EU AI Act Obligations: An Overview by Role

What is the EU AI Act?

The EU AI Act is a regulation that sets rules for AI systems placed on the EU market or used in the Union. Its central idea is proportionality: it sorts AI uses into risk tiers and attaches obligations to each. It also contains separate rules for general-purpose AI models. This article is a map, not a reading of the text. Dates, definitions and guidance change, so confirm them with counsel and the official sources.

What are the risk tiers?

Tier	What it means	Typical consequence
Prohibited	Practices judged unacceptable, such as certain manipulative or exploitative uses	May not be offered or used
High-risk	Uses in listed areas, and certain AI in regulated products, with significant effect on people	Detailed requirements before and during use
Limited-risk	Systems that interact with people or generate content	Transparency duties, such as telling users they are dealing with AI
Minimal-risk	Most other uses	No specific obligations; voluntary codes encouraged

Does your role change your obligations?

Yes. The Act assigns duties by role, and one organization can hold several roles for different systems. The main ones are:

• Provider. Develops an AI system or model, or has one developed, and puts it on the market under its name. High-risk providers carry the heaviest load: a risk management system, data governance, technical documentation, record-keeping, transparency to deployers, human oversight design, accuracy, robustness and cybersecurity, and a quality management system.
• Deployer. Uses a system in a professional capacity. Typical duties include using the system as instructed, assigning competent human oversight, monitoring operation, keeping logs under its control, and informing affected people where required.
• Importers, distributors and authorized representatives. Each has checking and cooperation duties.

A deployer can become treated like a provider by modifying a system substantially or putting it to a high-risk purpose. Role analysis is a legal question; start by recording the facts in your AI inventory.

What about general-purpose AI models?

General-purpose models, which can serve many downstream tasks, have their own regime. Providers face documentation and transparency duties, including information for downstream developers and a policy for respecting copyright, and models judged to carry systemic risk face further duties such as evaluation and incident reporting. If you build on a model from another party, ask what documentation they provide and keep it with your records.

How should you prepare?

• Build an inventory of AI systems, with intended purpose, users and affected people.
• Classify each system by tier and by your role, and have counsel confirm the close calls.
• Check for prohibited practices and for AI embedded in vendor products.
• For high-risk candidates, gap-assess data governance, documentation, logging and human oversight.
• Add AI literacy and transparency steps to training and user interfaces.
• Track application dates and guidance with counsel, since the phasing and details may be updated.

A hypothetical walk-through

A bank uses a vendor model to screen consumer credit applications and a chatbot for service questions. This example is hypothetical, and classification always needs legal review. The credit model is a candidate for the high-risk tier because of its effect on people. The bank, as deployer, records the vendor's documentation, assigns human oversight, and keeps logs. The chatbot raises transparency duties. The bank then asks the vendor, as provider, what conformity information it can supply.

What should you not assume?

Three assumptions cause trouble. First, that buying a product moves all responsibility to the vendor; deployers have their own duties. Second, that the tiers are fixed by technology rather than by use: the same model can fall in different tiers depending on what it is used for. Third, that a single global program is enough, since national laws and sector rules sit beside the Act. Treat the Act as one input to a wider obligations register, and keep your reasoning for each classification on file so you can explain it later.

Who should be in the room?

Preparation is a joint effort. Legal interprets the text and decides classifications, engineering and data teams supply facts about systems, procurement brings supplier contracts, and the governance function keeps the register and evidence. Agree early who decides disputed cases, because classification questions will arise.

Finally, keep a change log for the register itself, noting when a classification changed and why, so the history is available if a regulator or customer asks how your position evolved.

Where aerais fits

aerais is a governance systems firm, not a law firm, and gives no legal advice. We build the inventory, control set and evidence flows that let your counsel and compliance team answer regulators' questions, then operate them. Our AI governance practice and framework map controls to regulation, standards such as ISO/IEC 42001 and the NIST AI RMF. Alignment is not certification.

This article is for general information only and is not legal advice.