The AI Act has no size threshold. It applies by role and by territory, and the moment people in your company use AI for work, your organisation is a deployer with obligations of its own. What those obligations are depends on what the AI decides — not on how large you are.
Neither of them is about your size.
Do people in your organisation use AI in the course of their work?
You are a deployer.
This is nearly every company, and it is the answer most organisations get wrong. Not building AI makes you not a provider. It does not put you outside the Act.
Do you place an AI system on the market, or put one into service under your own name?
You are a provider.
Substantially heavier obligations, and you can arrive here without intending to — see below.
Do you import, distribute, or sell a product with AI built into it?
You are also in scope.
Importers, distributors, product manufacturers and authorised representatives each carry their own duties.
This is why the Act reaches suppliers who have never had an EU entity, and why where a system runs is a question your auditor will ask.
Nothing in the Act works like the employee or turnover thresholds in other EU regulation. Small and medium enterprises get lighter ways to comply — simplified technical documentation, regulatory sandboxes, fines scaled to their size — not an exemption from complying.
Two of these dates moved in July 2026. The one that is already enforceable did not.
Every provider and every deployer, at every risk level. Reasonable measures so the people who use AI understand what it can and cannot do.
Everyone.
Model providers, and the enforcement machinery behind everything else.
Tell people when they are dealing with AI. Mark synthetic content. Enforceable now by national authorities, with fines to €15M or 3% of worldwide turnover.
Grace period for generative systems already on the market before August 2026.
Human oversight, monitoring, informing workers — and keeping the system's automatic logs for at least six months.
Machinery, medical devices, vehicles and the rest of the product safety regime.
The December 2027 and August 2028 dates were moved by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. The transparency obligations were not moved — a distinction a lot of published guidance still gets wrong.
High risk is defined by what the system decides about people, not by how advanced it is. These are the Annex III areas an ordinary business actually touches.
Screening applications, allocating tasks, monitoring performance, decisions on promotion or termination.
Creditworthiness assessment, and risk pricing for life and health insurance.
Admission, assessment of learning outcomes, proctoring.
Remote identification, biometric categorisation, emotion recognition.
A manufacturer that lets an AI tool shortlist candidates is the deployer of a high-risk system. Very few of them know it.
The third column is the honest one. No platform makes an organisation compliant, and any vendor whose table has only two columns is selling you something.
| The obligation | What Tandevia records or enforces | What stays with you |
|---|---|---|
| AI literacyArticle 4 | A record of who uses which model, for what, and how often — so training can be aimed at the people and tasks that need it. | Deciding what your staff need to understand, and actually teaching them. |
| Knowing what AI you haveThe precondition for all of it | Every request attributed to a person, team, application or agent, across commercial, open-weight and self-hosted models. | Classifying each use against Annex III and deciding your risk tier. |
| Transparency to peopleArticle 50 | Which models an application may reach, so a customer-facing assistant cannot quietly be switched to an undeclared one. | Writing the disclosure into the interfaces your customers actually see. This is a property of your front end, not of the layer beneath it. |
| Human oversightArticle 26(1) | Approval gates in Workflow Studio, with the approver, the moment and the decision recorded against each run. | Choosing which steps need a person, and giving that person real authority to refuse. |
| Keeping the logsArticle 26(6) | A queryable record of every request, model, decision and cost, with configurable retention — including what was held back from a model, exportable as a document. | Setting retention to at least six months, and reconciling that with your data-protection rules. |
| Monitoring operationArticle 26(5) | Usage, cost and policy decisions per team and application, with alerts before a ceiling is reached. | Acting on what the monitoring shows, and reporting serious incidents. |
| Using it as instructedArticle 26(1) | An approved model catalogue per team. Unapproved models are unavailable rather than discouraged. | Reading the provider's instructions for use and configuring to match. |
| Input data governanceArticle 26(4) | Inspection before content leaves your network, and of content coming in from external sources before a model reads it — applied by policy. | Deciding what may be sent at all, and to whom. |
One thing to check against your own plan: Article 26(6) sets a floor of six months for a high-risk deployer's logs. On Tandevia that means Business or Enterprise retention — the Team plan keeps three months, which is below the floor.
Three routes turn a deployer into a provider. When any of them applies, the provider obligations in Article 16 become yours and the original supplier stops being the provider of that system.
The third is the one that catches ordinary companies. Building an automation that screens job applicants out of a general-purpose model is exactly that change of purpose — and it is a decision usually made by a team that has never read the Act.
This is a map, not legal advice. Nothing here makes an organisation compliant, and no product can — classification, training, disclosure and accountability stay with you. Check your own position with your own counsel.
Reflects the law as at September 2026, including Regulation (EU) 2026/1744. The AI Act is still moving; this page is dated for that reason.
You cannot classify, evidence or train for AI use you cannot see — and that is true whichever obligations turn out to apply to you. It is also the part that takes longest, which is why the deferral to December 2027 is time to use rather than time to wait.