The EU AI Act for mid-sized companies: what applies to you, and when

Most mid-sized companies don't build AI models. They use them: a chatbot on the website, an assistant in sales, Copilot in the IDE, maybe a tool that pre-sorts job applications. That makes them deployers in the language of the AI Act, and the obligations for deployers are far lighter than the headlines suggest, with a few important exceptions. Since the AI Omnibus entered into force on 27 July 2026, the dates for high-risk systems have also moved. This is the practical version: which role you have, which of your use cases fall into which risk class, what already applies today and what you should prepare for December 2027. It's an engineer's overview, not legal advice.

Dominik Heinrich

November 8, 202611 min read

1. Find your role first: deployer, provider or model provider

The AI Act sorts obligations by role. A deployer uses an AI system under its own authority: your support team with a chatbot, your developers with a coding assistant, HR with a screening tool. A provider develops an AI system and puts it on the market or into service under its own name. A provider of a general-purpose AI model (GPAI) trains and releases a model like the ones behind ChatGPT, Claude or Gemini.

If you call Gemini or Claude through an API and build an internal assistant on top, you are a deployer of that assistant. If you sell that assistant to customers under your brand, you become its provider, and the provider obligations attach to it. The GPAI rules, in force since 2 August 2025, are aimed at the model makers: documentation, copyright policy, and for the largest models, systemic-risk assessments. For you they matter indirectly: ask your model vendor for their documentation instead of trying to produce it yourself.

Tip from practice

Write your role next to every AI use case in one table. Most rows will say 'deployer'; the few that say 'provider' are the ones that need a closer look.

2. Sort every use case into one of four risk classes

The Act works with four tiers. Unacceptable risk is simply banned: social scoring, manipulation that exploits vulnerabilities, untargeted scraping of facial images, emotion recognition at work or in education, and since the Omnibus also AI that generates non-consensual intimate images. High risk covers areas where AI decisions affect people's lives: hiring and managing staff, access to education, credit scoring, critical infrastructure, and AI built into regulated products like machinery or toys. Transparency risk covers chatbots and AI-generated content. Everything else, from spam filters to an internal assistant that drafts emails, is minimal risk and has no specific rules.

For a typical mid-sized company the honest picture is: most use cases are minimal or transparency risk, and one or two touch high risk, usually in HR. That is where the work is. The diagram shows the four tiers next to the dates that apply to each, so you can see what is due when.

EU AI Act for deployers: four risk tiers — prohibited practices (since 2 February 2025, plus nudification apps from December 2026), high risk (Annex III from 2 December 2027, Annex I products from 2 August 2028), transparency risk such as chatbots (since 2 August 2026) and minimal risk (no specific rules) — next to a timeline from entry into force on 1 August 2024 through GPAI rules on 2 August 2025 and the AI Omnibus on 27 July 2026. — Four risk tiers and the dates that apply to each, after the AI Omnibus (in force since 27 July 2026). Most use cases of a mid-sized company sit in the lower two.

3. What already applies today

Three things are in force right now. The prohibitions have applied since 2 February 2025: if anything in your stack infers employees' emotions from their webcam, it has to go. AI literacy has applied since the same date; the Omnibus softened it, so providers and deployers now have to take measures to support the AI literacy of the people who use AI on their behalf, with the Commission and the Member States taking a stronger role. In practice that means a short training per role and written rules on what may go into which tool.

The transparency rules of Article 50 have applied since 2 August 2026. People have to know when they are interacting with an AI system, so a website chatbot needs a visible note. Providers of generative AI have to mark synthetic content in a machine-readable way, and deployers have to label deepfakes and AI-written texts on matters of public interest unless a person reviewed them. Since the same date, the AI Office and the national authorities supervise and enforce the Act.

Tip from practice

The AI guide on this site shows the note 'AI answers by Gemini' under every conversation. One line of UI text covers the chatbot part of Article 50.

4. High risk: what changes on 2 December 2027

The AI Omnibus moved the high-risk dates: the rules for the sensitive areas in Annex III, including employment, education, credit and critical infrastructure, apply from 2 December 2027; for AI embedded in products under Annex I, such as machinery, lifts or toys, from 2 August 2028. The reason given is that companies should have standards and support tools before the obligations bite.

If you deploy a high-risk system, Article 26 asks for five things: use it according to the provider's instructions, assign human oversight to people with the competence and authority to overrule it, make sure the input data you control is relevant, monitor it and report serious incidents, and keep the logs it generates for at least six months. Before using it at the workplace you inform the workers and their representatives. Public bodies, private entities providing public services, and deployers doing credit scoring or life and health insurance pricing additionally carry out a fundamental rights impact assessment under Article 27. Most of the heavy documentation sits with the provider of the system, so the first question to your HR software vendor is what they deliver by December 2027.

5. Fines, and why they're not the main reason to act

Article 99 sets three ceilings: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, including the transparency rules, and up to €7.5 million or 1% for misleading information to authorities. For SMEs, start-ups included, the lower of the two amounts applies, and the Omnibus extended several simplifications for SMEs to small mid-caps.

In my experience the stronger driver is your customers. Larger clients already ask in tenders which AI you use, where data goes and who checks the output. A one-page AI inventory with roles, risk classes and owners answers most of those questions, and it is the same document an authority would ask for.

6. A 30-day plan for a mid-sized company

Week one: inventory. Ask every team which AI tools they use, including the ones nobody approved, and write each into the table with purpose, role, data involved and risk class. Week two: transparency and the prohibited list. Add the AI note to every customer-facing chatbot, check that no tool falls under a prohibition, and decide where AI-generated texts need a human review before publishing. Week three: people. A short training per role, plus a one-page policy that says which data may go into which tool; that covers AI literacy in a way an auditor can see.

Week four: the high-risk plan. For each Annex III use case, ask the vendor for their compliance roadmap, name the people who will provide human oversight, and set up log retention. Then put a review in the calendar for every quarter until December 2027, because the guidance and the standards are still arriving. If you build AI products yourself, the readiness checklist in my article on taking AI prototypes to production covers the engineering side: access control, logging, backups and a release process that can say no.

text

AI inventory (one row per use case)
use case          | tool / model         | role      | data            | risk class   | owner   | due
website chatbot   | own guide on Gemini  | deployer  | visitor input   | transparency | sales   | done: AI note
coding assistant  | Copilot / Claude Code| deployer  | source code     | minimal      | CTO     | policy + training
CV pre-screening  | HR SaaS vendor       | deployer  | applicant data  | HIGH (Annex III) | HR  | 2 Dec 2027
product chatbot   | sold to customers    | PROVIDER  | customer data   | transparency | product | marking + docs

Takeaway
For most mid-sized companies the AI Act is a transparency and governance task, not a compliance project: know your role, label your chatbots, train your people, and give the one or two high-risk use cases a plan for December 2027.

Real projects behind this

Try it yourself

Production readiness

Want this in your company? Let's talk mail@dominikheinrich.ch

Sources and official guides