The European AI regulationopens in a new tab is written largely for the people who build the systems. A professional firm does not build them: it uses them. The pages that concern it are few, and it is worth knowing which.
The role: not provider, but deployer
The regulation distinguishes between placing an AI system on the market and using one under your own authority in the course of a professional activity. A firm buying a subscription to an assistant is in the second category, the one the regulation calls the deployer.
The distinction matters because almost all the heavy obligations, conformity assessment, technical documentation, quality management system, marking, sit on the provider’s side. A professional who bought a system and resold it under their own brand would change category, and that is the case to keep in mind before adding an “assisted” feature to your own service.
The dates, in order
The regulation did not start applying all at once. From 2 February 2025 the prohibitions on banned practices and Article 4 on AI literacy apply. From 2 August 2025 the governance rules, the rules on general purpose models and the Chapter XII penalties apply. From 2 August 2026 the Article 50 transparency duties and the full penalty regime apply, with national authorities operating at full powers.
And then there is the date that changed after it had been written down. The package known as the digital omnibus, Regulation (EU) 2026/1744opens in a new tab, published on 24 July 2026 and in force from the 27th, is the first substantive amendment to the AI Act, and it moved the obligations on high-risk systems back: to 2 December 2027 for the standalone systems in Annex III (biometrics, employment, education, credit, critical infrastructure, justice), and to 2 August 2028 for the systems embedded in products under Annex I.
For a professional firm the postponement changes nothing, and that is the most useful thing to know: those obligations concern high risk, and an assistant that summarises documents is not a high-risk system. The date is still worth knowing, because it explains why everything and its opposite was written around 2 August 2026.
Article 4, the one that concerns everybody
AI literacy is the obligation people forget because it produces no document to hand to anyone. Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among their staff and anyone operating the systems on their behalf, taking into account their knowledge, experience and context of use.
For a firm that means whoever uses an assistant has to know what it does and where it goes wrong. No university course is required: what is required is that the trainee knows the model invents citations and that the pasted document leaves. What matters is that somebody told them, and that you can show it.
What “literacy” means once you have to do it
Article 4 asks for no course, sets no number of hours and issues no certificate. It asks for training proportionate to the tools in use, to the experience of the people using them and to the risks of the setting. Put that way nobody knows where to start, so here is the version that fits in one afternoon and can be shown to somebody.
One: the list. Which AI tools come into the office, by name, who activated them and on what subscription. This is the step that almost always turns up two or three personal subscriptions the partner knew nothing about. Two: who uses them, tool by tool. Three: the briefing, which takes an hour and says four things. The model invents, and does it confidently; pasted text leaves the office; results get verified against the source; for these categories of document it is not used. Four: the written note summarising that hour, with the date and who was there. Five: the review, once a year or whenever a new tool arrives.
The fourth item is what turns compliance into something demonstrable, and it is also the most neglected: literacy produces no document to hand over, so if nobody writes it down there is no trace it happened. The same page can carry the rule on what is permitted, which is why the two are best written together.
Article 50 transparency
From 2 August 2026 the transparency obligations are operative. They fall mostly on those who supply the systems, disclosing that you are dealing with a machine, marking synthetic content, and touch a deployer when it generates or manipulates content that appears authentic, or uses emotion recognition or biometric categorisation systems.
A firm that only has documents summarised does not fall into those cases. One that publishes generated text as its own sits in an area worth looking at closely.
If the system ever were high-risk
There is one case where a firm genuinely meets high risk, and it is not the one people expect: it is not the legal software, it is the HR software. Annex III covers systems used for recruitment, for the allocation of tasks and for evaluating employees, so a ten-person firm adopting a CV screening tool would land inside it, while one having its pleadings summarised would not.
Even then the obligations are a deployer’s, and Article 26 lists them: use the system according to the provider’s instructions; assign human oversight to people with the competence and the authority to exercise it; make sure the input data is relevant to the purpose; keep the logs the system generates; and inform the workers concerned before putting it into use. It is a short list, but it has to be read before signing the contract rather than after, because the first two items depend on what the provider puts in its instructions.
What the AI Act does not do
This is the part to remember. The AI Act does not replace the GDPRopens in a new tab and settles none of the confidentiality questions: a document containing a client’s data sent to a supplier is still processing of personal data, with its legal basis, its recipient and its possible transfer, exactly as before.
They are two regulations that overlap without replacing each other, and for a professional firm the second still bites harder. How the GDPR looks at language models is in its own piece; the Italian statuteopens in a new tab, which adds a duty the AI Act does not have, is in the one about Law 132/2025.