Does the EU AI Act apply to my company?

If your company builds, sells or uses an AI system in the EU, or the output of its AI is used in the EU, the EU AI Act (Regulation (EU) 2024/1689) almost certainly applies to you in some role, most often as provider or as deployer. For most small companies that only use AI tools, the duties that matter today are the Art. 4 AI literacy duty and, since 2 August 2026, the Art. 50 transparency duties in the cases where they apply. High-risk duties come later and only concern specific uses.

Does the AI Act apply to a company that only uses AI tools?

Yes, as a deployer. A deployer is a company that uses an AI system under its own authority in a professional context (Art. 3(4)). Using a vendor's chatbot, a writing assistant, a meeting transcriber or an AI coding tool counts. You did not build it, and you are still in scope.

Being a deployer does not mean being under every duty in the Regulation. Most deployer duties are tied to specific uses. Art. 4 (AI literacy) is the exception that reaches every provider and deployer, at every risk level.

Does it apply if we are outside the EU?

Yes, in two situations. The Regulation applies to providers who place AI systems on the EU market, wherever they are established (Art. 2(1)(a)), and to providers and deployers in a third country when the output of their AI system is used in the Union (Art. 2(1)(c)). The test is whether the system is placed on the market or put into service in the Union, or whether its output is used there, not where your company is registered.

Counter-examples. A company outside the EU that runs AI only for its own local customers, with no output used in the EU, is not caught by that reading. A company outside the EU that sells an AI-powered product to EU customers is. If your case sits between the two, the Art. 2 text decides it, not a rule of thumb.

Are small companies and startups exempt?

No. The AI Act has no blanket exemption for small companies or startups. Duties follow the role you play and the use you make of AI, not your headcount. What size changes is the penalty cap: for SMEs, including start-ups, each fine ceiling is the lower of the two amounts, not the higher (Art. 99(6)). Since the Digital Omnibus, small mid-caps get the same lower-of rule for the Art. 99(4) and 99(5) ceilings (Art. 99(6a)). The details sit in the penalties section of our risk tiers guide.

Counter-example. A three-person agency that uses a chatbot platform on its website and an image generator for client work has the same kind of duties as a larger company in the same position. The duties are few: Art. 4, and Art. 50(4) where an image it publishes is a deepfake.

Is purely internal use covered?

Yes. The definition of deployer asks whether you use the system under your authority in a professional context. It does not ask whether the output reaches customers. An internal note-taking assistant or an HR drafting tool is still a system you deploy.

Counter-examples. An employee's private use of a consumer tool outside work is not your company's use. And Art. 2 contains a short list of exclusions. They are narrow and carry conditions. Read the exact wording in the Regulation before you rely on one.

Provider or deployer: which role are we?

You are a provider if you develop an AI system, or have one developed, and place it on the market or put it into service under your own name or trade mark, whether for payment or free of charge (Art. 3(3)). You are a deployer if you use a system under your own authority in a professional context (Art. 3(4)).

Most companies are deployers of other people's systems. You can be both: a SaaS company that builds an AI feature into its product is a provider of that feature, and a deployer of the AI tools its staff use. The role is set per system, not per company.

Which duties apply to us today?

For a typical small deployer, these apply today, and one more comes later.

• Art. 5, prohibited practices. Apply to every provider and deployer since 2 February 2025. Few companies come near them, but read the list once.
• Art. 4, AI literacy. In force since 2 February 2025, text replaced by the Digital Omnibus in July 2026. Providers and deployers take measures to support the development of AI literacy of the staff and others who operate AI on their behalf. The duty does not require guaranteeing a specific level for any individual (Art. 4(1)). Our Art. 4 guide explains what that means in practice.
• Art. 50, transparency. Applies since 2 August 2026 and was not deferred. If you use AI to generate or manipulate deepfake image, audio or video content, or AI-written text published to inform the public on matters of public interest, you disclose it as such; text under human review and editorial responsibility is exempt (Art. 50(4)). If you use emotion recognition or biometric categorisation, you inform the people exposed to it (Art. 50(3)). The duty to build chatbots so that people know they are dealing with AI sits with the provider (Art. 50(1)). If you build your own chatbot on a model API and offer it under your own name, that provider may be you (Art. 3(3)). A grace period to 2 December 2026 covers only the machine-readable marking of outputs, and only for systems placed on the market before 2 August 2026 (Art. 111(4)). The Art. 50 guide has the detail.
• High-risk systems (Art. 6 with Annex III). Deferred to 2 December 2027 by Regulation (EU) 2026/1744. They concern specific uses such as recruitment screening or credit scoring, not AI use in general. See the timeline for every date.

Providers carry more: obligations such as Art. 16 for high-risk systems, and the Art. 50(1) design duty above. Deployers of high-risk systems carry their own set in Art. 26, once those rules apply.

What are the penalty brackets?

Art. 99 sets three ceilings: one for prohibited practices (Art. 99(3)), one for most operator duties including Art. 16, Art. 26 and Art. 50 (Art. 99(4)), and one for supplying incorrect information to authorities (Art. 99(5)). SMEs get the lower-of rule in Art. 99(6); small mid-caps get it for Art. 99(4) and 99(5) under Art. 99(6a). We do not repeat the figures here. They are in the penalties section of the risk tiers guide, with the article numbers.

Five-question self-check

1. Do we build or sell a product or service that contains AI, in the EU or to EU customers? If yes, we are most likely the provider of that system, or its importer or distributor if we resell someone else's under their name.
2. Do our staff use AI tools for work (chatbot, writing, images, transcription, code)? If yes, we are a deployer, and Art. 4 applies.
3. Do we publish AI-generated images, audio, video or AI-written public-interest text? If yes, check Art. 50.
4. Does any AI we use or build decide about people, for example hiring, credit or access to services? If yes, check Annex III before 2 December 2027.
5. Is the company outside the EU, and is our AI output used in the EU? If yes, the Regulation can reach us anyway.

Klariq's free five-question classifier runs through this for your setup and returns your risk category and the obligations with their article numbers.

Frequently asked questions

Does the AI Act apply to B2B companies only, or also to consumer products?

Both. The Regulation is about the AI system and the roles around it, not the customer type. A provider of a consumer app and a provider of a B2B tool are both providers.

Does it apply if we only use free AI tools?

Yes. Price does not change the role. If your company uses the tool under its own authority in a professional context, you are a deployer.

Our employees use ChatGPT on their own. Are we a deployer?

Likely yes, where they use it for work with your knowledge or at your direction: that is use under your authority (Art. 3(4)). Use you do not know about is a grey area the text does not settle. A short acceptable-use rule and an Art. 4 training measure turn it into use you know about. Our AI policy guide shows what such a rule contains.

Sources

• Regulation (EU) 2024/1689 (EU AI Act), full text including Articles 2, 3, 4, 50 and 99: eur-lex.europa.eu
• Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689, published in the Official Journal on 24 July 2026, in force 27 July 2026: eur-lex.europa.eu

Read next

• EU AI Act risk tiers explained
• EU AI Act timeline: what applies when
• What must an AI chatbot disclose under Article 50?
• What changed on 2 August 2026