Most businesses that ask whether the EU AI Act applies to them are not building AI. They are using it: a chat assistant for drafting, an AI note-taker, a screening add-on. The Act still has something to say about that.
Step 1: are you a deployer?
The Act (Regulation (EU) 2024/1689) defines a deployer as a person or organisation using an AI system under its own authority, except for purely personal, non-professional use. If your staff use AI tools for work, your business is a deployer of those tools. A company that builds or sells an AI system is a provider, and carries heavier duties.
Step 2: the territorial test
Article 2(1) reaches deployers that are established or located in the EU. It also reaches providers and deployers in a country outside the EU where the output of the AI system is used in the EU. So a business outside the EU is not automatically out of scope.
Step 3: which duties could apply?
Which duties come into play depends on what you use AI for. In broad terms:
- AI literacy (Article 4). Providers and deployers take measures to support the AI literacy of staff and others using AI on their behalf. It applies to organisations that use AI tools, whatever the use. Free kit and lessons.
- Prohibited practices (Article 5). A short list of banned uses, such as certain manipulative techniques and social scoring.
- Transparency (Article 50). For example, people who talk to an AI system such as a chatbot, and AI-generated content that has to be marked.
- High-risk systems (Annex III). Uses such as hiring or credit decisions. These carry the heaviest duties and, after the Digital Omnibus, apply later than first planned (see what still applies).
Step 4: write down what you use
Every one of those duties depends on knowing which AI tools you use and for what. That list is an AI inventory. Start with the tools people actually use, including AI features inside software you already have (shadow AI).
Frequently asked questions
We only use ChatGPT or Copilot. Are we in scope?
Probably, if the territorial test below is met. The AI Act calls a business that uses an AI system under its own authority in a professional setting a deployer. Deployers have duties too, though they are lighter than a provider's.
We are not in the EU. Can it still apply to us?
It can. Article 2(1) also covers providers and deployers established in a third country where the output produced by the AI system is used in the EU. Whether that fits you depends on the facts.
Does being small exempt us?
No general exemption for small businesses appears in the scope rules. Some provisions take company size into account, for example how fines are set, so read the specific duty rather than assuming either way.
Is this legal advice?
No. It is general information. Check your own situation with counsel.
Check where you stand
Our free check asks a few questions and shows which kinds of duty may apply. No account needed. Free EU AI Act check →