EU AI Act: What Deployers Must Do Before August 2, 2026

The EU AI Act (Regulation 2024/1689) is no longer a future regulation. It is in force. Prohibited practices have been enforceable since February 2025, and the general application date is August 2, 2026 — less than two months away.

If your business uses AI in any way — a CRM with AI features, a chatbot, an internal AI assistant, or a SaaS tool that “uses AI under the hood” — you are a deployer under the Act, and you have obligations.

This is not a legal opinion. This is an engineering perspective: what the obligations actually require in practice, and how to build the evidence trail that survives an audit.

You Are Probably a Deployer

The AI Act defines a deployer as:

“A natural or legal person using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.”

That means if your company uses AI in a professional capacity — and in 2026, that includes most companies — you are a deployer. You do not need to have built the AI system. You do not need to have “intentionally” deployed it. If your CRM has an AI-powered lead scoring feature, you are a deployer of that AI system.

This is the most common misunderstanding: using a SaaS product with AI features makes you a deployer of those AI features, even if the vendor markets the product as “AI-powered” rather than “an AI system.”

The Six Deployer Obligations (Article 26)

Article 26 sets out the core deployer obligations. In practice, they break down into six concrete requirements:

1. Use the System According to Instructions for Use

You must operate the AI system in accordance with the provider’s instructions for use. This sounds obvious, but it has real consequences: if the provider says the system is not designed for a particular use case, and you use it that way anyway, you are in violation.

Engineering implication: Document which AI systems you use, what the provider’s stated purpose is, and how your use aligns with it. If there is a mismatch, you need to either stop the use or get written confirmation from the provider that the use is supported.

2. Assign Human Oversight

You must assign human oversight to persons with the necessary competence, training, and authority. The overseer must be able to:

Understand the capabilities and limitations of the AI system
Monitor the system’s operation
Decide not to use or to override the system’s output
Halt the system in case of a problem

Engineering implication: “Human oversight” does not mean “a human clicks a button occasionally.” It means a human who can actually understand what the AI is doing, make a judgment call, and halt the system. If your AI system processes 10,000 decisions per day, “human oversight” needs to be designed into the workflow, not bolted on as an afterthought.

This is where TramAI and similar governance frameworks become relevant: they provide the technical mechanism for human approval gates, suspension, and override that the Act requires.

3. Ensure Input Data Is Relevant and Representative

You must ensure that the input data used to operate the AI system is relevant to the intended purpose and sufficiently representative. For high-risk systems, this also includes checking for biases.

Engineering implication: If your AI system is making decisions based on data you provide (customer records, transaction history, application forms), you are responsible for the quality and representativeness of that data. A biased input dataset that produces biased outputs is your problem as deployer, even if the model is the provider’s.

4. Monitor Operations and Report Incidents

You must monitor the AI system’s operation and report serious incidents to the relevant market surveillance authority. A serious incident is one that:

Directly or indirectly leads to death or serious damage to health
Causes serious and irreversible disruption of critical infrastructure
Breaches fundamental rights obligations

Reports must be submitted immediately for ongoing incidents and within 15 days for incidents that have concluded.

Engineering implication: You need a logging and monitoring system that can detect and record incidents. “We didn’t know it was happening” is not a defensible position if the logs show it was happening. This is where structured audit logging (Article 12) becomes a deployer requirement in practice.

5. Retain Logs

You must retain logs generated by the AI system for at least six months (unless a longer period is specified by other applicable law).

Engineering implication: This is a concrete, measurable requirement. Your AI system must generate logs, those logs must be stored for at least six months, and they must be producible on demand for a regulator. If your AI system is a SaaS product, the provider is responsible for logging — but you should still be able to demonstrate that you have access to the relevant logs.

6. Inform Workers and Affected Persons

Before putting a high-risk AI system into use in the workplace, you must inform workers’ representatives and affected workers. For other AI systems, you must inform natural persons when they are interacting with an AI system (Article 50).

Engineering implication: This is a transparency obligation. If your company uses a chatbot, the user must know they are talking to an AI. If your company uses AI to evaluate job candidates, the candidates must be informed. These are not technical requirements — they are process and communication requirements, but they are still your obligation as deployer.

What About the Deadlines?

The EU AI Act applies in phases. The Digital Omnibus (Regulation 2026/1744), which entered into force on July 27, 2026, postponed the high-risk system obligations. Here is the current timeline:

August 2, 2026: GPAI (General-Purpose AI) model obligations apply to providers of foundation models. Article 50 transparency obligations (chatbot disclosure, deepfake labelling) become enforceable. Article 49 registration becomes applicable.
December 2, 2027: Annex III high-risk system obligations (deferred from August 2026 by the Digital Omnibus).
August 2, 2028: Annex I high-risk system obligations (unchanged).

The deferral does not mean you can wait. Here is why:

You still need to know whether your system is high-risk (classification work should happen now).
You still need the other deployer obligations (logging, monitoring, human oversight) in place.
The deferral gives you time to implement the technical controls, not to skip them.

How to Build the Evidence Trail

The most common failure mode for deployers is not “we didn’t know about the AI Act.” It is:

“We knew, we did some things, but when the auditor asked for the logs, we couldn’t produce them.”

The evidence trail is the difference between “we are compliant” and “we claim to be compliant.” Concretely, you need:

AI Inventory — a list of every AI system your organisation uses, including third-party tools and embedded AI features. For each: name, provider, purpose, data processed, outputs generated, who is affected.
Risk Classification — for each system, a documented assessment of its risk level under the AI Act (prohibited, high-risk, limited risk, minimal risk). This should reference the specific articles and annexes.
Obligation Mapping — for each system, a mapping of which Article 26 obligations apply and how they are met. Not a generic policy document — a system-specific mapping.
Technical Controls — the actual mechanisms that enforce the obligations: logging, monitoring, human oversight, input data validation. This is where governance frameworks like TramAI become relevant — they provide the technical mechanism that makes the compliance controls verifiable.
Incident Response Process — a documented process for detecting, recording, and reporting serious incidents. Including: who is responsible, what triggers a report, how the report is submitted, and how the incident is investigated.
Training Records — evidence that staff who operate or oversee AI systems have received appropriate training (Article 4 — AI literacy).

What Constant Labs Does

We are not a law firm. We are an engineering studio that builds the technical controls that make EU AI Act compliance verifiable.

Our approach:

AI Readiness Audit (€500, 10 business days) — AI inventory, risk classification, obligation mapping, and a 90-day implementation roadmap. This gives you the evidence trail for steps 1–3 above.
Private & Sovereign AI Deployment (from €3,500) — If your obligations require data residency, model control, or audit-ready logging, we deploy self-hosted models (Ollama, vLLM) or private cloud endpoints via TramAI — our open-source governed AI runtime for the JVM.
AI Software Integration (from €3,500) — If you already have AI in your stack but it lacks governance controls, we integrate the missing pieces: schema validation, approval gates, audit logging, and observability.

The key difference: we do not hand you a PDF and say “good luck.” We build the system that enforces the compliance in the execution path.

Start Here

If you are a deployer and you are not sure where you stand, the fastest path is:

Run the AI inventory. List every AI system your organisation uses. Most organisations find 2–5× more than they expected.
Classify the risk. For each system, determine whether it is prohibited, high-risk, limited risk, or minimal risk.
Map the obligations. For each system, identify which Article 26 obligations apply and whether you currently meet them.
Close the gaps. For the gaps, decide whether you need a technical control (logging, monitoring, human oversight) or a process control (training, incident response, documentation).

Our AI Readiness Audit covers steps 1–3 and gives you a 90-day roadmap for step 4. It costs €500, takes 10 business days, and you keep the documentation regardless of whether you work with us.

Book the audit →

This article is for informational purposes and does not constitute legal advice. For legal guidance on EU AI Act obligations, consult a qualified legal professional. The EU AI Act Service Desk (ai-act-service-desk.ec.europa.eu) is the authoritative source for the regulation’s text and guidance.