Deployer (EU AI Act)
Definition under Art. 3(4) EU AI Act — who uses AI systems
TL;DR
A deployer under Art. 3(4) EU AI Act is a natural or legal person, public authority or other body that uses an AI system under its own authority — except where it is used in the course of a personal, non-professional activity. 90 % of SMEs are deployers only.
What is a deployer under the EU AI Act?
Deployer obligations:
- Art. 4 AI literacy: since 2 February 2025 — training of staff (mandatory)
- Art. 5 prohibitions: ensure that no system in use carries out prohibited practices
- Art. 26 deployer obligations for high-risk systems for Annex III systems from 2 December 2027, and for Annex I systems from 2 August 2028 (Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026): use in accordance with the instructions, checking the relevance of input data, keeping logs, informing employees
- Art. 27 FRIA for certain deployers (public bodies, credit scoring) in the case of Annex III systems: from 2 December 2027 (Chapter III Section 3, Regulation (EU) 2026/1744)
- Art. 50 transparency from 2 August 2026: watermarking, chatbot notices, deepfake disclosure
Practical example
Practical use cases as a deployer:
- ChatGPT for marketing copy → deployer, AI literacy obligation
- Microsoft Copilot in M365 → deployer, and possibly high-risk use cases
- An HR recruiting algorithm from an external supplier → deployer and high risk (Annex III no. 4a) from 2 December 2027 (Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026)
- Gemini for code generation → deployer, AI literacy
Frequently asked questions
Do I become a provider if I integrate Copilot deeply?
Not necessarily. As long as Microsoft remains identifiable as the provider and there is no substantial modification, you remain a deployer.
Do I need an acceptable use policy?
Not as a strict requirement of the AI Act. BUT: it is best practice, and it links to the GDPR (Art. 5) and to the AGG (§ 22 AGG reversal of the burden of proof for AI recruiting). The Compliance-Kit provides a template.
What applies to high-risk deployers from 12/2027?
Obligations: use in accordance with the instructions, keeping logs (Art. 26), checking the relevance of input data, where applicable a FRIA (Art. 27), and informing employees and affected persons.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.