EU AI Act

The EU AI Act is Regulation (EU) 2024/1689. It sets rules for AI systems placed on the EU market or put into service in the EU, and it classifies those systems by risk. Its duties fall on roles in the supply chain: providers that develop or place a system on the market, and deployers that use a system under their authority. The Regulation was amended in 2026 by Regulation (EU) 2026/1744, which changed several application dates and the wording of some duties.

The Act's definitions decide who is covered. A deployer, for example, is defined as a person or body "using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity". An agent that a company builds and runs is therefore usually a deployer, even when another company supplied the model.

In practice

Start with the use case. The Act's duties depend on what a system is used for, not on the technology inside it. The same agent can carry few duties in one use and high-risk duties in another. Classification comes first, and the duties follow from it.

Read the consolidated text, not summaries. The 2026 amendment changed dates and wording, and several commentaries describe the older version.

Example

[Composite] A company used the same drafting agent for internal memos and for pre-screening job applicants. The memo use carried few duties. The screening use fell in the employment area of the high-risk list, which brought the deployer duties into scope. The company split the two uses into separate systems with separate controls.

Common mistakes

• Classifying the technology rather than the use.
• Relying on a summary of the amended text rather than the consolidated text.
• Treating an internal tool as outside the Act without checking its use.