EU AI Act & AI Governance

Provider (Art. 3(3) EU AI Act): any entity that develops an AI system, places it on the market under its own name or distributes it as own-brand — irrespective of whether for payment or free of charge. Typical providers are model vendors, AI SaaS platforms and companies that resell a procured model under their own brand. Providers bear the main burden of obligations (risk management, technical documentation, conformity assessment).

Deployer (Art. 3(4) EU AI Act): any entity that uses an AI system under its own authority in a professional context. This role applies to an estimated 90 per cent of all organisations — SaaS users of ChatGPT Enterprise, Microsoft 365 Copilot, Gemini for Workspace or Claude for Work are also deployers and are bound, amongst other things, by the AI literacy obligation under Art. 4 EU AI Act.

Importer and Distributor (Art. 3(6) and (7) EU AI Act): any entity that places an AI system from a third country on the EU market or further distributes it without being the provider. Obligations range from verifying the provider's identity and conformity to maintaining the CE marking and the EU declaration of conformity.

Since 02 February 2025 — Art. 4 AI literacy obligation: providers and deployers must ensure a sufficient level of AI literacy of their staff and of all persons handling AI systems on their behalf. The duty applies to ALL employees with AI exposure — from the case worker using Copilot to the data science team. Content and scope must be tailored to prior knowledge, application context and the categories of persons affected.

From 02 August 2025 — Art. 53 ff. GPAI provider obligations: providers of General-Purpose AI models prepare technical documentation under Annex XI, downstream information under Annex XII and a copyright compliance policy (DSM Directive Art. 4(3)). Where systemic risk is present (training compute exceeding 10^25 FLOPs), additional duties apply: model evaluation, incident reporting and cybersecurity protection.

From 02 August 2026 — Art. 26 deployer obligations and full application of Annex III high-risk: intended-purpose use, human oversight, logging, information of affected persons and, in part, a Fundamental Rights Impact Assessment (FRIA, Art. 27). The Digital Omnibus proposal of 19 November 2025 envisages postponing Annex III to 02 December 2027 — the trilogue is ongoing; the postponement is not confirmed.

Fines (Art. 99): up to EUR 35 million or 7 per cent of the worldwide annual group turnover of the preceding year (whichever is higher) for prohibited practices. For high-risk violations up to EUR 15 million or 3 per cent, and for incorrect information up to EUR 7.5 million or 1 per cent.