EU AI Act for companies using AI: obligations, timeline and how it meets the GDPR

A product manager in Munich asks a fair question: we use ChatGPT for marketing copy, Claude for code review and the OpenAI API inside our support tool. Does the EU AI Act make us a regulated AI company? The answer depends on one distinction the Act draws carefully, and on a timeline that changed in July 2026.

This page covers the AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Dates and duties below are as of October 2026.

Are you a provider or a deployer under the AI Act?

The Act regulates roles, not technologies. A provider develops an AI system or a general-purpose AI (GPAI) model and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. OpenAI, Anthropic and Google are providers of GPAI models. A company whose staff use ChatGPT is a deployer of an AI system built on one.

The line moves when you build. If you put an AI system into service under your own name, say a customer-facing support bot running on the Claude API, you're the provider of that system, even though someone else trained the model. Whether that matters depends on what the system does. A drafting assistant is low risk. A system that screens job applicants or scores creditworthiness falls under Annex III and is high-risk. Substantially modifying a GPAI model, for example through large-scale fine-tuning, can also make you a GPAI provider for the modification.

What applies when, after the Digital Omnibus?

The delay of the high-risk rules is real, but it's a delay, not a repeal. Teams that build HR or credit systems on LLMs should use the time to put data governance, logging and human oversight in place rather than pausing the work.

What does AI literacy under Article 4 require?

Article 4 has applied since 2 February 2025. The Digital Omnibus rewrote it: providers and deployers must take measures to support the AI literacy of their staff and others operating AI systems on their behalf, taking into account their knowledge, the context and the people affected. The new text says plainly that this doesn't require guaranteeing any specific level of literacy for any individual. The Commission and Member States must support companies, particularly SMEs.

In practice that means training people on what the tools do, where they fail and what they must not paste in, and being able to show you did it. A short internal policy plus a session per team, refreshed when tools change, is a reasonable baseline. What goes wrong with personal data in prompts belongs in it.

What are the prohibited practices and fines?

Article 5 bans a short list of uses: manipulative or exploitative techniques that cause significant harm, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work and in education (with narrow exceptions), biometric categorization by sensitive traits, and most real-time remote biometric identification in public spaces for law enforcement. The Omnibus adds AI that generates non-consensual intimate imagery or child sexual abuse material, from 2 December 2026.

Fines under Article 99 reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other breaches, with lower caps for SMEs and, after the Omnibus, for small mid-caps. Few companies using LLMs for drafting, coding or support come near Article 5. The bigger practical risk for them is the GDPR.

How does the AI Act relate to the GDPR?

They stack. The AI Act states that it doesn't affect the GDPR, so every prompt containing personal data is still processing under the GDPR, with a legal basis, minimization, a processor contract and a transfer route. The AI Act adds product-safety style duties on top. The Omnibus extends a legal basis for processing special-category data for bias detection and correction, under strict necessity and safeguards, but that helps providers of systems, not someone pasting a customer file into a chat window.

That's where a masking layer fits. The AI Act doesn't require you to mask anything. The GDPR's minimization and security duties strongly favor it, and the AI Act's literacy and governance expectations are easier to meet when you know which AI tools are in use and what data reaches them.

AI Act requirements, what Maskflare does, and what stays your job

A practical checklist for companies using AI

1. Inventory every AI tool and API in use. Note for each one whether you're a deployer or, because you built it, a provider.
2. Screen each use case against Article 5. Document the result even when the answer is obviously no.
3. Check Annex III: if any system touches hiring, credit, education, essential services or similar, plan for 2 December 2027 now.
4. Run an AI literacy program: policy, a session per team, a record of who attended. Refresh it when tools change.
5. Meet Article 50 for chatbots and generated media from 2 August 2026.
6. Handle personal data under the GDPR: mask identifiers before prompts leave, sign DPAs, check transfers, run a DPIA.
7. Ask your GPAI providers for the documentation they must give downstream providers, and keep it with your system file.

What we can't tell you

Classification under Annex III turns on facts about your system and is often arguable. Guidance from the Commission and the AI Office is still arriving, and national enforcement structures are still being set up. Maskflare helps with the data side and with visibility. It doesn't classify systems, produce conformity assessments or make anyone 'AI Act compliant'.