The EU AI Act for mid-sized companies: what you actually have to do

Key takeaways

• The regulation distinguishes providers from deployers. Anyone using AI in their own business is a deployer with obligations of their own.
• The AI literacy obligation under Article 4 has applied since 2 February 2025, regardless of company size.
• Since 2 August 2026 the regulation is in principle fully applicable.
• Deadlines for high-risk systems have been shifted several times during the legislative process — worth checking against the current state.
• Typical mid-market applications are mostly low risk; it becomes critical where AI decides about people.

Provider or deployer — and why that makes the difference

Regulation (EU) 2024/1689 attaches obligations to roles. A provider develops an AI system and places it on the market under their own name. A deployer uses an AI system under their own responsibility. The vast majority of mid-sized companies are deployers — and that is by far the lighter role.

Lighter does not mean without consequence, though. Deployers must use systems as intended, follow the provider's instructions, ensure human oversight for certain systems and be transparent about where people interact with AI. And they are subject to the literacy obligation.

One point deserves attention: anyone who substantially modifies a purchased system or redistributes it under their own name can become a provider themselves — with considerably broader duties. Anyone building their own assistants on top of language models and offering them to customers should check this.

The literacy obligation: the rule that really affects everyone

Article 4 requires deployers to ensure a sufficient level of AI literacy among the people working with the systems. This is deliberately open-ended and should be scaled by role, prior knowledge and use case — there is no prescribed curriculum and no mandatory certificate.

In substance it is about what actually goes wrong in daily use: that employees understand how a language model arrives at its answers, why it can be convincingly wrong, which data they may feed into it and which not, and that responsibility for a result stays with the human. Good training on this does not take a week — it just has to happen and be documented.

Which systems become critical in mid-market companies

The regulation works with risk classes. Only a few clearly defined practices are prohibited — social scoring or emotion recognition in the workplace, for example. Systems in critical infrastructure, education, employment as well as creditworthiness and insurance count among the high-risk category.

For most mid-market applications this is reassuring: a Copilot summarising emails, a chatbot answering standard questions, a classification of incoming documents — these are typically low-risk systems, in part with transparency obligations.

It becomes critical as soon as AI decides about people or materially prepares such decisions. The most prominent mid-market example is recruiting: software that pre-sorts or scores applications falls into the high-risk area. Performance evaluation and credit checks are similarly sensitive. Anyone using or planning such tools should examine this early and deliberately.

A pragmatic implementation path

Don't start with the legal text but with reality. Four steps are enough to begin with:

• Build an inventory: which AI features are actually in use — including tools business units run without IT approval?
• Classify per system: which risk class, which role, which personal data is involved?
• Interlock with GDPR: data flows, legal basis, processing agreement — the two frameworks mesh together.
• Rules and training: an understandable usage policy plus an instruction session that satisfies the literacy obligation.

Frequently asked questions

Do we need an AI officer?

The regulation does not mandate a dedicated function like the data protection officer. In practice it still helps to name responsibility clearly — otherwise nobody looks after the inventory and reviews. The role is often attached to existing compliance or IT responsibilities.

Is banning ChatGPT in the company enough?

Experience says no — it merely shifts usage to private devices and accounts, where you have neither control nor evidence. More effective is an approved, privacy-compliant route plus clear rules on which data has no place there.

Does the AI Act also cover software we introduced before 2025?

In principle yes, although the regulation provides differentiated transitional rules for existing systems. Since these deadlines have been adjusted several times during the legislative process, the assessment should be made case by case against the current state of the law.