Am I Covered by the AI Act? The Four-Question Test

Last updated: November 2026 · Reading time: 6 minutes

---

In short. If your organisation uses an AI tool in a professional setting, even an assistant like ChatGPT or Copilot, you are very likely covered by the AI Act. The real question is not whether the regulation applies, but which obligations it places on you. They depend on four parameters.

Regulation (EU) 2024/1689 does not target a sector. It targets systems, roles and uses. A very small business, a local authority or a start-up can therefore be subject to it just like a large group.

Question 1. Do you use an AI system within the meaning of the regulation?

Article 3 defines an AI system as an automated system that operates with some degree of autonomy and infers, from the input it receives, how to generate predictions, content, recommendations or decisions. The key word is inference.

Generally an AI system	Generally outside the definition
Conversational assistant (ChatGPT, Copilot, Mistral Le Chat)	Spreadsheet formula or macro
Customer-service chatbot based on an LLM	Business-rules engine with fixed rules written by a human
Automated CV or e-mail sorting	Descriptive statistics and classic dashboards
Data extraction by OCR combined with an LLM	Simple keyword search
Scoring or fraud-detection tool based on machine learning	Deterministic calculation from a fixed scale

The Commission's guidelines on the definition, published in February 2025, confirm that systems based solely on rules defined by humans remain outside. When in doubt, assume the tool is an AI system.

Question 2. What is your role?

The AI Act allocates obligations among several operators. One organisation can hold several roles depending on the tool.

• Provider. You develop an AI system, or have one developed, and place it on the market or put it into service under your own name. This is the heaviest role.
• Deployer. You use an AI system under your authority in a professional setting. This is the case for the vast majority of businesses and public administrations.
• Importer and distributor. You place on the European market a system designed outside the EU, or you resell it.

Beware of the role switch provided by Article 25. A deployer becomes the provider of a high-risk system if it puts its name on it, substantially modifies it, or changes its intended purpose so that it becomes high-risk. A company that builds its own chatbot on a model's API and puts it online under its brand is the provider of that chatbot.

Question 3. Are you within the territorial scope?

The AI Act applies to providers placing a system on the EU market, wherever they are established, and to deployers established or located in the EU. It also covers non-EU actors where the output produced by the system is used in the Union.

A few uses fall outside the scope.

• Purely personal, non-professional use by a natural person.
• Military, defence and national security uses.
• Scientific research carried out solely for that purpose, and research and testing before placing on the market, excluding testing in real-world conditions.
• Systems released under a free and open-source licence, unless they are prohibited, high-risk or subject to transparency obligations.

Question 4. What is the risk level of your use?

The risk level depends on the use, not the technology. The same model can draft an e-mail or screen candidates.

Level	Examples	What it implies
Prohibited (Article 5)	Social scoring, emotion recognition at work, manipulation exploiting vulnerabilities	Banned since 2 February 2025
High-risk (Annexes I and III)	Recruitment, employee evaluation, credit, education, access to public benefits	Stricter obligations from 2 December 2027 or 2 August 2028
Transparency (Article 50)	Chatbot, deepfake, generated text published to inform the public	Informing individuals since 2 August 2026
Minimal risk	Internal drafting aid, translation, spam filter	No system-specific obligation

A use listed in Annex III can escape high-risk status if it does not pose a significant risk and is limited, for example, to a narrow procedural task, to improving the result of a previously completed human activity, or to a preparatory task, under Article 6(3). This exception must be documented and never applies to profiling of individuals.

What applies to everyone

Whatever the risk level, two obligations already concern all providers and deployers.

• Do not use the prohibited practices of Article 5.
• Support AI literacy in your teams (Article 4). Since the Digital Omnibus, this is an obligation of means. You must take training measures adapted to the tools and uses, and be able to demonstrate them.

Three typical profiles

Profile	Role	Main obligations today
12-person firm using ChatGPT to draft documents	Deployer, minimal risk	AI literacy, no prohibited practices
E-commerce business that built its own chatbot on an LLM API	Provider and deployer of the chatbot	Tell visitors they are talking to an AI, plus the common obligations
Local authority piloting a tool to help process social benefit claims	Deployer, probably high-risk	Common obligations today, FRIA and human oversight before December 2027

What do you risk?

Fines reach €35 million or 7% of worldwide turnover for prohibited practices, and €15 million or 3% for most other breaches. For SMEs, and since the Digital Omnibus for small mid-cap companies, the lower of the two amounts is the cap. The real risk also lies in contracts, reputation and tenders, where compliance is increasingly requested.

FAQ

Is a very small business covered by the AI Act?

Yes, as soon as it uses an AI system in its activity. There is no size threshold. SMEs only benefit from lighter formalities and lower penalty caps.

Does an employee using free ChatGPT make the company a deployer?

If the use is on behalf of the company and under its authority, the company is a deployer. Unauthorised use raises a more delicate question, but it still exposes the organisation under the GDPR and on confidentiality.

My company is established outside the EU. Am I covered?

Yes, if you place a system on the European market or if its outputs are used in the EU.

Is the GDPR enough?

No. The GDPR protects personal data. The AI Act governs the systems themselves, even when they process no personal data. The two texts apply together.

Read also

• Digital Omnibus on AI: What Summer 2026 Really Changed in the EU AI Act
• Agentic AI vs Generative AI: What Changes for Your Compliance
• OCR, LLMs and the AI Act: Must You Tell Your Client?

What now?

The free DILAIG audit takes these four questions with a deterministic engine, no generative AI. It gives you your role, your risk level and your obligations article by article. For a first screening in two minutes with no account, also try our free tools Is My AI Prohibited? and Am I a General-Purpose AI Model Provider?

How many AI tools does your organisation actually use today, do you think?

Sources

• Regulation (EU) 2024/1689 on EUR-Lex
• Regulation (EU) 2026/1744 on EUR-Lex
• European Commission AI Act Service Desk