August 2 came and went. The EU AI Act now applies to companies that use AI.

For two years the EU AI Act felt like someone else's problem. The early deadlines hit model providers, and the loudest coverage was about frontier labs. That phase is over. Since August 2, 2026, the obligations for high-risk AI systems apply, and the law splits them between the provider who builds the system and the deployer who uses it.

Deployer is not a niche word. If your company runs a resume screener, a credit scoring tool, an exam proctoring system, or AI that manages workers, and that use touches the EU, you are likely a deployer of a high-risk system. The duties that follow are yours, not your vendor's.

What deployers actually owe

Article 26 is the working list. In plain terms, a deployer of a high-risk system must:

• Assign human oversight to people with the training and authority to intervene
• Use the system according to the provider's instructions for use
• Make sure the input data you control is relevant and representative for the purpose
• Monitor operation, and suspend use if you see a serious problem
• Keep the logs the system generates, at least six months
• Tell workers and their representatives before using high-risk AI on them

None of this requires a machine learning team. It requires knowing what you run, deciding who is accountable for it, and writing four or five short documents you can stand behind. That is organizational work, and most of it can be drafted in an afternoon once your AI use is actually mapped.

The trap: nobody owns the list

In most mid-size companies, AI arrived through the side door. Marketing turned on a generation feature, recruiting bought an ATS add-on, support enabled a copilot. Each choice was reasonable. The sum is a portfolio of AI systems no single person can list, which means no one can say which ones are high risk, which is the first question every framework asks.

That is why the practical first step is not a legal memo. It is an AI-use register: one row per system, what it does, who it affects, who owns it. Every obligation hangs off that list.

If you do one thing this quarter

Build the register, classify each use case honestly, and fix the two disclosure gaps almost every company has: chatbots that do not say they are AI, and candidates who are not told AI screens them. Those two fixes are cheap, visible, and they are the exact places enforcement starts.

Regolyn does this mapping and drafting from a guided questionnaire, and a lawyer should review whatever turns out to matter. Preparation first, opinions second.