The AI Act: whose responsibility is it, the provider's or yours

When someone reads that there is a European law on artificial intelligence, the first reaction is usually: “and now what do I have to do?”. The reassuring answer is that, if you buy a virtual assistant rather than building one, most of the work is not yours. But it is worth knowing exactly where the line is.

General guidance, not legal advice. For your specific case, consult a professional.

Two different roles

Regulation (EU) 2024/1689 splits the obligations according to the role each party plays:

• Provider. Whoever develops the AI system and places it on the market under their name. They carry the bulk: design, technical documentation, risk management, data quality, system transparency.
• Deployer. Whoever uses it in their professional activity. That is the role of a hair salon or a clinic that takes on a virtual assistant. Their obligations are considerably lighter.

This distinction is the most practical thing to take away: buying is not the same as building, and the law recognises that.

What falls to you as a business

Broadly, and for an assistant handling enquiries and scheduling:

1. Use it for its intended purpose. That is, what it was designed for. An appointment assistant answers and books; it cannot be used for something it was not built for.
2. AI literacy. The regulation requires those operating these systems to have a sufficient level of understanding of what they do and of their limits. In practice: your team should know what the tool resolves, what it does not, and when to step in. This has applied since February 2025.
3. Maintain human oversight. There should be someone behind it able to review, correct and pause.
4. Comply with the rest of the rules that already applied to you. The AI Act does not replace data protection: the GDPR carries on separately.

Notice that none of these four things requires a technical department. They are common-sense good practices, now written down.

What you should be able to demand from your provider

This is where the law gives you leverage as a customer. From whoever sells you an AI assistant, it is reasonable to expect a clear answer on:

• What exactly the system does and what it does not do.
• That the person talking to it knows it is an AI.
• Where the data is processed and stored.
• How a conversation is handed to a person when needed.
• How it is paused or switched off.
• What gets recorded.

If a provider cannot answer that comfortably, that is the signal.

How we approach it at ClaudIA

At ClaudIA Tech we are the ones who build the tool, so that work is ours, not yours. And the answers to the list above are the ones we already give: ClaudIA answers, informs and books; it escalates to someone on your team when the case calls for it; data is processed in the European Union; conversations are logged; and you can pause it whenever you want.

If you want the full context of the rules, start with what the EU AI Act means for your business.

Buying well is, to a large extent, choosing someone who has already asked themselves these questions before you did.