Part 1: The AI Act, Part 1: What It Is and Who It Talks To

The AI Act's four risk tiers, the roles of provider and deployer, and why using a purchased AI tool still makes a company a deployer with duties. Then the stages the law switches on in, and how the Digital Omnibus moved the high-risk dates to December 2027 and August 2028. Explains the law, gives no advice.

Tue, 27 Oct 2026 · 14 min

Made for you, by AI, from the sources below.

Listen to it in The AI Act, Explained for Your Workplace

Transcript

The script the two voices were given, with the sound cues taken out. A voice may say a word a little differently, so the audio is the episode.

Mia: Welcome to Walking Points. Picture a hospital that buys a triage assistant, software that helps staff decide which patients need care first, from a vendor. Nobody there builds anything, trains anything, or writes a line of code. Ask the managers about Europe's new AI law and the answer comes fast: we only use the software.

Adam: That sounds like a perfectly reasonable way to stay out of it.

Mia: It sounds reasonable, and under the law it's exactly the wrong reading. The law has a name for that hospital, and the name comes with duties. Maybe your own employer sits in that picture too. That's what this episode is about: What the AI Act is: risk tiers, providers and deployers, and the Digital Omnibus dates. This part was made in October 2026. The AI Act is a European Union regulation, the first broad, binding law anywhere that covers artificial intelligence as a whole, rather than one use of it. It earns a full episode because the next two parts both hang on its map. We'll take three ideas in order: the four risk tiers, the two roles called provider and deployer, and then the calendar, including how a law passed this summer pushed back the dates for the most demanding rules.

Adam: Before the tiers, what kind of law is this? Is it one of those where every country writes its own version?

Mia: No, and that's a real difference. A regulation applies directly in every member state, with no national rewrite. A directive is the kind that gets translated country by country. Each country still has to name the authorities that enforce the Act, but the rules themselves are the same everywhere. Formally it's Regulation 2024/1689, and it entered into force on 1 August of that year.

Adam: And what does it actually regulate? AI is a pretty big word.

Mia: That's the clever part. It doesn't regulate AI as a technology at all. It regulates what an AI system is used for, and it scales the rules to the harm that use could do. Most AI gets almost no rules. A few uses are banned. The ones in between carry duties that grow with the stakes. Article 3 defines an AI system as a machine-based system that works with some autonomy and, from the input it gets, produces outputs like predictions, content, recommendations or decisions. In practice that covers a chatbot, a CV-screening tool, a credit-scoring model and an image generator alike.

Adam: And a company outside Europe? A lot of these tools are built elsewhere.

Mia: Covered too. A company outside the EU falls under the Act when its system is placed on the EU market, or when the output of its system is used in the EU. So it matters to any employer in Europe, whichever vendor's software they use.

Adam: Okay. So, the tiers.

Mia: Four of them, as the European Commission describes them. First is unacceptable risk, which means banned outright. The Commission's page lists social scoring, manipulative techniques that exploit vulnerabilities, and emotion recognition in workplaces and schools among them. The first eight categories of ban already apply. Second is high risk: systems that can seriously affect health, safety or fundamental rights. The Act lists the areas in a part called Annex III: biometrics, critical infrastructure, education, employment, essential services such as credit and public benefits, law enforcement, migration, and the administration of justice. A tool that ranks job applicants, decides who gets a loan or marks an exam is the typical case.

Adam: Hold on, emotion recognition in workplaces is banned outright? That seems like a big one for employers.

Mia: It's on the Commission's list, yes, and Part 2 returns to the bans properly. Staying with the tiers, the third is transparency risk. Here the rule is disclosure: tell people when they're talking to a chatbot, label deepfakes, and make AI-generated content identifiable. That's Article 50, and it has applied since early August this year. The fourth is minimal risk. The Commission says most AI systems in the EU fall here, with spam filters and AI in video games as its examples, and no specific rules apply. There's also a separate group of high-risk systems, the ones built into already regulated products like medical devices, machinery or vehicles. That list is called Annex I.

Adam: Mia, I'm not sure four tidy boxes survive contact with real tools. Say a chatbot helps draft emails one week and gets pointed at job applications the next. Which box is that?

Mia: That's the right objection, and the Act's answer is that the tier belongs to the use, not the tool. The same language model is minimal risk when it drafts a birthday message, and high risk when it's wired into a process that screens candidates. I'll concede the edges are where the arguments will happen, because Annex III is a list, and a use either sits on it or it doesn't. But to answer you directly: it changes box the moment the use changes.

Adam: So the box follows the job, not the product. Then who carries the responsibility?

Mia: That's the roles, and there's a trigger in the middle of them that can turn a buyer into a builder in the law's eyes. First the basics. The Act talks to operators by role, and two matter for a workplace. A provider is the person or organisation that develops an AI system, or has one developed, and puts it on the market or into service under its own name or trademark. Think of the company that builds and sells recruitment software, or the lab that builds the model. A deployer is an organisation using an AI system under its own authority, except for purely private, non-professional use. Think of the company that buys the recruitment software and uses it to hire.

Adam: Which is our hospital.

Mia: Exactly. The sentence that matters is in the definition: using is enough. A bank with a purchased credit-scoring tool, a hospital with a purchased triage assistant, an employer with a purchased interview-analysis product: each is a deployer, and each has duties as such. So if you work somewhere that buys an AI tool and uses it, your organisation is a deployer, whether the firm has ten people or ten thousand, though fines are scaled differently for small firms.

Adam: So we only use it isn't an exit. It's the description of the role the law was written for.

Mia: That's it in one sentence. And the roles are functional, not labels stuck on a company. One organisation can be the provider of one system and the deployer of another. Now the trigger. Under Article 25, a company that puts its own name or trademark on a high-risk system, or makes a substantial modification to it, takes on the provider's much heavier duties. So a company that merely customises a vendor's tool should read the vendor contract carefully.

Adam: What does a deployer owe, then, in the ordinary case?

Mia: For most AI, very little. Article 4 on AI literacy and the transparency rule are the main duties, and Part 2 covers them. For high-risk systems it's substantial. Article 26 says: use the system according to the provider's instructions, give human oversight to people with the competence, training and authority to do it, check that input data you control is relevant and representative, monitor the system and report risks or serious incidents, and keep the logs it generates for at least six months. Before using a high-risk system at work, the deployer also has to inform workers' representatives and the affected workers.

Adam: That's a long list for an organisation that just bought a product.

Mia: It is, and it's why Part 3 goes through them one by one. One more piece: where such a system makes or assists decisions about people, deployers must tell those people they are subject to it. Now, the high-risk rules were due this summer, and they didn't switch on then. That's the calendar.

Adam: Right. When does each piece actually switch on?

Mia: The Act was designed to switch on in stages, so the clearest harms were stopped first and the heaviest paperwork came last. After it entered into force, nothing was yet binding on operators. On 2 February 2025 the first eight prohibitions and the AI literacy duty began to apply. Six months later, the rules for general-purpose AI models, the big foundation models, began to apply, along with the governance machinery. On 2 August 2026 the Act became generally applicable, the AI Office and national authorities took on enforcement, and the transparency rules began. The big high-risk rules were due on that same date, and that's the stage that moved.

Adam: Why did it move?

Mia: Last November the Commission proposed a Digital Omnibus, a package meant to simplify several digital laws, the AI Act among them. The reason given was practical: the technical standards companies would use to show compliance weren't ready, and the deadline was approaching with no way to meet it. A political agreement followed in May. According to the Commission, the AI part entered into force on 27 July, a few days before the original deadline would have bitten.

Adam: And the new dates?

Mia: Annex III systems, the stand-alone areas like recruitment, credit scoring and education, now apply from 2 December 2027. Annex I systems, the ones embedded in regulated products, apply from 2 August 2028. The first proposal had tied the delay to when standards were ready, with those two dates as a backstop. The final text uses fixed dates instead, in the hope of more clarity and predictability.

Adam: Hm. That still sounds like the law got softer. Isn't a delay just a quiet retreat?

Mia: Adam, fair challenge, and for the high-risk stage it did buy time. But what didn't move is as important. The banned practices, the general-purpose model rules and the transparency duty are unchanged and already live. Only the high-risk obligations got breathing room. And some commentators warn that the new December date is not a snooze button: buying decisions made now commit a company to systems that will still be running when the rules arrive, and the vendor's paperwork has to be ready by then.

Adam: What else did the Omnibus change?

Mia: Three smaller things. A ninth ban, on systems that generate non-consensual intimate imagery or child sexual abuse material, the so-called nudifier apps, with a transition that ends in December. A grace period on one transparency duty: systems placed on the market before that August date have until 2 December to mark AI-generated content so it's machine-readable, while the general duty to tell people they're dealing with AI isn't delayed. And a bundle of adjustments: stronger powers for the AI Office, simplifications for small firms extended to small mid-cap companies, and wider access to regulatory sandboxes, which are supervised test areas for new systems. Member states also got one more year to set up their own.

Adam: You said there was something about the literacy duty.

Mia: There is, with a caution. The law firm Gibson Dunn summarised the agreement as softening the AI literacy duty in Article 4: providers and deployers would have to support the development of AI literacy among staff, rather than guarantee a particular level. That summary describes the deal before formal adoption, so the final text is the thing to check.

Adam: And the fines? People always ask about those.

Mia: They're in Article 99, and they're ceilings, not the usual amount. For the prohibited practices, up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. For most other operator duties, including a deployer's duties, up to 15 million euros or 3 percent. For giving authorities incorrect or misleading information, up to 7.5 million euros or 1 percent. For small and medium businesses, including start-ups, the rule flips, and the fine is capped at whichever of the two figures is lower.

Adam: So what could a curious professional actually try this week with all this?

Mia: One step. Pick a single AI tool that your workplace uses, and write down in one sentence what it is used for. The reason is that the tier follows the use, and that one sentence is what every role and every duty in the Act depends on for you.

Adam: This part comes down to one idea: the Act sorts uses rather than technologies into four tiers, it speaks to the ones who build and the ones who use, and using a purchased system is exactly what makes an organisation a deployer.

Mia: That was part one of three. Part two is called What already applies at work, and it is about the practices banned outright and who enforces the rules.

Heard something wrong? Tell us