Regulation (EU) 2024/1689 is long, and almost all of the accessible summaries are written for enterprises. If you are a small team that put a model into a product, the summaries tend to leave you with a vague sense of exposure and no idea what to do on Monday.
This is not legal advice, and a genuine assessment of your own system needs someone qualified looking at your specifics. But there is a structure to the thing, and knowing the structure tells you roughly how much of it is pointed at you.
First, which role are you
The Act assigns obligations by role, not by company size, and this is the step most small teams skip. The four that matter are provider, deployer, importer and distributor.
You are a provider if you develop an AI system, or have one developed, and put it on the market under your own name. You are a deployer if you use one under your own authority in a professional context. The distinction matters enormously, because provider obligations are much heavier.
Here is the part that surprises people: calling a third party model API from your product frequently makes you a provider, not a deployer. If you have built something on top of that model, given it your name, and sold it, the fact that you did not train the weights does not make you a bystander. Conversely, if you use an off the shelf tool internally to help with hiring or performance review, you are a deployer of that tool, and deployer obligations for high risk systems are real but far narrower.
Second, which tier is the system
There are four, and the practical answer for most small products is the third or fourth.
- Prohibited practices under Article 5. Social scoring, certain biometric categorisation, manipulative techniques that cause significant harm. If you are here you do not have a compliance problem, you have a different product to build.
- High risk under Article 6 and Annex III. Employment and worker management, education access, essential private and public services including creditworthiness, law enforcement, migration, critical infrastructure, biometrics. This tier carries the heavy machinery: risk management system, data governance, technical documentation to Annex IV, logging, human oversight, conformity assessment under Article 43.
- Limited risk under Article 50. Transparency duties. Tell people they are interacting with an AI system. Mark synthetic content as machine generated. Disclose emotion recognition and biometric categorisation to the people subject to it.
- Minimal risk. Everything else, which is most software. No obligations under the Act beyond the general ones that apply to everyone.
Read Annex III properly before concluding you are outside it, because the categories are broader than they sound. A tool that screens or ranks job applicants is in scope even if you think of it as a productivity feature. So is one that scores applicants for a service on creditworthiness. “We are just a small SaaS” is not a tier.
What limited risk actually costs you
If you land in the Article 50 tier, which many products with a model in them do, the obligations are genuinely light and mostly amount to not being misleading.
Users interacting with your AI system should know they are. Content your system generates should be marked as generated, in a machine readable way where that is technically feasible. If you do emotion recognition or biometric categorisation, the people subject to it must be told.
That is a day of work and a paragraph in your documentation, not a compliance programme. The mistake is not the cost, it is failing to notice the tier applies and then discovering it during a buyer’s questionnaire.
What high risk actually costs you
Considerably more, and honestly more than you can improvise. A risk management system that runs across the lifecycle. Data governance covering your training and validation data. Technical documentation to the standard in Annex IV. Automatic logging. Human oversight designed into the product rather than asserted in the manual. Then conformity assessment under Article 43, which is either internal control or, for some systems, a notified body.
If your honest reading of Annex III puts you in this tier, the correct next step is not a checklist. It is professional advice, early, because several of these obligations shape the architecture and are expensive to add afterwards.
Where this fits with everything else
The AI Act does not replace anything. If you process personal data you still have GDPR, and the overlap is significant but the two are not substitutes. A DPIA is not an Annex IV file, and neither is a SOC 2 report.
What does transfer is the evidence. The record of what you assessed, when, and what you concluded is the same underlying material whether it is going into an AI Act file, a DPIA or a security questionnaire. Teams that keep that record once and reuse it spend a fraction of what teams reconstructing it from memory spend, every single time somebody asks.