines apply 
• Review your suppliers: check contracts, documentation and responsibilities 
• Put controls in place: address governance, risk management, human oversight and monitoring 
• Complete any assessments: consider whether an AI Impact AssessmentA structured process used to identify, assess, and mitigate potential risks associated with an AI system before and during its deployment. An AIIA evaluates factors such as fairness, transparency, privacy, and accountability, helping organisations demonstrate compliance with AI regulations and responsible innovation practices., Data Protection Impact AssessmentA formal documented assessment which allows decision-makers to identify, manage and mitigate any data protection risks associated with a project., or Fundamental Rights Impact Assessment is required 
• Support AI literacy: give employees appropriate guidance and training 
• Record and review: document your decisions and revisit them when the system or its use changes 

EU AI Act blog series

Explore the other blogs in our Compliance with the AI Act series: 

• Part 1: EU AI Act timeline and important deadlines 
• Part 2: What is high-risk activity 
• Part 4: Strategies for achieving compliance 

______________________________________________________________________________________________________________________________

Need support with AI governance? 

The DPO Centre’s AI governanceThe framework of policies, processes, and roles that ensure Artificial Intelligence (AI) is developed and used responsibly, ethically, and in compliance with applicable laws, societal expectations, and corporate values.  services can help you understand your obligations, assess AI risks and put appropriate oversight in place. This includes AI Impact Assessments and support from an Outsourced AI Officer. 

______________________________________________________________________________________________________________________________

In case you missed it… 

• A practical guide to updating privacy notices for AI 
• Governing AI Agents: What organisations need to know 
• How to explain AI-generated outputs in a DSAR response 

______________________________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn