Provider
Broadly, the organisation developing or commissioning an AI system and supplying it under its own name.
Start with your AI use, your role and the applicable rules.
This guide separates regulatory context from the workflow records CloudSeals can help you organise. Using an application or retaining evidence does not establish compliance.
Identify the role before choosing controls
Deployer
Broadly, an organisation using an AI system under its authority in a professional context.
These are simplified descriptions. Assess your actual role and scope against Article 3 on the Commission’s AI Act Service Desk.
Determine what applies to the use case
The Act uses a risk-based approach. Relevant requirements depend on the system, intended purpose and organisational role. An application name or operational incident severity does not determine legal classification.
Check the Commission overview and the application rules in Article 113 with your advisers before deciding what your deployment requires.
Dates to check against the current rules
- 2 February 2025: AI literacy obligations entered into application.
- 2 August 2026: the general application date; the Commission Q&A also gives this as the start of Article 4 supervision and enforcement.
- 2 December 2027 / 2 August 2028: amended application dates for relevant Annex III high-risk systems / high-risk systems under Annex I respectively.
Dates are not a classification decision. See Article 113 and the AI literacy Q&A.
Turn a requirement into a reviewable workflow
Define the work
Write down the input, intended purpose, users and the people affected.
Assign responsibility
Identify who reviews a recommendation, approves an action and handles exceptions.
Keep the record
Connect source context, the decision, reviewer and outcome so the work can be examined later.
Where CloudSeals fits
Finance
LedgerSight connects reconciliation exceptions, accountant review and decision evidence. It does not make a legal classification of your finance system.
Workplace safety
CompliSight supports configured events from approved CCTV and supervisor review. Assess privacy, worker-related requirements and classification for your particular use.
Carbon MRV
CarbonSight connects source data, methods and reviews. It does not decide your reporting obligations or provide an assurance opinion.
AI literacy and the operating discipline
The Article 4 guide describes a role-based approach to literacy records. TrustOps is the operating discipline; Evidence Fabric describes the decision record. CloudSeals does not inventory or govern arbitrary third-party AI systems.
Questions to clarify
Does CloudSeals certify EU AI Act compliance?
No. It supports operational review and evidence inside its application workflows. Your organisation and advisers determine the rules and whether your arrangements meet them.
Is every workplace AI system classified the same way?
No. Assess the intended use and the relevant legal provisions for the particular system. An internal alert severity is not an AI Act risk classification.
Where should we check for changes?
Use the Commission overview, AI literacy Q&A and AI Act Service Desk linked on this page. Revisit your assessment when the use case or applicable rules change.
Sources and review
Reviewed 25 October 2026 against the Commission pages and AI Act Service Desk linked above. The Service Desk identifies its text as based on the consolidated AI Act of 27 July 2026. This page is informational, not legal advice.