Your company is based in the United States. Half your customers are in Germany and France. You deploy a third-party hiring screener, a customer support chatbot, and a general-purpose writing assistant. The EU AI Act does not care that you did not train the models. If you deploy AI in the EU market, deployer obligations may apply to your use case regardless of vendor headquarters.
EU AI Act tool buyers need a risk-tier map, not a legal treatise. This guide summarizes the Act for deployers (organizations that use AI, not build foundation models), explains risk categories with commercial tool examples, details obligations for high-risk use cases, covers documentation and human oversight requirements, and outlines timeline and enforcement considerations. Review AI chatbot tools and AI API platforms against EU deployer duties before expanding EU operations.
EU AI Act Overview for Deployers Not Developers
The EU AI Act regulates AI systems placed on the EU market or used in the EU, with different rules for providers (developers), deployers (users), importers, and distributors. As a buyer deploying third-party SaaS AI, you are typically a deployer. Providers owe conformity assessments and technical documentation for high-risk systems they place on market. Deployers owe correct use, monitoring, transparency, and cooperation with authorities.
General-purpose AI (GPAI) models have separate provider obligations (transparency, copyright policies, systemic risk for the largest models). Deployers still must know if their vendor's GPAI model meets provider requirements and whether their specific application triggers high-risk classification.
Risk Categories and Examples in Commercial Tools
Risk tier depends on intended purpose, not marketing category. The same chatbot API is minimal risk for internal brainstorming and potentially high risk if used to evaluate job applicants.
| Risk tier | Commercial tool example | Deployer obligation summary |
|---|---|---|
| Unacceptable (banned) | Social scoring, manipulative subliminal techniques, real-time biometric ID in public spaces (with exceptions) | Do not deploy; contractual prohibition |
| High risk | CV screening, credit scoring, employee performance monitoring, access to essential services | Use per instructions, human oversight, logging, incident reporting, registration where required |
| Limited transparency | Chatbots, emotion recognition, deepfake generation, biometric categorization | Inform users they interact with AI; label synthetic content |
| Minimal risk | Spam filters, AI-enabled video games, inventory optimization without rights impact | Voluntary codes of practice; general product safety laws still apply |
Obligations for High-Risk Use Cases
High-risk deployers must use the system according to provider instructions, ensure human oversight, monitor operation, keep logs, and report serious incidents. Before procurement, request the provider's EU declaration of conformity, instructions for use, and technical documentation summary. Your legal team maps these to internal policies.
- Assign trained staff to interpret outputs and intervene when needed.
- Do not use the tool outside the provider's stated intended purpose without reassessing risk classification.
- Maintain logs of operation for periods specified in the Act (where applicable).
- Conduct fundamental rights impact assessments for certain public-sector high-risk deployments.
- Cooperate with market surveillance authorities and provide access to logs on request.
Documentation and Human Oversight Requirements
Documentation is the deployer's evidence of lawful use. Maintain records of: why the system was classified at its risk tier, vendor conformity documents, training materials for staff, monitoring results, incidents and corrective actions, and changes to configuration or purpose that might reclassify risk.
Human oversight means more than a human clicking approve on every row. It requires competence to recognize errors, authority to override, and escalation paths when the system performs outside acceptable bounds.
Timeline and Enforcement Considerations
The EU AI Act entered into force in 2024 with staggered application dates. Prohibitions on unacceptable-risk practices and GPAI obligations for providers phase in before full high-risk system requirements for many product categories. Deployers should track European Commission guidance and national implementing acts in each EU member state where they operate.
Penalties can reach significant percentages of global turnover for serious violations. Even before maximum fines apply, contract loss and reputational damage from non-compliance affect EU market access.
Frequently Asked Questions
Do U.S. companies without EU offices need to comply?
If you deploy AI that affects people in the EU (customers, employees, users), deployer obligations may apply regardless of corporate headquarters. Selling to EU customers through a SaaS product often triggers review even when you have no physical EU entity.
How do GPAI model rules affect buyers of general chat APIs?
Providers of GPAI must meet transparency and documentation duties. Deployers should verify provider compliance for models embedded in purchased tools and still independently assess whether their application is high-risk. Buying a compliant API does not automatically make every downstream use compliant.
What contract clauses should EU deployers require?
Require EU AI Act conformity documentation for high-risk systems, incident notification SLAs, cooperation with authority requests, change notification for model updates affecting risk profile, and clear intended purpose statements limiting unauthorized use cases.
Is a customer support chatbot always limited-risk?
Transparency duties for chatbots apply when users interact with AI unless obviously artificial. If the chatbot makes or influences decisions in employment, credit, or essential services, classification may rise to high risk. Purpose determines tier, not the word "chatbot."
