01
Roles shape responsibility
Providers develop an AI system or have it developed and place it on the market or put it into service under their name or trademark. Deployers use an AI system under their authority in a professional context. The Act also defines importers, distributors, authorised representatives and operators across the value chain.
An organisation can hold different roles for different systems and can sometimes move into provider-like responsibilities when it substantially modifies a system or changes its intended purpose. Role decisions should be system-specific and documented.
02
Risk categories change the control set
The framework includes prohibited practices, high-risk systems, systems subject to transparency duties and uses that do not carry mandatory system-specific requirements under the Act. High-risk providers face requirements that can include risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity.
Deployers of relevant systems can have duties concerning instructions, human oversight, input data, monitoring, logs, worker information and impact assessments in defined contexts. Transparency provisions can require people to be informed about AI interaction or AI-generated and manipulated content.
03
Use current implementation dates
The application timetable has evolved through the EU implementation process. Prohibited practices and the original AI literacy provisions began applying in February 2025, and rules for general-purpose AI models began applying in August 2025. Other requirements follow the current phased timetable published by the European Commission.
Because dates and support measures can change, implementation plans should reference the latest official timeline rather than relying on an old static summary.