The EU AI Act does not just regulate the companies that build AI. It regulates the companies that use it. If you deploy high-risk AI systems from vendors, you have compliance obligations — including documentation, human oversight, and evidence of risk classification. The August 2, 2026 deadline applies to your AI vendor stack.
The EU AI Act draws a clear line between the companies that build AI systems (providers) and the companies that put AI systems into use in their operations (deployers). Most SMBs are deployers. Both have obligations.
You develop an AI system and make it available to others, under your own brand or white-labelled. Providers bear the heaviest obligations: conformity assessment, CE marking, EU Declaration of Conformity, technical documentation, and registration in the EU AI database for high-risk systems.
You integrate a third-party AI tool into your workflow — an AI recruitment screener, an AI credit scoring tool, an AI customer service system. As a deployer, you must use AI systems according to the provider’s instructions, ensure human oversight, maintain logs, conduct fundamental rights impact assessments (where required), and not use AI systems for prohibited purposes.
Most SMBs are deployersIf you substantially modify a third-party AI system — fine-tuning it on proprietary data, changing its intended purpose, or embedding it in your own product — you become a provider for that modified system. The obligations of a provider then fall to you, not the original vendor.
Every AI system used in the EU falls into one of four tiers. The tier determines what your vendor must provide and what you must do as a deployer. Most obligation-heavy requirements apply only to high-risk AI.
The EU AI Act bans a specific set of AI applications outright, regardless of who provides them: social scoring systems that classify people based on behaviour, real-time remote biometric identification in public spaces (with narrow law enforcement exceptions), emotion recognition at the workplace or in education, AI that manipulates people through subliminal techniques, and AI that exploits vulnerabilities of specific groups. If a vendor offers any of these capabilities, using them violates EU law regardless of any contractual arrangement.
High-risk AI systems are listed in Annex III. The most common categories for SMBs are: employment and HR AI (CV screening, shortlisting, interview scoring, performance monitoring), creditworthiness assessment AI (credit scoring, loan risk models), AI in education (systems that determine access to educational institutions), and AI in critical infrastructure (energy, water, transport management). Your vendor must have a completed conformity assessment and CE marking. You must register your deployment and maintain logs.
Deadline: August 2, 2026 — action required nowAI systems designed to interact with people — chatbots, AI-generated content, deepfakes — must disclose that users are interacting with an AI. If your customer service platform uses an AI chatbot, that chatbot must identify itself as AI. This applies whether you build the chatbot or use a vendor’s. The obligation falls on the deployer to ensure disclosure is active.
Most AI tools in common business use fall here: AI writing assistants, spam filters, AI-powered search, recommendation engines, basic data analytics tools, and most productivity AI. There are no mandatory compliance obligations for minimal-risk AI systems, though providers may voluntarily follow a code of conduct. This is the tier where most business software AI features sit.
If any of your vendors provide a high-risk AI system (Annex III), these are your obligations as a deployer — regardless of the vendor’s own compliance status.
You cannot deploy a high-risk AI system for a purpose not covered by the provider’s intended use documentation. If a vendor’s CV screening AI is certified for initial screening only and you use it to make final hiring decisions, you may be creating a new high-risk use case for which you become the de facto provider.
High-risk AI systems must have a human in the loop. You must assign a natural person responsible for overseeing the AI system’s operation and able to intervene. The AI system must generate logs of its operation — your vendor should provide this capability, and you must retain logs for at least six months (or longer if required by sector regulation).
Public bodies and private operators providing public services or banking/insurance must conduct an FRIA before deploying high-risk AI. The FRIA documents how the AI system may affect fundamental rights (non-discrimination, privacy, fair trial), what mitigation measures are in place, and who is responsible for monitoring. The FRIA must be notified to the relevant market surveillance authority.
VendorAuditly: document your AI risk assessment and store evidence alongside vendor recordsYour vendor must provide: a copy of the EU Declaration of Conformity, evidence of CE marking, the technical documentation summary relevant to your deployment context, and the instructions for use. You should store and date this evidence — in the event of a regulatory inspection, you need to demonstrate that you verified compliance before deployment, not after a complaint.
VendorAuditly: track CE marking and EU DoC certificates with automatic expiry alertsEmployees who work with or are affected by high-risk AI systems must receive appropriate training and information. If your HR team uses an AI shortlisting tool, they need to understand what the AI does, its limitations, when to override it, and how to detect bias. Training records should be documented and dated.
If a high-risk AI system causes or contributes to a serious incident — a decision that harms someone, a discriminatory outcome, a safety event — you must report it to your national market surveillance authority. This obligation applies to deployers, not just providers. You need a process for identifying, logging, and escalating AI incidents before they occur.
High-risk AI is not only in enterprise systems. Many widely-used SaaS tools include AI components that may trigger Annex III classification depending on how they are deployed.
*Chatbots that interact with users must disclose they are AI (limited risk transparency obligation). The same tool may be higher-risk if deployed in a context that affects access to services.
Start with an audit of every AI tool in your stack. For each one, determine the risk tier and collect the right evidence from the vendor. Here is exactly what to ask for.
Review your SaaS tools and ask: does this product use AI to make or inform decisions? Add every AI-enabled tool to your vendor register with a flag indicating AI capabilities. Pay particular attention to HR software, financial tools, and any system that touches access decisions. Many SMBs discover they have 8–15 AI-enabled tools when they do this exercise for the first time.
VendorAuditly: add a “uses AI” flag to any vendor in your registerFor each AI tool, determine: is it prohibited, high-risk (Annex III), limited risk (transparency only), or minimal risk? The classification depends on both what the AI does and how you use it. A general-purpose AI tool used to make employment decisions may move from minimal to high-risk based on your use case, not the vendor’s intended classification.
VendorAuditly: classify vendors by AI risk tier alongside your standard vendor risk scoreFor every vendor you classify as high-risk, send a questionnaire requesting: EU Declaration of Conformity, CE marking evidence, technical documentation summary, intended use documentation, and their process for post-market monitoring. If a vendor cannot provide these documents for a high-risk AI system, that is a material compliance gap — not just a vendor risk flag.
VendorAuditly: use the AI vendor questionnaire template, store dated responsesConformity assessments for high-risk AI are not one-time events. When vendors update their AI systems significantly, they may need to renew their conformity assessment. Store certificate dates with expiry alerts so you know when to request updated documentation — before a regulatory review surfaces the gap.
VendorAuditly: automatic expiry alerts for CE marking and EU DoC documentsWhen a regulator, enterprise customer, or internal audit requests evidence of your EU AI Act compliance, you need a single document showing: your AI vendor inventory with risk classifications, questionnaire response dates, certificates on file, human oversight assignments, and incident log status. This is your AI vendor evidence pack — the deployer equivalent of a provider’s technical documentation file.
VendorAuditly: one-click evidence export including AI vendor classifications and certificatesClassify every AI tool in your stack, collect conformity documentation from high-risk vendors, and export your evidence pack — all at $49/month.
No credit card required. Set up in under an hour.