The EU AI Act (Regulation (EU) 2024/1689) entered into force in August 2024 and applies in stages. For most companies the important point is their role: if you use ChatGPT, Copilot or an AI agent built on someone else's model, you are a deployer, not a provider. The heaviest obligations fall on providers of high-risk systems and general-purpose AI models — but deployers have duties too.
What already applies to deployers
- Prohibited practices (since February 2025): certain uses of AI are banned outright, such as manipulative techniques or social scoring.
- AI literacy (Article 4, since February 2025): providers and deployers must take measures so that their staff — and others using AI on their behalf — have a sufficient level of AI literacy for the systems they use. There is no mandatory certificate, but you should be able to show what you did.
- Transparency and high-risk duties follow in later stages, mainly from August 2026 onwards; check the current timeline, as the EU has discussed adjusting some dates.
And GDPR keeps applying in full whenever personal data is involved.
The evidence you will be asked for
Regulators, auditors and customers increasingly ask practical questions:
- Which AI systems are used in the organisation, and by whom?
- What data is sent to them, and how is personal data protected?
- What rules apply, and how are they enforced — not just written?
- How are employees guided and trained in their actual use of AI?
- Can you show a record of decisions when something needs to be investigated?
How WALLIOO helps
WALLIOO turns those questions into data. WALLIOO Control keeps an inventory of the AI tools in use and what they are used for, Browser Guard and Gateway enforce your rules on every interaction, notes at the moment of use support AI literacy in practice, and every decision is recorded in one audit trail you can send to your SOC. See the audit use case →
This article is general information, not legal advice. Check the current text and timeline of the AI Act and your own obligations with a legal adviser.
Frequently asked questions
Am I a provider or a deployer?
If you use an AI system under your authority — ChatGPT, Copilot, an agent built on someone else’s model — you are generally a deployer. You become a provider when you develop an AI system or model and place it on the market under your own name.
Do we need a certificate for AI literacy?
No certificate is required. You should take measures suited to your staff and the AI systems they use, and be able to show what you did.
Does the AI Act replace GDPR?
No. Both apply. Whenever personal data is processed with AI, GDPR obligations remain in full.
