The EU AI Act in your company step by step. Where to start in seven steps

Preparing a company for the EU AI Act means putting order into how staff use artificial intelligence: who is responsible, which tools you use, what is not allowed, what people need to learn and how you can prove all of it. It also applies to companies that do not build AI and only use off-the-shelf tools.

Below are seven steps in the order worth doing them, with control questions and links to detailed procedures.

Does the AI Act apply to a company that only uses AI?

Yes. Regulation (EU) 2024/1689 calls such a company a deployer (Article 3(4)) and excludes only personal, non-professional use. Since 2 February 2025 a deployer has had the Article 4 obligation, meaning measures that build AI literacy, and must respect the Article 5 prohibitions. Since 2 August 2026 part of the Article 50 transparency obligations apply as well. In Poland, the rules on inspections, complaints and penalties take effect on 28 October 2026. From then on the question "what have you done" can come not only from the regulator but also from a customer, a job applicant or an employee. A full overview of the obligations is on our EU AI Act for companies page.

Step 1: Ownership - who in the company looks after AI?

The AI Act does not create a role like the data protection officer. Without an owner, though, nobody makes sure the next steps happen, so it starts with a board decision.

Control questions: Who is responsible for AI use in the company, and is that in writing? Can this person stop a new tool from being rolled out? Who stands in for them? Do HR, IT and legal know whom to ask about AI?

If the answer is "everyone" or "IT", in practice it means nobody.

Step 2: Inventory - which AI tools do we use?

Every further obligation depends on which tools the company uses and for what. The list has to cover what is actually in use, not just what the IT department bought.

Control questions: Do we know which AI tools staff use, including on private accounts? Does each one have a purpose and an owner? What data goes into it? Are AI features built into ordinary software, such as the office suite or the CRM, on the list too?

We describe how to build that list in our article on the AI system register.

Step 3: Role - are we a deployer or a provider?

The role decides the scope of obligations and is assessed for each tool separately. Most companies are deployers. A company that offers customers its own chatbot is often a provider for that system (Article 3(3)).

Control questions: Which tools do we only buy, and which do we build or offer under our own name? Does our chatbot tell people they are talking to AI (Article 50(1))? Does any use case concern recruitment, employee evaluation or the creditworthiness of individuals? Who made this assessment for each tool?

Use cases in that last group may be high-risk systems under Annex III, with their own deadlines.

Step 4: Prohibitions - does anything fall under Article 5?

The prohibited practices have applied since 2 February 2025 and carry the highest fines in the regulation: up to EUR 35 million or 7 percent of annual turnover (Article 99(3)). Companies are most often surprised by the ban on inferring emotions in the workplace.

Control questions: Does any tool analyse the facial expressions, tone of voice or "engagement" of employees or candidates? Does anything assess people using data collected for a completely different purpose? Do AI-generated messages exploit the vulnerabilities of their audience? Have vendors confirmed in writing where their biometric data comes from?

There is no remediation path for a prohibition: the feature gets switched off. Details in our article on prohibited practices step by step.

Step 5: Literacy - do people know how to use AI safely?

Article 4 requires the company to take measures that build AI literacy among the people who use AI on its behalf. Since the July 2026 amendment it is an obligation of diligent conduct, so what counts is what you can show.

Control questions: Who in the company uses AI, and have they been trained? Does the scope of training match the person's tools and role? Does the training cover risks, data and the people affected by AI outputs? Do new hires go through it during onboarding?

One recording for the whole company rarely explains why HR and marketing got the same scope. That is how we build EU AI Act training for teams.

Step 6: Rules - what is allowed and when do we label content?

The AI Act does not require an AI usage policy in so many words, but without written rules diligence is hard to show. The policy says which tools and data may be used, who approves new ones and how the company discloses AI involvement in what it publishes.

Control questions: Do staff know which data must not be pasted into AI tools? Who approves a new tool? Do we publish deepfakes or text on matters of public interest that require disclosure of AI involvement (Article 50(4))? Have staff confirmed they have read the rules?

A policy template is in our article on how to write a company AI policy, and the labelling rules in the one on labelling AI content.

Step 7: Evidence - can we show all of this?

The last step turns actions into a trail that survives an outside question. After it, the company should have:

• a decision naming the person responsible for AI;
• a tool register with the company's role and an owner for each entry;
• a recorded review against the prohibited practices;
• a list of trained people with the date, scope and result;
• a policy with employee acknowledgements;
• a date for the next review.

We describe how to organise this documentation in our article on evidence of due diligence. If you already have some of it in place, the EU AI Act compliance audit step by step shows how to check where you stand.

On your own or with a tool?

All seven steps can be done in a spreadsheet and a word processor. The difficulty starts a few months later: new people and new tools arrive, and the documents stop matching reality.

That part is handled by the AI TrustCERT platform, which comes included in the training licence: a register with decision history, policies with acknowledgements and courses with an exam. To begin, the free AI Ready Check shows in a few minutes which obligations may apply to you. If your company is small, also read what the AI Act means for small and medium-sized companies.

Summary

For a company that only uses AI, the EU AI Act comes down to seven steps. First, name a responsible person and list your tools. Then decide your role for each tool and rule out prohibited practices. Next, train people with a scope matched to their work and write down the rules, including when to label content. Finally, collect the evidence.

The Article 4 and Article 5 obligations have applied since February 2025, the transparency obligations since August 2026. From 28 October 2026 the complaints procedure also runs in Poland. A company that goes through these steps now will answer an outside question with a document rather than a promise.

This article structures the preparation but does not replace a legal assessment of the specific AI use cases in your company.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.