EU AI Act compliance for B2B teams

What is the EU AI Act?

The AI Act, Regulation (EU) 2024/1689, is the EU's law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages.^[1][2] It regulates AI systems by the risk their use creates, not by the technology behind them, and it reaches companies outside the EU when their AI systems are placed on the EU market or used there.

For a B2B company the practical questions are three: which of your AI systems fall into which risk level, what role you play for each one, and which dates apply. This guide covers all three. It is not legal advice: confirm your obligations with your own legal adviser.

Which risk levels does the Act use?

The Commission describes four:^[1]

Most AI that B2B teams use, such as drafting, summarizing or internal search, sits in the minimal or transparency levels. The risk rises with the purpose: the same model that drafts sales emails becomes high-risk if you use it to rank job applicants.

What changed with the AI Omnibus?

The dates for high-risk systems. The Commission proposed the Digital Omnibus on AI on 19 November 2025.^[1] It was adopted as Regulation (EU) 2026/1744 on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.^[3]

The first three rows come from the original Act as the Commission summarizes it; the last two are the amended dates.^[1][3] The Omnibus also gives providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to meet the rule on marking generated content, and it rewrites AI literacy as a duty for providers and deployers to "take measures to support the development of AI literacy of their staff".^[3]

Are you a provider or a deployer?

It depends on the system, so answer it for each one. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority, other than for personal, non-professional use.^[2] A SaaS company that ships an AI feature is a provider of that feature; the same company using a vendor's recruiting tool is a deployer of it.

The line can move. A deployer or other third party is treated as the provider of a high-risk system if it puts its name or trademark on one, makes a substantial modification that keeps it high-risk, or changes a system's intended purpose so that it becomes high-risk.^[2]

What must deployers of high-risk AI do?

Article 26 sets the main duties.^[2] Deployers must:

• take appropriate technical and organizational measures to use the system according to its instructions for use;
• assign human oversight to people with the necessary competence, training and authority;
• keep the logs the system generates, where they control them, for at least six months unless other law requires otherwise;
• as employers, inform workers' representatives and affected workers before a high-risk system is used at the workplace.

Providers carry the heavier load: risk management, data governance, technical documentation, logging by design, conformity assessment and registration. For Annex III systems those duties now start on 2 December 2027.^[3]

What about chatbots and AI content?

Transparency rules apply to everyone in scope, whatever the risk level. Providers must design systems that interact directly with people so those people are told they are dealing with AI, unless it is obvious from the context, and must mark synthetic output "in a machine-readable format".^[2] The Commission adds that deepfakes and certain public-interest text must be clearly and visibly labeled.^[1] It has published guidelines on these obligations.^[1]

What applies to general-purpose AI models?

Obligations for providers of general-purpose AI models have applied since 2 August 2025.^[1] Most B2B companies use these models through an API rather than provide them, so the duties fall on the model vendor. The Commission published a voluntary General-Purpose AI Code of Practice on 10 July 2025, with chapters on transparency, copyright, and safety and security, that providers can use to show compliance.^[4]

If you fine-tune or substantially change a model and offer it under your name, check with your adviser whether you have become a provider. Our guide to AI governance for LLM training covers the data controls that matter either way.

Where should a B2B team start?

1. Inventory every AI system you build or use, with its owner, vendor and intended purpose.

2. Classify each one by risk level and record your role, provider or deployer.

3. Check transparency on every customer-facing chatbot and every generated image, audio or video.

4. Plan high-risk work against the amended dates, and ask vendors for their documentation and instructions for use.

5. Run AI literacy training for the staff who use or oversee these systems.

Pair the inventory with technical controls: prompt injection gateways for systems that read outside content, and hallucination verification for answers people act on. Our AI governance service covers the inventory and policy steps as part of our AI consulting work.