EU AI Act: 3 checks that decide your compliance risk
Yuri VonchitzkiUpdated 6 min readIn April and May 2026, I had two consultations that show the two extreme ends of the EU AI Act risk spectrum. The EU AI Act is the European Union law that regulates AI systems by their level of risk.
The first client was a medical institution. It wanted to integrate AI into both clinical and administrative workflows. We spent 90 minutes sorting out what was safe to deploy right away. Scheduling, billing, transcription and HR were good to go. AI-assisted diagnosis, treatment planning and patient risk scoring were off the table until the institution has a solid compliance framework, and definitely not before the original August 2, 2026 deadline.
The second client was a judge. He wanted to know if he could use AI to process case documents. The answer was a specific "yes, but". Legal research and summarization are permitted if strict quality assurance catches hallucinations. AI for evidence analysis, sentencing support or pretrial detention scoring is high-risk and needs a full compliance framework first. Under the Act, judicial AI is classified as high-risk by default.
Those are edge cases. For most businesses, EU AI Act compliance is much simpler. In July 2026, the EU moved the deadline for the Annex III high-risk obligations to December 2, 2027. Before that date, check three things: your role under the Act (User, Deployer or Provider), whether you trip any prohibited practice, and, if you build AI for clients, your contract clauses.
The May 7 agreement moved the high-risk deadline
On May 7, 2026, the EU Council and Parliament reached a provisional political agreement to delay the Act's Annex III high-risk obligations to December 2, 2027. Annex III is the part of the Act that lists the high-risk use cases. In May, the agreement was not law yet. Gibson Dunn warned that the changes "only take legal effect upon formal adoption and publication of the Omnibus in the Official Journal."
That step is now done. According to the Future of Privacy Forum, Parliament adopted the AI Omnibus on June 16, 2026, the Council adopted it on June 29, and it was published in the Official Journal on July 24, 2026. The Annex III high-risk obligations now apply from December 2, 2027. High-risk AI inside products covered by Annex I moves to August 2, 2028.
Not everything moved. The prohibited practices have applied since February 2, 2025. The Omnibus adds two more, on AI-generated child sexual abuse material and non-consensual intimate images, from December 2, 2026. Most of the Article 50 transparency duties, including the duty to tell people that they talk to an AI, apply from August 2, 2026, as planned.
The three EU AI Act roles and their obligations
The EU AI Act does not look at your industry or your company size. It assigns obligations by your role. Your role decides how much work you have ahead of you.
| Role | Who it is | Examples | What you must do |
|---|---|---|---|
| User | You use off-the-shelf AI tools for internal operations | ChatGPT for copywriting, Claude for document summaries, Cursor for coding, Notion AI for your knowledge base | Screen for the prohibited practices in Article 5. GDPR covers data privacy. |
| Deployer | You configure or run an AI system for a specific purpose, often customer-facing | Customer-facing chatbots, AI phone agents, medical transcription tools | User obligations, plus a clear AI disclosure at the start of each interaction |
| Provider | You build and market AI systems | An automated hiring tool that ranks candidates, a credit-risk scoring engine in a SaaS product | Conformity assessments, registration, system logging, human oversight documentation |
Users have minimal obligations. Screen your use against the prohibited practices in Article 5 and make sure you do none of them. Standard GDPR handles your data privacy. You have no registration, no complex assessment and no heavy documentation.
Deployers have one extra step beyond the User obligations. Article 50 of the Act requires that people are told they are interacting with an AI, "at the latest at the time of the first interaction". As the Deployer, make sure your setup does this. One clear sentence per touchpoint is usually enough.
Providers carry the full weight of compliance. For a Provider, the December 2, 2027 deadline is a serious matter. Get specialist legal counsel now. A generalist who handles your standard GDPR work is not enough.
How agencies get misclassified as Providers
Agencies and no-code implementation partners often fall into a trap: they think they are contractors, but the law can see them as Providers.
The trap works like this. You integrate AI into a system that makes decisions about your client's customers in a regulated area, such as hiring, credit scoring, healthcare data or legal proceedings. The law can then treat you as a Provider, not as a service contractor. If you build the same AI workflow for ten clients, you can carry Provider obligations that each client assumed you were handling.
The fix is a contract clause. Add a clause to your standard contract that states the client is the Deployer and owns compliance once you deliver the system. Without that written statement, the liability gap sits between you and your client with no agreed owner. I explain what this clause looks like in practice in Section 7A of the EU AI Act Compliance Checklist. If your build includes AI agents, the same logic applies to the agentic liability clause.
How to check your EU AI Act compliance
Everything depends on one question: are you a User, a Deployer or a Provider? Follow these steps.
- Find your role. Answer the three role questions at the top of the free EU AI Act Compliance Checklist. You will know your group before you reach page two.
- Screen for prohibited practices. Check every AI use in your business against the prohibited practices in Article 5. Do this whatever your role is.
- Follow the path for your role. For most Users, the rest of the process takes less than five minutes. For most Deployers, the full self-assessment takes under an hour. If you run customer-facing AI or build AI products for clients, block a structured afternoon.
- Fix your contracts if you build for clients. Name the client as the Deployer in writing.
- Bring in a specialist if you are a Provider. Use the checklist together with a specialist lawyer, not as a replacement for one.
The bottom line
Knowing your category gives you clarity. Before December 2, 2027, you do not have to comply with something enormous. You answer one question about your role, then you follow the path for that role. Most businesses only needed someone to show them where the question starts.
If you want the bigger picture before you add more AI to your operations, read 5 rules to stop an AI agent from damaging your live data.
Build a calmer business,Yuri
Frequently asked questions
Did the May 7, 2026 agreement delay the EU AI Act high-risk deadline?
Yes, once it became law. On May 7, 2026, the EU Council and Parliament reached a provisional political agreement to delay the Annex III high-risk obligations of the EU AI Act. Parliament adopted the AI Omnibus on June 16, 2026, the Council adopted it on June 29, and it was published in the Official Journal on July 24, 2026. The Annex III high-risk obligations now apply from December 2, 2027. The existing prohibited practices and most Article 50 transparency duties did not move. The Omnibus adds two new prohibited practices from December 2, 2026.
What are the three roles under the EU AI Act?
The EU AI Act assigns obligations by role, not by industry or company size. A User runs off-the-shelf AI tools for internal work. A Deployer configures or runs an AI system for a specific purpose, often customer-facing. A Provider builds and markets AI systems. Users have the fewest obligations, and Providers carry the full compliance weight.
What does a business that only uses ChatGPT or Claude internally need to do under the EU AI Act?
A business that uses off-the-shelf tools such as ChatGPT, Claude, Cursor or Notion AI for internal work is a User under the EU AI Act. A User screens its use against the prohibited practices in Article 5. GDPR covers the data privacy side. A User has no registration, no conformity assessment and no heavy documentation to prepare.
Can an agency or no-code implementer become an AI Provider under the EU AI Act?
Yes. An agency that integrates AI into a system that makes decisions about its clients' customers in regulated areas, such as hiring, credit scoring, healthcare data or legal proceedings, can be classified as a Provider. To avoid this, the agency's standard contract should state that the client is the Deployer and owns compliance after delivery.
What must a Deployer do under the EU AI Act?
A Deployer under the EU AI Act, for example a company that runs a customer-facing chatbot, an AI phone agent or a medical transcription tool, has one step beyond the User obligations. Article 50 requires that people are told they are interacting with an AI, at the latest at the first interaction. As the Deployer, make sure your setup does this. One clear sentence at each touchpoint is usually enough.