EU AI ActAI for business ownersAI responsibilityAI literacyAI governanceGroundlens
Using an AI Tool Still Means Responsibility | AI Act
A vendor can provide the tool. Your business still needs to know what it does, who uses it, and who owns the next decision.
Buying an AI feature is easy.
Knowing what it does inside your business is harder.
A vendor may provide the system. Your company may use it in a real workflow. Someone still needs to understand the output, check it, and decide what happens next.
That is the practical point behind the provider and deployer language in the EU AI Act. It is not a claim that every company using ChatGPT becomes a provider. It is a reminder that the vendor name does not describe your whole situation.
For an owner or operations lead, the first useful question is not “Which role am I?” It is “What exactly is happening in this workflow, and who can act when it goes wrong?”
The vendor is not the whole story
The AI Act distinguishes roles.
A provider is the person or organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark.[1]
A deployer is a person or organisation using an AI system under its authority, apart from purely personal, non-professional use.[1]
Those definitions depend on the facts. A company using a vendor's tool is not automatically the provider. But buying the tool does not make the company's workflow disappear either.
The European Commission also describes AI literacy responsibilities for providers and deployers, including staff and other people dealing with AI systems on their behalf.[2] Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026 and is in force. It amended Article 4: the obligation remains, but no specific or “sufficient” level of AI literacy is mandated for each individual. The Commission’s Q&A still describes that amendment as proposed, so use the consolidated Regulation for the legal wording and the Q&A as practical guidance only. This does not turn the obligation into one universal certificate, test, or training course.
This is why a tool list is not enough. “We use ChatGPT” tells you the product name. It does not tell you what the product does, who checks it, or who can stop the use.
The same tool can create different questions
Imagine three businesses using the same AI assistant:
- One uses it to draft internal emails.
- One uses it to sort job applications.
- One uses it to answer customer questions.
The product name is the same. The workflow is not.
The output is different. The people affected are different. The person checking the result may be different. The consequences of a bad answer are different too.
These examples do not assign a legal role or risk level to any named company. They show why the use needs to be described before anyone can sensibly decide what controls or advice are relevant.
Write down one real use
For each AI use, write down these six lines:
- System: Which product, feature, or model is involved?
- Workflow: What task does it perform, and where does it sit in the process?
- Output: What does it produce, and what happens next?
- People: Who provides it, uses it, checks it, or may be affected by it?
- Owner: Who can stop the use, correct the output, or decide what happens next?
- Unknowns: Which facts have not been checked yet?
Mark unknowns as unknown. That is better than filling the gap with an assumption.
For example:
System: AI feature inside the CRM Workflow: Draft a follow-up email from a salesperson's notes Output: Draft email; the salesperson reviews and sends it People: Vendor provides the feature; the company uses it; the customer receives the message Owner: Sales manager decides whether the workflow remains in use Unknowns: Retention, access permissions, and escalation process still need checking
This is not a compliance verdict. It is a usable description of the work. It gives an owner something concrete to review with the relevant legal, technical, or data-protection specialist when the use is consequential.
Responsibility is not the same as blame
The useful question is not “Who gets blamed if the AI is wrong?”
It is:
Who knows this system is being used, who checks what it produces, and who can stop the workflow when it fails?
The answer may involve the vendor, the company, a manager, a contractor, or several people. The answer may also be unknown. Make that visible before you decide which rules or controls matter.
Groundlens recommendation: start with five actual uses. For each one, name the human owner and record the system, workflow, output, provider or vendor relationship, user, checker, affected people, and unknowns. Do not call the list a complete compliance programme. It is the first layer of operational visibility.
Sources
[1] EU AI Act Service Desk, Articles 2 and 3: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2 and https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3
[2] European Commission, AI literacy questions and answers: https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
[3] EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and entering into force on the third day after publication: https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
Is recurring work behind the question?
Tell us what keeps happening in the free fit check. We will review whether Groundlens is the right next step.