The EU AI Act does not apply one identical set of duties to every AI project. The relevant obligations depend on the system, intended purpose, organisational role and applicable provisions.
Start by identifying what the system does and which role your organisation occupies. Then assess the current consolidated law and related rules with the people responsible for legal and regulatory decisions.
Identify the system and the actor
A business using an AI application may be a deployer, while another party is its provider. Developing, placing a system on the market or making certain modifications can change the analysis. General-purpose AI models have their own provisions.
Document the intended use, users, affected people and decisions the system supports or makes. Record the model, application, connected tools and responsible suppliers separately.
Do not infer an organisation’s legal role from whether its engineers wrote an integration or whether the model is open-weight. The statutory definitions and actual arrangement matter.
Classify the use case carefully
An application is not automatically high risk because a financial-services organisation uses it. The Act identifies particular categories and conditions, including uses listed in its annexes and specified product-related systems.
For example, a knowledge-search tool and a system used to assess creditworthiness can have materially different purposes. A label such as “internal assistant” does not settle classification if its actual use affects consequential decisions.
Prohibited practices, high-risk systems, transparency obligations and general-purpose model rules need separate assessment. Do not collapse them into a single maturity score or a generic “compliant AI” badge.
Use the current application dates
As of this November 2026 refresh, the Commission’s guidance and consolidated legislation reflect the AI Omnibus that entered into force on 27 July 2026. The main high-risk dates are now:
- 2 December 2027: the relevant Annex III high-risk rules.
- 2 August 2028: Article 6(1)/Annex I product-related high-risk rules.
Other provisions have their own application dates, and some already apply. The earlier statement that all high-risk duties apply from August 2026 is therefore not a reliable summary.
Check the Commission’s current guidance and the consolidated regulation before setting a project deadline. Avoid treating an old press release or unofficial checker as the operative law.
Translate obligations into project evidence
Once applicability is established, identify the records and controls the project must produce. Depending on the role and system, relevant work may include risk management, data governance, documentation, logging, human oversight and monitoring.
The provider and deployer responsibilities are not interchangeable. An ordinary API customer should not assume it has every obligation of a model developer, nor assume that its provider’s documentation covers the customer’s own use.
Map each applicable requirement to an owner, an implementation measure and evidence. Record gaps explicitly. A diagram showing an approval gate is not proof that the deployed application enforces it.
Keep GDPR and other requirements separate
The AI Act does not replace privacy, employment, consumer, sector or contractual duties. GDPR requirements depend on the processing and legal basis; not every processing activity requires explicit consent.
GDPR Article 22 addresses certain solely automated decisions producing legal or similarly significant effects, subject to its conditions and exceptions. Adding a nominal review button does not establish meaningful human involvement.
Likewise, private hosting does not resolve every requirement. Data location, model transparency, documentation, testing and human responsibilities are different questions.
Plan change control
A changed purpose, new model, additional tool or deployment in another setting can affect the assessment. Maintain a record of the approved scope and revisit it when the actual use changes.
Our AI Security and Governance work can help implement and test agreed technical controls. Legal classification and conformity decisions remain with the accountable organisation and its advisers. This article is a project-scoping guide, not a legal opinion or certification.
Written by Anshul Kaushik, Managing Director at Ryzolv.
Back to Insights