EU AI Act Deployer Readiness Map

The EU AI Act does not wait for clean lists or tidy project charts. Deployers face hard deadlines and harsh consequences if a system is missed—live, in stealth, or in the pipeline. Every AI-enabled use—automated loan approvals, chat assistants, demand forecasting, image scanning—counts. No exceptions for pilots, internal tools, or edge use cases.

Accountability begins when you write down what exists. Assume the risk: if you have not named ownership, purpose, and provider for every AI use, you will not spot high-risk cases or missing obligations later. Shadow deployments and projects-in-waiting become regulatory liabilities if skipped.

You are not mapping technical details. You are mapping accountability. Who owns the deployment? What is the AI used for? Who built or integrated it? This is your single source of truth. If you have to chase someone later, you failed to map it now.

This list is not legal advice. It is the starting point for compliance, risk, and audit. Use it to drive the next steps—the right review, the right escalation—before the real deadlines hit. [Official source: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai]

You can’t meet your duties if you don’t know which law applies. The EU AI Act splits responsibilities: some belong to AI model providers, others to deployers. Deployer duties trigger for specific risks—high-risk, general-purpose (GPAI), or transparency-relevant systems. If you classify wrong, you may miss full obligations: risk assessment, documentation, human oversight, new transparency rules.

Start from your inventory. For each AI use, answer: Does this system fall in a high-risk sector? (Source: EU AI Act, see risk list.) Does it generate content that could mislead? (Article 50, transparency rules apply.) Is it built on or exposes a general-purpose AI? (GPAI rules now live.)

Next, map your role. Did your organisation build the core AI model, or are you deploying/optimising someone else’s? If you only deploy, you’re a deployer—most duties are yours unless the system is clearly off-the-shelf and unmodified. Tag each use in your map with both risk status and your role.

These tags decide your next legal and compliance steps. Don’t trust gut feeling or defaults—use the Commission’s sources. If there’s doubt, flag for legal review. This is a living map: new rules, products, or system changes may shift risk and obligations.

Knowing which duties fall to your organisation—as deployer, not provider—is where compliance shifts from risk to control. The EU AI Act splits duties differently than older frameworks. Most missed requirements come from not mapping evidence or from unclear handoff between compliance, legal, and technical teams. The work: For every AI deployment, use your risk and role classification to check which deployer duties apply. Reference current deadlines from official sources for high-risk and transparency-classified AI, bearing in mind that rules for General Purpose AI and Article 50 transparency enter force August 2025 and 2026 (see Commission sources). Log every required element: risk assessment, data quality proof, use-case documents, transparency labelling, oversight process. Name the specific owner or team for each. Mark any missing evidence, unclear owner, or process that is in draft or absent. For high- or transparency-risk uses, escalate gaps for legal or compliance review; do not wait for next cycle. The product is a live ledger. Each use is status-marked: complete, missing, or flagged for expert review. This is not legal advice. It is a field map for internal readiness, always cross-checked with your legal team as enforcement dates approach.

Worked example

A team lists their main customer-facing chatbot as high-risk. They check the EU AI Act for deployer duties: oversight process, transparency disclosure, and documentation. Oversight is documented and owned by IT. Transparency labels are missing—no owner. Documentation is in draft with the product team. They flag the transparency item for legal review and note the documentation status as 'in progress'. Their ledger shows each duty matched to an owner or escalation step, ready for review.

Output template

• AI deployment/use:
• Risk classification:
• Deployer duties (list):
• Duties status (complete/missing/legal review needed):
• Named owner/team per duty:
• Deadline for compliance:
• Escalation notes:

Quality checklist

• Duties sourced from official EU AI Act pages
• Each item status-marked and owner assigned
• Missing or unclear items flagged for review
• Ledger covers all classified deployments