What must we do when we use AI? Deployer obligations under the AI Act
Short answer
Every business that uses AI must ensure AI literacy (Article 4), avoid prohibited AI (Article 5) and tell people when they are exposed to deepfakes or emotion recognition (Article 50). If you use high-risk AI, Article 26 applies on top from 2 December 2027: use the system according to the instructions, give oversight to competent people, make sure input data is relevant, monitor the use, keep logs for at least 6 months, inform employees and those affected, and cooperate with the authorities.
Duties for all AI use
| Duty | When | Article |
|---|---|---|
| AI literacy | Since 2 February 2025 | Art. 4 |
| No prohibited AI | Since 2 February 2025 | Art. 5 |
| Disclose deepfakes and emotion recognition | From 2 August 2026 | Art. 50(3) and (4) |
Extra duties for high-risk
Article 26 applies from 2 December 2027 for uses in Annex III. The most important part is human oversight: a person who understands the system, can see when it gets things wrong and has the authority to say no. In GoalCube, a person decides every case about an individual, and the log shows who decided what, when and why.
What about the GDPR?
Many of the duties overlap with the GDPR: the duty to inform (Articles 13 and 14), the right to a human decision (Article 22) and the data protection impact assessment (Article 35). The AI Act says directly that you must use the provider's information for your DPIA (Article 26(9)).
What to do
- Follow the instructions for use.Use the AI for what it was built for, as the provider describes.
- Assign oversight.Named people with the competence, training and authority.
- Control input data.Data you provide yourself must be relevant and representative for the purpose.
- Monitor and react.Stop using it and notify if the AI presents a risk or a serious incident occurs.
- Keep logs.The automatic logs under your control, for at least 6 months.
- Inform.Employees and their representatives before use in the workplace; people subject to decisions.
What the law says
- Article 26 AI Act – obligations of deployers of high-risk AI systems
- Content unchanged by the Digital Omnibus; applies from 2 December 2027 for Annex III.
- Article 27 AI Act – fundamental rights impact assessment (FRIA)
- For public bodies, private bodies providing public services, and for credit and life/health insurance.
- Article 86 AI Act – right to explanation
- People affected can ask for an explanation of the AI's role in a decision.
Questions and answers
Are we a deployer when staff use ChatGPT?
Yes, when they use it in their work for you. Personal, non-professional use is exempt.
How long must we keep logs?
At least 6 months for the logs under your control, unless other law says otherwise.
How do we inform employees?
Before you start using high-risk AI in the workplace, employees and their representatives must be told. GoalCube has a ready-made template.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.