Guide
EU AI Act deployer checklist
If you use AI and did not build the model, start here — not with provider training.
You are probably a deployer
The Act splits providers (who build or substantially modify AI systems) from deployers (who use them). Using ChatGPT, a copilot, or a vendor model in a customer workflow is deployer work. Provider courses will not give you the checklist procurement will ask for.
Enforcement for the duties that hit everyday companies concentrates in August 2026. Waiting for a lawyer’s memo is how teams miss the runbook.
Twelve points to have answers for
Where AI is used (systems and teams). When a person is told they are interacting with AI. What inputs are banned from prompts. What outputs need human review before they reach a customer, a regulator, or a hiring file. What you log, for how long, and who can see it. Who is the human on the hook. What you tell a vendor. What you tell an employee. What you do after an incident. What you do not automate. What you review on a schedule. What evidence you keep for a customer or authority.
That list is the spine of Gabby Software’s Deployer Bootcamp (waitlist, Q4 2026). You can start answering the questions now; the course turns them into a 12-point checklist with triggers.
What this is not
Not legal advice. Not a provider conformity-assessment walkthrough. Not a security pentest. If you need the training with a waitlist and a classroom, join EU AI Act Deployer Bootcamp.