Knowing how your business uses AI is pretty important in any situation, but that knowledge has taken on major compliance and risk relevance as the EU AI Act is rolled out, explains Sam Peters of ISMS.online. Companies need to know how they’ll be categorized under the act, which has important compliance dates starting later this year. The distinctions aren’t as clear as you may think.
As organizations prepare for the EU AI Act, most of the attention has gone to risk classifications, documentation requirements and looming enforcement deadlines. All of which are important. But there’s a more basic risk that isn’t getting nearly enough attention.
It’s not whether you understand the rules. It’s whether you understand what your organization’s role is under them.
The EU AI Act does not apply to organizations in a uniform way. The regulation applies extraterritorially, meaning that it applies to organizations that operate outside the physical borders of the EU. Section 2 of the act notes that any organization placing AI systems on the EU market or whose AI outputs are used in the EU may be in scope, regardless of where it physically resides.
What matters is where your organization sits in the AI value chain, not where your organization has offices. Get that wrong, and everything that follows, from risk assessments to governance controls, starts on shaky ground.
The regulation distinguishes among several roles, including providers, deployers, importers and distributors. Each carries a different set of obligations.
Providers face the heaviest lift. They are responsible for ensuring that AI systems meet strict requirements before entering the EU market, including conformity assessments, documentation and ongoing monitoring. Deployers, by contrast, use AI systems developed by others. Their obligations are narrower, centered on oversight, monitoring and appropriate use.
That sounds clean and easy to distinguish. In practice, the line between these roles is anything but clean.
How organizations could get it wrong
A common assumption is that if you are not building AI models from scratch, you are a deployer. That assumption can fall apart quickly. Under the act, a deployer can become a provider if it makes substantial modifications to an AI system or markets it under its own name. One should not look at that scenario as remote or an outlier. In fact, it generally reflects how modern software is built.
Take a typical SaaS company. It might integrate a third-party foundation model, fine-tune it for a specific use case and embed it into a broader product offering. That product is then sold into multiple markets, including the EU. What is that company, then? A deployer? A provider? Both? The answer is not always obvious.
Misclassification is only part of the problem. More often, organizations are not just one thing. A single company might develop parts of an AI system, integrate third-party components, deploy those systems internally and distribute them externally through partners. Each of those activities can trigger a different role under the regulation. The result is overlapping obligations that do not always line up neatly. Again, this is becoming standard operating reality rather than a rare exception.
For compliance teams, that creates a level of complexity most existing models were never designed to handle. Ownership gets blurry. Accountability gets split. And it becomes easier than it should be for critical obligations to slip through unnoticed.
The EU AI Act’s ‘Wait and See’ Window Is Closing
AI literacy has survived attempts to water it down and remains a direct organizational obligation — not a policy aspiration
Read moreDetailsWhy this creates real compliance risk
For organizations operating across borders, misunderstanding your role is a technical problem, yes, but it’s also a governance problem. If you assume you are a deployer when you meet the definition of a provider, the gaps show up quickly. Conformity assessments may not happen or documentation may be incomplete. Requirements around transparency, traceability and oversight could be missed altogether. And when regulators come knocking, demonstrating compliance becomes difficult.
The EU AI Act is clear on one point: It is not enough to say you are compliant. You have to be able to show it. This points to a broader issue. Many organizations are still treating AI as just another layer of IT, which is a mindset that doesn’t hold up.
AI systems behave differently. They evolve, depend on complex supply chains and can directly affect individual outcomes. That combination makes informal or loosely defined governance models hard to sustain.
Without clear structures to identify where AI is being used, assign ownership, understand how systems are built and modified and track how they are deployed across markets, organizations are left guessing. We all know that guessing is not a strong compliance strategy.
For compliance leaders, the priority is not to memorize every detail of the regulation. But they need to know enough to get clarity on where the organization actually sits within it.
That means asking some basic questions. Where is AI being used across the business, including in products, services and internal operations? Which of those systems have an impact on operations in the EU? How are those systems built, particularly when third-party components are involved? Are systems being modified, fine-tuned or rebranded in ways that change their classification? And who exactly owns each system from a governance standpoint?
The answers tend to be more complicated than expected, though that is not necessarily surprising given the complexity of the regulation itself. But if this complexity is not surfaced, compliance decisions are being made on incomplete information.
Misunderstanding your organization’s role under the EU AI Act is not a small mistake. It is a foundational one, that can cause a butterfly effect that ripples outward into larger compliance failures. Organizations that take the time now to get that foundation right will be in a much stronger position, not just for this regulation, but for what comes next.
Sam Peters is chief product officer at ISMS.online, a cyber compliance platform. 
