AI Act for Companies That Only Use AI: What to Do

If you only use AI in your company, the AI Act (Regulation (EU) 2024/1689) still applies to you, and some obligations are already binding. You are a "deployer": a company that uses someone else's AI tool in its business. Today you must take measures to promote AI literacy, meaning you support people's ability to work with AI sensibly. You do not have to guarantee a specific level of knowledge. You must also respect the prohibitions, and since 2 August 2026 you must follow the transparency rules. Only the requirements for high-risk systems have been postponed.

What applies now and what has moved

The postponement is not blanket. The omnibus, Regulation 2026/1744 published on 24 July 2026, did not remove any category of obligations, according to the French news site ActuIA. It only moved the deadlines for some of them.

The omnibus replaced the European Commission's original proposal, which tied the delay to conditions, with fixed dates. According to the law firm Gibson Dunn, the rules are being postponed, not cancelled.

Step 1: list your AI tools

Start here. The technology company Apertia points out that firms often struggle before regulation even comes into it: management cannot put together a list of the tools the company uses. AI has often entered marketing, support, HR and sales because teams adopted it themselves.

For each tool, record:

• which tools and models are in use, and who is responsible for them,
• which ones talk directly to customers or employees,
• where content for the public is produced,
• which ones decide or recommend in sensitive areas, such as selecting people,
• what data goes in and where it goes,
• whether it is an in-house solution or a vendor's service.

The list tells you which of the other obligations apply to you.

Step 2: train your people and document it

Article 4 requires AI literacy: people should understand AI well enough to judge its risks. The omnibus softened it. Previously, a company had to ensure a sufficient level of knowledge "to the best extent". Now, according to ActuIA and Gibson Dunn, providers and deployers must take measures to promote AI literacy. You do not have to guarantee a specific level of knowledge for every person, but the obligation remains.

It covers employees and anyone else who uses AI on your behalf, including contractors. According to the Commission's FAQ, you do not need a certificate; an internal training record is enough. The Commission also says that when employees use ChatGPT for writing or translation, you must make them aware of the risks, such as invented answers. A user guide for the tool is often not enough.

According to an article on the Czech legal portal epravo.cz, which draws on the Commission's guidance, training should cover:

• what AI is and how it works,
• which tools the company uses,
• what risks they carry,
• what obligations the AI Act places on the company,
• the link to personal data protection (GDPR).

The AI Act does not prescribe the length or format of training. The author of the epravo.cz article recommends training new hires at onboarding and refreshing the training at least once a year. She also recommends keeping attendance sheets and slides, and writing literacy requirements into internal rules and contracts with suppliers.

Step 3: check chatbots and published content

Article 50 has applied since 2 August 2026. According to businessinfo.cz (the Czech government's business information portal) and the law firm Morgan Lewis, it means the following for deployers:

• A customer chatbot or voice agent must tell people they are communicating with AI, unless this is obvious from the circumstances. A simple adjustment is usually enough. This duty falls mainly on the provider, so ask your vendor how they handle it.
• If you publish a deepfake (realistic images, video or audio created by AI), you must disclose it. ActuIA gives the example of a marketing team publishing an AI video of the CEO.
• A similar duty applies to text published to inform the public on matters of public interest. It does not apply if the text went through human review and a specific person is responsible for publishing it.
• If a company uses emotion recognition or biometric categorisation tools, it must inform the people affected.

You do not need to label every email or text that AI has checked. According to businessinfo.cz, the point is transparency where a person could be misled.

Machine-readable marking of content is an obligation of providers of generative tools. For tools placed on the market before 2 August 2026, it is postponed to 2 December 2026. The postponement does not touch deployers' obligations. Morgan Lewis advises asking your vendor how they handle marking and whether they are using the delay.

What is prohibited

The Article 5 prohibitions have applied since February 2025. For employers, according to ActuIA, the key one is the ban on emotion recognition in workplaces and schools, except for medical and safety reasons. An example is a tool that analyses the emotions of call centre staff. Other prohibitions include subliminal manipulative techniques and social scoring.

Two more prohibitions arrive on 2 December 2026: AI systems that create intimate content about identifiable people without their consent, and systems that produce child sexual abuse material. For deployers, the ban applies only if they use a system for such a purpose.

High-risk systems: time to prepare

According to ActuIA, high-risk systems are mainly tools for recruitment and candidate selection, decisions on promotion or dismissal, performance monitoring, and creditworthiness assessment of individuals. Education and biometrics also fall into this group. The requirements apply from 2 December 2027.

As a deployer, you will have to:

• use the system according to its instructions,
• assign human oversight to trained people,
• keep logs, meaning records of how the system operates,
• inform employees and their representatives before deployment (Art. 26(7)).

Gibson Dunn advises using the postponement to prepare. The tool list from Step 1 will show whether you already have such a tool.

Fines and supervision, with the Czech Republic as an example

Fines can reach:

• up to EUR 35 million or 7% of turnover for prohibited practices,
• up to EUR 15 million or 3% of turnover for other obligations, including Art. 50,
• up to EUR 7.5 million or 1% of turnover for providing misleading information to authorities.

Small and medium-sized companies pay the lower of the two amounts. Breaches of Art. 4 are handled under national rules. According to the Commission, supervision of it lies with national authorities, not the European AI Office.

Each member state sets up its own enforcement. In the Czech Republic, the Ministry of Industry and Trade has prepared a minimalist draft law. It does not restate the obligations from the regulation and deals only with supervision, procedure and sanctions. According to the Czech law firm Dostupný advokát, the draft makes the Czech Telecommunication Office the main supervisor. The Czech National Bank would oversee the financial sector, and the Office for Personal Data Protection would play a role where AI meets personal data. For less serious breaches, the draft provides for a warning and a deadline of at least 15 days to put things right.

Questions for management

• Do we have a list of all AI tools, including those teams adopted on their own?
• For each one, do we know who is responsible and what data goes into it?
• Have the people who work with AI been trained, and do we have a record of it?
• Does our chatbot tell customers it is AI?
• Do we have a rule on who approves publishing AI images, videos and voices?
• Do we use a tool that recognises employees' emotions? In the workplace this is prohibited except for medical and safety reasons, and even then we must inform the people affected.
• Do we use AI in selecting or evaluating people? If so, start planning for 2027.
• Have we asked our vendors how they meet their obligations and how they label generated content?

AI agent use cases for companies by industryData security when you deploy AI in your company

Prepared by AI from the listed sources and checked automatically against them. Not legal advice.