EU AI ActAI for business ownersAI riskAI deployeroperationsGroundlens
The EU AI Act Is Not One Rule for Every AI Use
The tool name is not the answer. Describe the system, purpose, output, and your role before trying to classify an AI use.
If you made the five-row list from the first piece, the next mistake is to put every row into one box.
"We use AI" is too vague.
"We use ChatGPT" is only a product name.
The EU AI Act does not treat every system and use as if they were the same. The European Commission describes it as a risk-based framework for specific uses of AI.[1]
That sounds legal. The practical point is simple: you cannot understand an AI use from the logo on the login screen.
Same vendor, different job
Think about three situations:
- An assistant drafts an internal email.
- A system sorts job applications.
- A chatbot answers customers.
A company could buy all three from the same vendor. They are still different uses. The purpose changes. The output changes. The people affected may change.
The Commission's AI Act FAQ explains that risk classification depends on the function performed by the system, its intended purpose, and the specific purpose and way it is used.[2]
Official guidance: the actual function and use matter.
Practical interpretation: a tool name is not enough to describe the situation.
Do not classify each use from a short blog post. Collect the facts before asking for a classification.
Your company's role matters too
The Regulation separates several roles.
Law: it defines a "deployer" as a person or organisation using an AI system under its authority, apart from purely personal, non-professional use.[3]
Official example: the Commission describes the developer of a CV-screening tool as a provider and a bank using that tool as a deployer.[2]
Practical interpretation: buying a system does not automatically remove the business using it from the picture. "The vendor handles the AI" is not a complete description.
This article does not decide whether your company is a deployer in a particular case. That depends on the facts. The useful move is to record what the company actually does with the system.
Write one AI use in four lines
Take one row from your list and write:
- System: the product, feature, or model, if known.
- Use: the task and workflow where it appears.
- Output: what it produces and what happens next.
- People and roles: who provides it, who uses it, who checks it, and who may be affected.
For example:
System: AI feature inside the CRM
Use: Draft a follow-up email from a salesperson's notes
Output: Draft email; the salesperson reviews and sends it
People and roles: The vendor provides the feature, the company uses it, and the customer receives the message
The note gives you a usable description, not a compliance verdict.
Now compare it with this:
We use AI in sales.
The second version gives a lawyer, an IT lead, or the owner almost nothing to work with. The first version gives them a real starting point.
Do not jump from the note to a legal label
Avoid these shortcuts:
- Listing only the vendor name
- Treating a whole department as one AI use
- Assuming the vendor owns every responsibility
- Calling the business compliant because a person checks the output
- Treating this four-line note as a complete inventory
The note has one job: replace a vague AI label with observable facts.
Groundlens recommendation: do this for one use today. Keep unknown details marked as unknown. Then decide whether that use needs a deeper legal, technical, data, or operational review.
One better question
Do not start with:
Does the AI Act apply to us?
Start with:
We use this system for this task. It produces this output. These people provide, use, check, or receive it. Which rules and controls should we examine?
That question is narrower. It is also much easier to answer honestly.
Take one row from your P01 list and rewrite it now: system, use, output, people and roles.
If this exercise exposes several unclear uses, Groundlens qualification starts with the workflow, ownership, data sensitivity, and access boundaries before any implementation.
Sources
Is recurring work behind the question?
Tell us what keeps happening in the free fit check. We will review whether Groundlens is the right next step.