AI Engineering · 6 MIN
EU AI Act for companies buying AI: what a buyer must ask the vendor
A buyer's guide to the EU AI Act: provider vs deployer roles, dates now in force, AI literacy, transparency duties, high-risk rules and what to put in vendor contracts.
If your company in the EU buys or builds an AI system, the EU AI Act (Regulation (EU) 2024/1689) treats you as either a provider or a deployer, and each has duties. Most buyers are deployers. Since 2 February 2025 you must avoid prohibited uses, the AI literacy duty has since been simplified by the Digital Omnibus, and transparency rules apply from 2 August 2026.
- The Act sorts companies by role: providers build or place AI systems on the market, deployers use them under their own authority.
- You can become a provider by putting your name on a system or substantially changing it, so custom builds need a role check.
- The ban on prohibited practices (Article 5) has applied since 2 February 2025, and the AI literacy duty (Article 4) applied from the same date before the Digital Omnibus simplified it.
- Transparency rules, including telling people they are talking to an AI, apply from 2 August 2026.
- After the Digital Omnibus, obligations for most high-risk systems in Annex III move to 2 December 2027, and for products regulated under Annex I to 2 August 2028.
- Nactore is an AI-native technology and growth company in Mumbai that builds with evals, logs and human review, which are the records an AI Act buyer needs.
Does the EU AI Act apply to a company that only buys AI?
Yes. Article 2 applies the Act to deployers established in the EU, and also to providers and deployers in other countries when the output of the system is used in the Union. A deployer is any person or organization using an AI system under its own authority, apart from personal non-professional use (Article 3). The official text is on EUR-Lex.
If your vendor is in India and your customers are in Germany, both of you are in scope. The Act does not care where the code was written.
Which dates are in force right now?
The Commission's AI Act page keeps the live timeline. As of October 2026 it reads as follows. Because the Digital Omnibus on AI changed some dates in 2026, confirm against the Official Journal before you plan.
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and AI literacy (Article 4), the latter since simplified by the Digital Omnibus |
| 2 August 2025 | Rules for general-purpose AI models and governance |
| 2 August 2026 | General application, including transparency rules (Article 50) |
| 2 December 2027 | High-risk systems listed in Annex III, such as hiring, credit and education uses |
| 2 August 2028 | High-risk AI embedded in products regulated under Annex I |
The Digital Omnibus on AI entered into force on 27 July 2026, as the Commission announced, and postponed the high-risk dates from the original August 2026 and 2027 targets.
Are you a provider or a deployer?
Check this before you sign. Under Article 25, a deployer becomes the provider of a high-risk system if it puts its name or trademark on it, makes a substantial modification, or changes its intended purpose so that it becomes high-risk. If you commission a custom AI tool and sell it under your brand, assume you are the provider unless counsel says otherwise.
The split matters because providers carry the heavy duties, such as risk management, technical documentation and conformity assessment for high-risk systems. Deployers carry lighter but real ones.
What must deployers do?
For most business uses, a deployer has four jobs.
- Build AI literacy. Article 4 originally required providers and deployers to ensure a sufficient level of AI literacy among staff who operate AI systems. The Commission says the Digital Omnibus simplified this requirement, with the Commission and Member States taking a stronger role in promoting AI literacy, so check the amended text for what remains on your side. Training the people who use the system is still good practice.
- Avoid prohibited practices. Article 5 bans uses such as social scoring and certain manipulative or biometric practices. Check your use case against the list.
- Meet transparency duties. Article 50 requires that people be told when they interact with an AI system such as a chatbot, unless it is obvious, and that deepfakes and some AI-generated text published to inform the public be labelled.
- For high-risk systems, follow Article 26. Use the system as instructed, assign human oversight to trained staff, monitor operation, keep automatically generated logs for at least six months, and inform workers before using such systems at work.
Public bodies and certain private deployers, such as those using AI for credit scoring or life and health insurance pricing, must also assess the impact on fundamental rights (Article 27).
What are the penalties?
Article 99 sets three tiers. Prohibited practices can lead to fines up to 35 million euros or 7 percent of worldwide annual turnover. Breaches of most other obligations can reach 15 million euros or 3 percent. Supplying incorrect information to authorities can reach 7.5 million euros or 1 percent. For small and medium enterprises the lower of each pair applies.
What should an AI vendor contract say for AI Act purposes?
Ask for these terms in writing, whether the vendor is in Berlin or Mumbai.
- Role statement. Who is the provider and who is the deployer for each system.
- Intended purpose. A description precise enough to judge risk class.
- Risk classification. The vendor's view of whether the use is high-risk, and the reason.
- Instructions for use. What a deployer must do to stay within the vendor's design.
- Logs. What the system records, how long, and how you can export it.
- Transparency features. Built-in disclosure that users are talking to an AI.
- Change notice. Advance warning of model swaps that could alter behavior or risk.
- Cooperation. Help with authority requests, incident reports and impact assessments.
Link this to your data terms too, see IP and data terms for AI projects. If you are unsure what a vendor can show, how to evaluate an AI demo gives a practical test.
Build the log and the disclosure into the first release. Retrofitting "this is an AI" banners and exportable decision logs across a live product costs far more than designing them in.
Frequently asked questions
Does the AI Act apply if our vendor is outside the EU?
Yes, when the system's output is used in the Union. The Act reaches providers and deployers in third countries in that case.
Is a customer-support chatbot high-risk?
Usually not. It does fall under the transparency duty, so users must be told they are talking to an AI unless that is obvious.
Are the high-risk deadlines still moving?
They changed in 2026 under the Digital Omnibus. Check the Commission's timeline and the Official Journal before relying on any date.
Is this legal advice?
No. It is a plain-language summary of public texts. Confirm your classification with EU counsel.
A short close
Buying AI in the EU means knowing your role, training your people, disclosing AI to users and keeping logs. A vendor who can hand you those on day one is worth more than one with a slightly better demo.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.