AI Act for deployers what falls on those who use AI

Who is a deployer under the AI Act?

Whoever uses an AI system under their own authority, for work: that is the definition in article 3, point 4. A company that gives ChatGPT to its staff, puts a chatbot on its website or buys a program that reads CVs is a deployer, even if it has not written a line of code. Only people using AI for themselves, outside work, are left out.

The provider is another figure. It is whoever develops an AI system, or has it developed, and places it on the market or puts it into service under their own name or trademark, for payment or free of charge (article 3, point 3). The difference matters because the heavy obligations, technical documentation, conformity assessment, CE marking, belong to the provider. The same system, though, can change the role of whoever uses it.

The last row is the surprising one. A general-purpose assistant used to rank CVs does something its provider did not intend, and that the AI Act treats as high-risk. The prudent reading of article 25 is that whoever uses it that way becomes the provider, with the provider's obligations. The original provider, in that case, is no longer the provider of that system, but must cooperate.

When we build a custom system for you, under your name, you are the provider under the AI Act: that is why we put compliance into the architecture, not into a separate document.

From when do the obligations apply?

Training and prohibited practices have applied since 2 February 2025, transparency applies from 2 August 2026, and high-risk rules from 2 December 2027 for annex III and from 2 August 2028 for annex I. The dates are those of article 113 as amended by Regulation (EU) 2026/1744, which moved the high-risk dates.

On 24 October 2026 we asked Google, ChatGPT and Perplexity the same question. The answers agree on the substance, not on the dates: Google's AI Mode, in one answer, put high-risk at 2 August 2027, and the AI Overview said training was mandatory from 2 August 2026. Those dates are wrong. Other answers give no date for high-risk at all.

2 December 2027 is not a date to start from: a system that screens or evaluates people is chosen, contracted and put into service months earlier. That is when you decide whether it will have the logs, the human oversight and the instructions that article 26 asks for.

What do you have to do, case by case?

With an assistant like ChatGPT you need training and a rule on data. If AI screens or evaluates people, in Italy the final decision already has to be taken by a person today, and from 2 December 2027 the high-risk obligations are added. Tick what describes you: below appear the obligations that follow, each with the article it comes from. They appear once even if they come back under several items, those already in force first and then by date.

In three of the answers we read, the chatbot notice falls on the company that uses it. Article 50 puts it on the provider, who must design the system that way; the company that uses it is left with checking it and writing it into the contract.

A system listed in annex III is, in some cases, not high-risk. Article 6, paragraph 3, excludes it when the system performs a narrow procedural task, improves the result of human work already completed, detects patterns without replacing a person's assessment, or performs a preparatory task for an assessment. It never applies if the system profiles people, and the assessment must be carried out and documented by the provider. If a provider tells you its HR program is not high-risk, ask for that assessment in writing, before signing.

Then there is a right for those on the receiving end of the decision. Anyone affected by a decision taken with a high-risk system from annex III can ask you for clear explanations of the role AI played and of the main elements of the decision: that is article 86. It applies if the decision has legal or similar effects and the person considers it harms their health, safety or rights; critical infrastructure is excluded. A system that cannot say why it proposed what it proposed leaves you without an answer.

What does Italian law add for those who use AI with employees?

Three things, and they apply already today: decisions on employment are taken by a person, the worker is informed beforehand, and the risks of AI go into the risk assessment. The rules come from Legislative Decree 179 of 2026, which aligns Italian law with the AI Act, and from two rules that were already there. The decree was published in the Official Gazette on 8 October 2026 and has been in force since 23 October.

Article 41 of the decree applies to every employer that uses AI systems in decisions on employment, not only high-risk ones. Final decisions on hiring, changing and ending employment, disciplinary measures and performance evaluations included, cannot rest solely on automated processing. The final decision belongs to a person exercising real and autonomous authority, and the worker's consent is no exception. Searching for and screening applications do not count as the final decision, even when they exclude someone from the next stages. The worker has the right to an understandable explanation, given by a person, with the weight AI had and the main parameters. A dismissal decided in breach is void, and so are the other decisions.

Before using the system, the same article refers to the information duties of article 1-bis of Legislative Decree 152 of 1997. Every worker must be informed in writing of what the system decides or monitors, for which purposes, with which logic, which data and parameters it uses, with which controls and with what accuracy. The same information goes to the trade union representatives, and changes that alter working conditions must be communicated at least 24 hours in advance. If the system also allows remote monitoring of workers' activity, article 4 of the Workers' Statute applies: you need an agreement with the trade union representatives or, failing that, the authorisation of the National Labour Inspectorate. Tools the worker uses to do the job and those that record attendance are left out.

Article 42 brings AI into workplace safety. A system that affects how work is organised, its pace, the way of working or decisions that matter for safety is assessed in the risk assessment document. Workers must be informed and trained on the specific risks of the AI they use.

A signature at the bottom of a ranking made by AI is not a decision taken by a person: whoever decides must be able to change the outcome, and know why the system proposed what it proposed. That is why, in the systems we build, the person who approves sees the reasons for the proposal, and every choice stays in a log of what the AI did.

What do you risk if you do not comply?

For deployer obligations up to 15 million euro or 3% of worldwide annual turnover, but for an SME the cap is the lower of the two. The thresholds are those of article 99 of the AI Act, which in Italy article 23 of Legislative Decree 179 of 2026 takes up and completes.

For SMEs, start-ups included, the lower of the amount and the percentage applies. An example in round numbers: a company with 10 million euro turnover that breaches an article 26 obligation risks up to 3%, that is 300,000 €, not 15 million. Small mid-caps have the same rule for the 3% and 1% bands. For minor breaches, article 22 of the decree allows the authority to order a remedy within a deadline, instead of a fine; whoever does not comply pays up to a third more.

The training obligation of article 4 appears in neither list of penalties: it remains an obligation, but it has no fine of its own. And for a company that uses AI with employees the most concrete risk is not the fine: it is a void dismissal, or a performance evaluation that does not stand up in court.

An example: a metalworking company with 60 people

A metalworking company with 60 employees uses Copilot for emails and documents, an AI camera that rejects defective parts on the line, and wants to buy software that evaluates employee performance. On 24 October 2026 we asked Google, ChatGPT and Perplexity what it must do under the AI Act, and which of the three systems are high-risk.

The answers agree: the evaluation software is high-risk, listed in annex III, point 4. The camera is not, as long as it rejects parts and is not a safety component of a machine; neither is Copilot. Article 4 of the Workers' Statute and informing the unions appear in Google's AI Mode, in the AI Overview and in ChatGPT. No answer cites Legislative Decree 179 of 2026, in force since the day before.

That is exactly what is missing. Here are the three systems under today's rules.

For Copilot, the information on the risks is required by article 42 of decree 179. For the camera a union agreement is needed if it frames people, and without one the Inspectorate's authorisation; the risk assessment is updated if the pace of work changes. For the evaluation software, the written notice goes to workers and unions before use, article 4 of the Workers' Statute applies if the program monitors activity, and from 2 December 2027 article 26 also requires informing the representatives.

The evaluation software is the one to decide first, not last: it is the only high-risk system of the three, and in Italy its evaluations are already decisions to be taken by a person. Before buying it, ask the provider for the instructions for use of article 13 and how the program lets the evaluator see and change the proposal. Also ask where the logs are kept and for how long, and which data the evaluation rests on. If the provider cannot answer, you have your answer.

From there, the path worth taking is this:

1. a list of the AI systems used in the company, with who uses them and for what, including those employees use on their own;
2. short training for those who use Copilot and a written rule on which data are never pasted;
3. for the camera, a check of what it frames and of its effects on the pace of work, to bring into the risk assessment document;
4. for the evaluation software, the notice and the discussion with the representatives before purchase, then a period in which a person does the evaluations and the system only proposes.

When do you not have to do anything more?

When you use AI to write, summarise and search, and no system decides, or helps to decide, about people. Then the article 4 training is enough, with a clear rule on which data may be given to the tools and what the GDPR already requires. The heavy obligations begin when AI touches people: whom you hire, how you evaluate them, what you publish about them.

We work alongside legal advisers, not in their place: they interpret the obligations, we put them into practice. The other questions on the AI Act are on the page on the AI Act. Where to start with AI, before the rules, is in the guide AI in business.

Sources and further reading

• AI Act, article 3, “Definitions”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 4, “AI literacy”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 5, “Prohibited AI practices”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 26, “Obligations of deployers of high-risk AI systems”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 27, fundamental rights impact assessmentai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 50, transparency obligations for providers and deployersai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 99, “Penalties”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, article 113, “Entry into force and application”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• AI Act, annex III, high-risk AI systemsai-act-service-desk.ec.europa.eu, accessed 24 October 2026
• Legislative Decree of 7 October 2026, no. 179, aligning Italian law with Regulation (EU) 2024/1689normattiva.it, in Italian, accessed 24 October 2026
• Legislative Decree of 26 May 1997, no. 152, article 1-bis, information on automated decision-making or monitoring systemsnormattiva.it, in Italian, accessed 24 October 2026
• Law of 20 May 1970, no. 300 (Workers' Statute), article 4, “Impianti audiovisivi e altri strumenti di controllo” (audiovisual equipment and other monitoring tools)normattiva.it, in Italian, accessed 24 October 2026