The EU AI Act for companies that use general‑purpose AI models

The Act calls anyone who uses an AI system under its own authority a deployer (Article 3(4)). A company that calls GPT, Claude or Gemini through an API, or gives its staff an AI assistant, is the deployer of that system. The obligations for general-purpose AI models in Chapter V, such as technical documentation, information for downstream providers and a copyright policy, sit with the companies that make and place the models on the market.

A deployer takes on provider obligations when it puts its own name or trademark on a high-risk AI system, substantially modifies one, or changes the purpose of an AI system so that it becomes high-risk (Article 25). The Commission’s guidelines for general-purpose AI model providers explain when modifying a model, for example by fine-tuning, makes you the provider of the modified model.

Source: Article 25, AI Act Service Desk, Guidelines for providers of general-purpose AI models, European Commission, General-Purpose AI Code of Practice, European Commission

Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and of others who operate or use AI systems on their behalf, taking into account their knowledge, experience and training and the context in which the systems are used. The Digital Omnibus rewrote the article in July 2026: it remains an obligation, and it does not require any specific level of AI literacy for any individual.

The Commission’s questions and answers give the example of staff who use ChatGPT to write advertisements or translate text, who should be told about risks such as hallucination. No certificate is needed, and an internal record of trainings and guidance is one way to show the work. National market surveillance authorities supervise the obligation from 2 August 2026.

Source: Article 4, AI Act Service Desk, AI literacy questions and answers, European Commission

From 2 August 2026, Article 50 asks deployers to disclose that image, audio or video content constituting a deepfake has been artificially generated or manipulated. The same applies to AI-generated or manipulated text published to inform the public on matters of public interest, unless the text has been through human review or editorial control and a person holds editorial responsibility for it. Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them.

The information has to be clear and distinguishable and given at the latest at the first interaction or exposure. The Commission published a Code of Practice on marking and labelling AI-generated content on 10 June 2026, with a section for deployers on labelling.

Source: Article 50, AI Act Service Desk, Code of Practice on marking and labelling AI-generated content, European Commission

Using AI for a purpose listed in Annex III, such as recruiting and selecting candidates, managing workers, assessing creditworthiness or education, makes it a high-risk AI system. From 2 December 2027, Article 26 asks deployers of such systems to use them according to the provider’s instructions, assign human oversight to people with the competence and authority to exercise it, monitor the system and inform workers and their representatives before using it at the workplace.

Article 26(6) asks deployers to keep the logs the high-risk system generates, as far as they are under their control, for a period appropriate to its purpose and of at least six months, unless other Union or national law, in particular data protection law, provides otherwise.

Source: Article 26, AI Act Service Desk

Standard Compute puts Claude, GPT, Gemini and open models behind one company account, with a key for every person and every app. The inventory, the usage policy and the records then live in one place.

Every admin change is recorded with before and after values, and you can export a record of every request showing the model, the provider that served it and the region rule in force, kept for 12 months. Request records hold metadata only (model, provider, tokens, cost and status), never your prompts or outputs.

Choose exactly which inference providers may handle your data, for the whole company, a team or a single key. Lower levels can only narrow the rules, new providers are never added without an admin’s approval, and fallbacks can never route around your list. Decide which models each key can use, so every app and every team member gets exactly the models you approve.

Set a Europe rule for your company, a team or a single key, and every request, including retries and fallbacks, is served only by approved European inference endpoints. If no European endpoint can serve it, the request is refused before your prompt is sent. Our EU gateway terminates TLS and runs in Finland, and your account data is stored in Frankfurt.

Turn on zero data retention for your company, a team or a key, and every request is routed only to inference endpoints that commit to keeping no copy of your data. Teams and keys inherit the requirement and can never switch it off underneath you.

Connect Microsoft Entra ID or any SAML identity provider so your people sign in to Standard Compute with their work accounts. Employees sign in to Claude Desktop and Claude Code with their Microsoft work account, through our EU gateway, so usage is tied to a person in your directory.

These records help you keep the evidence your AI Act and GDPR work draws on. They are gateway records of model and provider use. The logs Article 26(6) refers to are those a high-risk AI system generates itself, and what the Act requires of your company is for your legal team to decide.

The full picture of what Standard Compute offers companies is on the enterprise overview. What we store, where it is stored and how it is protected is on the security page, with the sub-processor list and the DPA next to it.