The EU AI Act for a 200-person company: what you actually have to do

The EU AI Act runs to well over a hundred pages, and most commentary on it is written for companies that build AI models. If you run a 200-person logistics firm, clinic group or manufacturer, very little of that is about you. Some of it is, though, and it is worth knowing which parts.

What follows is a practical overview for companies that mainly use AI rather than develop it. It is not legal advice, and the timetable for some obligations has been under review, so check current dates with your counsel.

Start with an inventory

You cannot classify what you have not listed. Write down every AI system in use: the obvious ones, such as a chatbot on your website, and the less obvious, such as AI features inside your HR software, CRM or accounting package, and the tools staff have signed up for themselves. For each, note who uses it, for what, and with which data. In a company of 200 this typically takes two weeks and turns up between fifteen and forty items.

Sort by what the system does

The Act is built on risk categories, and they depend on the use, not on your size.

• Prohibited uses. A short list including manipulative techniques, social scoring and, with narrow exceptions, emotion recognition in workplaces. If you find one, stop.
• High-risk uses. Mainly AI that makes or shapes decisions about people in sensitive areas: recruitment and staff evaluation, access to credit or insurance, education, essential services. Medical devices and safety components fall here too.
• Transparency uses. Chatbots and AI-generated content. People must be told they are dealing with an AI system, and synthetic content has to be identifiable as such.
• Everything else. Most internal productivity uses. No specific duties beyond the general ones below.

The duty that applies to everyone: AI literacy

Any organisation that uses AI systems has to make sure the people operating them have a sufficient level of AI literacy for what they do. The Act does not prescribe a course. In practice a regulator or auditor will want to see that staff were trained in a way that fits their role, and that you kept a record. A ninety-minute session per role, with an attendance list and the materials on file, covers most companies.

If you use a high-risk system

Most mid-sized companies meet high-risk AI as a deployer: you bought a recruitment screening tool or a credit-scoring module from a vendor. The heavy obligations sit with the provider, but you still have duties. Use the system according to its instructions. Assign human oversight to someone with the competence and authority to exercise it. Keep the logs it generates. Tell workers and their representatives before using it on them. Check that your vendor can show its own conformity. This is where your contracts matter, so ask vendors now what they will provide and when.

Do not forget the GDPR

The AI Act sits alongside data protection law and does not replace it. If personal data goes into an AI tool, you still need a legal basis, a processor agreement and, for riskier uses, a data protection impact assessment. In our experience this is where most real exposure lies today, usually through free tools used with customer data.

A sensible minimum

• An AI inventory with an owner, reviewed twice a year.
• A risk classification for each item, with the reasoning written down.
• A short AI policy: approved tools, forbidden data, who to ask.
• Role-based literacy training with records.
• A check of vendor contracts for the tools that touch decisions about people.

For a company of 200, that is six to ten weeks of part-time work, most of it useful beyond compliance. The inventory alone usually pays for itself in cancelled duplicate licences.