---
title: "The EU AI Act, read by an engineer"
description: "EU AI Act deployer obligations, read by an engineer: risk tiers, provider vs deployer, the amended timeline, and what logging and oversight ask of your systems."
url: "https://www.lmtek.com/source-code/eu-ai-act-read-by-an-engineer"
locale: "en"
updated: "2026-10-14"
---

# The EU AI Act, read by an engineer

An engineer's reading of the EU AI Act for organisations that use AI rather than build it: what it says, who it applies to, when, and the parts that touch the systems AI runs on. It covers the European Union only. It isn't legal advice: for your own position, talk to your counsel.

By LM TEK · Published 14 Oct 2026

> This article reflects the EU AI Act (Regulation (EU) 2024/1689), as amended by Regulation (EU) 2026/1744, as it stood on 14 October 2026. Dates and obligations may have changed since. It describes what the Act says; it isn't legal advice.[^oj]

## Key points

- The EU AI Act sorts AI by risk. Most business uses sit in the lower tiers. The heavy duties fall on high-risk systems and on the makers of general-purpose AI models.
- A business that uses an AI system under its own authority is a deployer, not a provider, and deployers carry their own, narrower set of duties.[^art3][^art26]
- Since the 2026 amendment, duties for most high-risk systems apply from 2 December 2027, and for high-risk systems that are parts of regulated products from 2 August 2028. Transparency duties apply from 2 August 2026.[^art113]
- For infrastructure, the parts that matter are logs, human oversight and data governance. Where a system runs affects how easily you can show what it did. The Act doesn't say where AI must run.

The message usually arrives from HR or procurement, forwarded with one line on top: *Does the AI Act apply to us? We only use these tools, we didn't build them.* Attached is a link to a summary written by a law firm, or a webinar invitation from a vendor.

Both have their place. Neither is written for the people who run the systems.

This is a reading of the EU AI Act by people who build the infrastructure AI runs on, for organisations in the European Union that use AI systems rather than make them. It is about which of the EU AI Act deployer obligations reach down to the systems underneath, and it sticks to what the text says. Where the text leaves a question open, so do we.

For readers outside the EU: the Act can also apply to organisations established elsewhere, when their AI systems are placed on the EU market or the output those systems produce is used in the EU.[^art2-1] Whether it applies to you is a question for your counsel.

## Four tiers and a separate track: most business use sits low

The Act doesn't regulate AI as one thing. It sorts AI systems into tiers by the risk their use poses, and sets duties tier by tier. General-purpose AI models, the large models other systems are built on, run on a separate track with rules of their own.

**Tier · 01 · Prohibited practices**
A short list of uses the Act bans outright, such as social scoring and AI that manipulates people in ways that cause them harm. Recognising emotions in the workplace is also prohibited, except for medical or safety reasons. From 2 December 2026 it also covers AI that generates sexual imagery of real people without their consent, or child sexual abuse material.[^art5] Few businesses will be anywhere near this tier, but it applies to everyone.

**Tier · 02 · High-risk systems**
AI used in areas the Act lists as sensitive, and AI that is a safety component of products already regulated in the EU. The listed areas include employment, such as screening job applications, and access to essential services, such as credit scoring of individuals.[^annex3] This is where most of the Act's duties sit.

**Tier · 03 · Systems with transparency duties**
AI that people interact with directly, or that produces content people might take for real, such as chatbots and generated images or audio. The duty is to make the AI, or the AI-generated content, recognisable as such.[^art50]

**Tier · 04 · Minimal risk**
Everything else: spam filters, internal search, most drafting and summarising tools. The Act sets no specific duties for this tier beyond the general ones that apply to everyone, such as AI literacy.

**Separate track · General-purpose AI models**
The makers of large general-purpose models carry their own duties on documentation, copyright and, for the largest models, systemic risk.[^gpai] These fall on the model's maker, not on the business that uses a product built on it.

So for most organisations, the useful question isn't "are we regulated?" It's "do any of our uses fall into tier 02?"

## Provider or deployer: which one are you?

The Act gives different duties to different roles. The two that matter most are the provider and the deployer.[^art3]

A **provider** develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. A **deployer** uses an AI system under its own authority, outside purely personal use.

Most businesses reading this are deployers. Use a hiring tool, a credit-scoring system or a customer chatbot that someone else built, and you're its deployer, whether it runs in the supplier's cloud or on your own servers. Which types of AI those systems are, and how they're delivered, is mapped in [*What are the different types of AI in the market, and which is suited to my business?*](/source-code/types-of-ai-for-business)

The roles can change. Under the Act, a deployer is treated as the provider of a high-risk system if it puts its own name or trademark on that system, makes a substantial modification to it, or changes its intended purpose so that a system becomes high-risk.[^art25] An organisation that builds its own AI system for its own use can also be its provider.

The line between using and building is one to check with counsel before a project starts, not after.

## The timeline, as amended in 2026

The Act entered into force in 2024, but its duties apply in stages. In 2026 the EU amended it through Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, which moved the high-risk dates later. The amending regulation was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.[^omnibus] For deployers, the main changes are that the high-risk duties apply later than first planned, that the AI literacy duty was reworded, and that two practices were added to the prohibited list.

| **From** | **What applies (EU, as amended)** |
|---|---|
| 1 Aug 2024 | The Act enters into force |
| 2 Feb 2025 | Prohibited practices; AI literacy |
| 2 Aug 2025 | Duties for makers of general-purpose AI models |
| 2 Aug 2026 | Transparency duties |
| 2 Dec 2026 | Two added prohibited practices (non-consensual sexual imagery, child sexual abuse material); end of the grace period for providers to mark AI-generated content, for systems already on the market |
| 2 Dec 2027 | Duties for high-risk systems in the listed areas (Annex III) |
| 2 Aug 2028 | Duties for high-risk systems that are parts of regulated products (Annex I) |

*Source: Articles 113 and 111(4) of the Act, as amended in 2026.*[^art113]

Treat this table the way you'd treat a train timetable in a strike week. The dates are as they stood when this article was checked. They have moved once already, and this is the part of the article most likely to move again.

## What a deployer has to do

These are the duties the Act places on deployers. Most apply only to high-risk systems. Each one carries the article it comes from, so you can check it against the text rather than take our word for it.

**Duty · 01 · AI literacy** `[Art. 4, as amended]`
Providers and deployers must take measures to support the AI literacy of their staff and of others who operate and use AI systems on their behalf, taking into account their knowledge, experience and training and the context the systems are used in. Since the 2026 amendment, the duty doesn't require any particular level of AI literacy from any individual; as first adopted, it asked for measures to ensure a sufficient level.[^art4] This duty applies to every AI system a deployer uses, not only high-risk ones.

**Duty · 02 · Transparency** `[Art. 50]`
In the cases the Act lists, deployers must tell people they are subject to certain AI systems, such as emotion recognition, and must disclose content that is AI-generated or manipulated to look real, such as a deepfake.[^art50] This duty doesn't depend on a system being high-risk.

**Duty · 03 · Use as instructed, with human oversight** `[Art. 26]`
For high-risk systems, deployers must use the system in line with the provider's instructions for use, and assign human oversight to people who have the competence, training and authority to carry it out.[^art26]

**Duty · 04 · Keep the logs** `[Art. 26]`
For high-risk systems, deployers must keep the logs the system generates automatically, to the extent those logs are under their control, for at least six months unless other EU or national law says otherwise.[^art26]

**Duty · 05 · Inform, and in some cases assess** `[Arts. 26, 27]`
For high-risk systems, deployers must inform workers' representatives and affected workers before using such a system in the workplace, and inform people when a listed high-risk system is used to make decisions about them. Certain deployers, including public bodies and organisations providing public services, and those using AI for credit scoring or for life and health insurance pricing, must also carry out a fundamental-rights impact assessment before first use.[^art26] Since 2026, a deployer can reuse relevant parts of its GDPR data protection impact assessment in it.[^art27]

That is what the Act asks of deployers. How each duty applies to a particular organisation and a particular system depends on facts this article can't see.

## Where infrastructure comes in: logs, oversight and data

Read the deployer duties as an engineer and three requirements on the systems behind them stand out.

**Logs that exist, are complete and can be retrieved.** The Act requires high-risk systems to be built so that they record events automatically over their lifetime, which is a duty on the provider.[^art12] The deployer then has to keep those logs, to the extent they are under its control. That last phrase is the engineering question.

**A person who can see what the system did, and stop it.** High-risk systems have to be designed so that people can oversee them, understand their output and intervene or stop them.[^art14] For the deployer, oversight is only as good as the visibility the system gives the people assigned to it.

**Input data the deployer controls.** Where a deployer controls the input data, it has to make sure that data is relevant and sufficiently representative for the system's intended purpose.[^art26]

All three depend partly on where the system runs. When an AI system runs on infrastructure an organisation controls, its logs, its input data and its records of what happened sit inside that organisation's own boundaries. Keeping them, retrieving them and showing them to someone else is a matter of the organisation's own engineering and policy.

When the system runs as a provider's service, the same records exist where the provider keeps them, in the form and for the period the provider offers. The deployer can still meet its duties. How easily it can show what the system did depends on what the provider exposes and retains.

This is an engineering observation about evidence and access, not a reading of the law. The Act doesn't require AI to run on premises, and running it there doesn't make a system compliant. It can make it easier to show what a system did, with which data, and who could have stopped it.

## What the Act doesn't say

A few things are often read into the Act that aren't in it.

- **It doesn't say where an AI system must run.** The text sets duties on providers and deployers; it doesn't contain a requirement to run AI on premises, in the EU or on any particular infrastructure.[^noloc]
- **It doesn't replace the GDPR.** Where an AI system processes personal data, the General Data Protection Regulation still applies alongside the Act.[^art2-7]
- **It doesn't tell any single business what to do in its own case.** It sets out roles, tiers and duties. Which apply to an organisation depends on what its systems do and how it uses them.

For your legal position, talk to your counsel. For the infrastructure side, there's a simpler check, and we call it **the tomorrow question**. If someone asked you tomorrow to show what one of your AI systems did, with which data, and who could have stopped it, where would that record be?

Wherever the answer is, on your own systems or at a supplier, knowing it is the first engineering question.

## Frequently asked questions

### Does the EU AI Act apply to my business if we only use AI?

It can. Under the EU AI Act, an organisation that uses an AI system under its own authority is a deployer, and deployers have their own duties. Most of those duties apply only to high-risk systems, such as AI used in hiring or credit scoring; a few, like transparency in listed cases, apply more widely. Whether any apply to your business depends on the systems you use and how; check with your counsel.

### What is the difference between a provider and a deployer under the AI Act?

Under the EU AI Act, a provider develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority. A deployer can be treated as a provider of a high-risk system if, for example, it puts its own name on that system or substantially modifies it.

### When do the high-risk AI obligations apply?

Under the EU AI Act as amended in 2026, duties for high-risk systems in the areas listed in Annex III apply from 2 December 2027, and for high-risk systems that are parts of regulated products (Annex I) from 2 August 2028. These dates reflect the Act as it stood on 14 October 2026 and may change.[^art113]

### What does the AI Act require for logging and human oversight?

The EU AI Act requires high-risk systems to be built to record events automatically and to allow effective human oversight; those are provider duties. Deployers of high-risk systems must keep the logs the system generates, to the extent the logs are under their control, for at least six months unless other law says otherwise, and must assign oversight to competent people with the authority to act.[^art12][^art14][^art26]

### Does the EU AI Act say where an AI system must run?

No. The EU AI Act sets duties on providers and deployers according to risk; it doesn't contain a requirement about where an AI system runs. Where a system runs can affect how easily an organisation can keep and retrieve its logs and data, which is a practical question rather than a legal requirement.

## Read next

Logs, oversight and a named owner aren't one-off compliance tasks. They're what running AI looks like after go-live.

- [What are the different types of AI in the market, and which is suited to my business?](https://www.lmtek.com/source-code/types-of-ai-for-business): The types of AI the Act's tiers apply to, and how each is delivered.

## Sources

Article references are to Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article links go to the European Commission's AI Act Service Desk, which shows the EUR-Lex consolidated text and marks what the 2026 amendment changed.

[^oj]: Regulation (EU) 2024/1689 (Artificial Intelligence Act), OJ L, 12.7.2024, [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng); amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 24.7.2026, [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng).
[^art2-1]: AI Act, [Art. 2(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2), points (a) and (c): providers placing AI systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country", and providers and deployers in third countries "where the output produced by the AI system is used in the Union".
[^art3]: AI Act, [Art. 3](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3), points (3) "provider" and (4) "deployer".
[^art5]: AI Act, [Art. 5(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5), points (a) (manipulative techniques causing significant harm), (c) (social scoring) and (f) (emotion recognition in the workplace and in education, except for medical or safety reasons). Points (ba) and (bb) were added by Regulation (EU) 2026/1744 and apply from 2 December 2026 (Art. 113, point (a), as amended).
[^annex3]: AI Act, Art. 6(2) and [Annex III](https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3), points 4(a) (recruitment and selection, including filtering job applications) and 5(b) (creditworthiness and credit scoring, excluding fraud detection). Safety components of regulated products: Art. 6(1) and Annex I.
[^art50]: AI Act, [Art. 50](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50): paragraphs 1 and 2 (providers: telling people they are interacting with AI; machine-readable marking of generated content) and paragraphs 3 and 4 (deployers: informing people exposed to emotion recognition or biometric categorisation; disclosing deep fakes).
[^gpai]: AI Act, Chapter V, [Art. 53(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53) (technical documentation, information for downstream providers, copyright policy, summary of training content) and [Art. 55](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-55) (additional duties for models with systemic risk).
[^art25]: AI Act, [Art. 25(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-25), points (a) to (c). The 2026 amendment changed Art. 25(2) and (4), not paragraph 1.
[^omnibus]: Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 24.7.2026, [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng). It entered into force on 27 July 2026, the third day after publication (recital 46). The new high-risk dates are explained in recital 40.
[^art113]: AI Act, [Art. 113](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113), as amended: entry into force on the twentieth day after publication (1 August 2024); general application from 2 August 2026; point (a), Chapters I and II from 2 February 2025 and new Art. 5(1)(ba) and (bb) from 2 December 2026; point (b), Chapter V from 2 August 2025; point (c), Chapter III Sections 1 to 3 from 2 December 2027 (Art. 6(2) and Annex III) and 2 August 2028 (Art. 6(1) and Annex I). Grace period for marking generated content: [Art. 111(4)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111).
[^art4]: AI Act, [Art. 4](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4), as replaced by Art. 1, point (5), of Regulation (EU) 2026/1744. As first adopted, Art. 4 required measures "to ensure, to their best extent, a sufficient level of AI literacy" ([OJ L, 12.7.2024](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng)).
[^art26]: AI Act, [Art. 26](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26), paragraphs 1 (instructions for use), 2 (human oversight), 4 (input data), 6 (logs kept "to the extent such logs are under their control", for at least six months "unless provided otherwise in applicable Union or national law"), 7 (informing workers) and 11 (informing affected persons). Not changed by the 2026 amendment.
[^art27]: AI Act, [Art. 27](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27), paragraph 1 (who must carry out a fundamental-rights impact assessment; systems in Annex III point 2, critical infrastructure, are excluded) and paragraph 4, as amended by Regulation (EU) 2026/1744 (reuse of the data protection impact assessment).
[^art12]: AI Act, [Art. 12(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12): high-risk AI systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system".
[^art14]: AI Act, [Art. 14](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14), paragraph 1 and paragraph 4, points (c) (interpreting the output) and (e) (intervening, or interrupting the system "through a 'stop' button or a similar procedure").
[^art2-7]: AI Act, [Art. 2(7)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2), as amended by Regulation (EU) 2026/1744: the Act "shall not affect Regulation (EU) 2016/679" (the GDPR) or the other EU data protection acts it names.
[^noloc]: No provision of the Act sets where an AI system must be hosted or run. Its reach depends on placing a system on the EU market, where providers and deployers are established, and where the output is used ([Art. 2(1)](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2)); its duties attach to roles such as provider and deployer, not to infrastructure.

Free to cite with attribution: LM TEK (2026). The EU AI Act, read by an engineer. LM TEK Source Code. https://www.lmtek.com/source-code/eu-ai-act-read-by-an-engineer