EU AI Act for IT Companies and AI Developers

For IT companies, the EU AI Act means that your obligations depend on your role: if you only use AI tools for work, you are a deployer and are subject to simpler rules; if you create and provide AI functionality in your product, you become an AI provider and assume significantly broader obligations as a developer. Many Lithuanian software companies fall into both roles simultaneously, so it is crucial not to confuse which set of rules applies when.

For an IT company, the first question is the role: is AI only used internally, or is AI functionality already provided to clients as part of a product? The answer determines whether we are talking about deployer duties or the broader obligations of an AI provider under the EU AI Act (Regulation (EU) 2024/1689).

Does the EU AI Act Apply to My IT Company?

Yes, almost always - the question is only which role applies. The EU AI Act regulates AI systems based on what you do with them, not the size of your company. An IT company typically falls into one of two roles (or both):

• Deployer - when you use AI in your professional activities: developers work with “Copilot”, the team uses “ChatGPT” for documentation, designers generate images. Read more in who the EU AI Act applies to.
• AI provider - when you integrate AI functionality (e.g., a chatbot, recommendation engine, or automatic content generation) into your product and provide it to clients under your own name or brand.

A key principle: if you take a third-party model (e.g., via API) and embed it in your software, which you then sell, you may become the provider of that AI system in the EU market - even if you did not create the underlying model yourself. This is a common mistake among IT companies: “we only use OpenAI” does not exempt you from provider obligations if you offer that functionality to end users as part of your product.

When Do the Obligations Take Effect?

Many IT companies mistakenly believe they have time until 2026. However, the basic obligations have been in effect since 2 February 2025:

This means that the AI literacy obligation under Article 4 has been in effect since 2 February 2025 and applies to every IT company whose employees use AI. GPAI model rules began applying on 2 August 2025, subject to transitional provisions. On 2 August 2026, general application and transparency provisions took effect, while high-risk system rules begin applying from 2 December 2027. If you create a product with high-risk AI functionality, additional provider obligations start applying from the relevant dates - but preparation for them (architecture, logs, documentation) must begin much earlier, as they cannot be “backdated” later.

How Do AI Provider Duties Differ from Deployer Obligations?

This is the key difference for IT companies. Deployers have a relatively light burden; providers have a heavy one. Here is the essential comparison:

AI developer obligations cover far more than just training. If your product falls into the high-risk category, you must have a documented risk management process, a quality management system, technical documentation, automatic event logging, and ensure human oversight. This is not a formality but real engineering and legal work that must be incorporated into the product plan from the very beginning.

When Does an IT Product Become a “High-Risk” AI System?

Most standard SaaS product AI features are not high-risk - a chatbot for customer service, text summarisation, or an internal code assistant. However, a product falls into the high-risk category if AI is used in sensitive areas, such as:

• employee recruitment, evaluation, or dismissal (HR tech);
• credit scoring or financial assessment;
• access to education or exam evaluation;
• essential public services or certain critical infrastructure;
• biometric identification.

For a precise list and logic, see the article on AI Act risk categories. The most important thing for an IT company is to conduct an honest self-assessment: if you create, for example, a hiring platform with AI candidate scoring, you are most likely a high-risk system provider with all the associated obligations. If you create a marketing text generator, it is almost certainly not high-risk, but you should assess the relevant Article 50 transparency duties and exceptions for the content and use involved.

A separate note on open-source components and code tools: if your developers use AI code assistants, this is a separate topic with its own risks - covered in detail in the article on Copilot and other AI code tools in companies.

What Should an IT Company Do in Practice?

Regardless of whether you are only a deployer or also a provider, the minimum set of actions for an IT company looks like this:

1. Determine your role for each AI system. Separately assess internal tools (those you use) and product features (those you provide). A single company often has both roles.

2. Train your team in AI literacy. This has been a mandatory obligation since 2 February 2025. Under Article 4, companies must take measures to support the development of AI literacy for staff and relevant persons, considering their knowledge, experience, training, context, and the people who may be affected. This does not mean that a specific or sufficient individual level must be guaranteed. Knowledge checks and records can help assess and explain training; Article 4 does not prescribe a specific test or document.

3. Inventory the tools you use. List every AI tool with its purpose, responsible person, and risk assessment.

4. Implement a usage policy. Clearly define what data can and cannot be provided to AI tools (client code, personal data, secrets).

5. On the product side - assess the risk category early. If a feature could be high-risk, plan for technical documentation, logs, and human oversight from the architecture stage.

6. Ensure transparency for users. Assess the applicable disclosure duties for AI interaction and particular types of generated content, including the exceptions in Article 50.

A good rule of thumb: if a client or auditor came tomorrow and asked, “how do you manage AI risk?”, you should be able to show documents, not just explain verbally. This evidentiary material is the essence of compliance.

What Documents Can Help a Company?

At the deployer level (which practically every IT company must have), the recommended set of documents includes:

• AI usage policy - how AI tools may be used and what data is prohibited.
• AI tool registry - with all tools used and their risks.
• Compliance record under Article 4 - proof that employees are trained in AI literacy (this document is not legally mandatory and is one possible way to record evidence).
• Employee AI guide - practical daily rules for the team.
• AI literacy training with knowledge checks and certificates - documented proof.

If you are also a provider with a high-risk product, this set is supplemented by separate technical documentation, a risk management system, and a conformity assessment - this is already product engineering work that cannot be purchased as a template.

You do not need to create the basic deployer document set from scratch. nebedirbam.lt automatically prepares this entire package for a fixed €149 + VAT (€299) price, tailored to your company’s answers - from policy to training with certificates (see homepage). If you first want to try the training yourself, there are also free AI literacy training. The free path is for one signed-in participant; team training is included in the paid documentation package.

Note: The EU AI Act does not require a specific certificate, a particular document bundle, fixed training hours, an external auditor, or a dedicated AI officer. These are practical recommendations, not legal obligations.

Frequently Asked Questions

Do we become an AI provider if we use OpenAI API in our product? You may. If you provide AI functionality to end users under your own brand, you are the provider of that system in the EU market, even if another party created the underlying model. The scope of obligations depends on whether the system is high-risk.

Does the Article 4 obligation apply if only 3 people work in the company? Yes. The AI literacy obligation has no exception based on company size and has applied since 2 February 2025 from the first AI user.

Is it prohibited to use AI tools with personal data? The EU AI Act does not prohibit using AI with personal data, but a GDPR compliance assessment must be carried out. Companies often prohibit the use of unapproved public tools with personal data, but this depends on the lawful basis, the principle of data minimisation, the reliability of the tool, and safeguards. There is no blanket ban - each situation must be assessed individually.

Our product only generates text - do we need to do full high-risk compliance? Most likely not. Text generation is usually not high-risk, but you should assess the relevant Article 50 transparency duties and exceptions for the content and use involved.

For more practical articles on EU AI Act compliance, see the list of all articles.

---

The information in this article is based on official EU AI Act (Regulation (EU) 2024/1689) sources: AI Act Service Desk - Article 4 and European Commission AI Act. For the latest information, visit these pages.