Most companies didn't build AI — they switched it on inside SAP, Microsoft, Oracle, Salesforce or Workday. That still creates obligations. Five questions map yours, on the post-Omnibus deadlines most checklists haven't caught up with.
Select everything that's activated or in rollout — not what you own on paper.
The Act classifies by use, not by product. Select all that apply — be honest about pilots too.
This is the provider trap: rebrand it, substantially modify it, or repurpose it into high-risk use, and you may inherit provider duties — far heavier than deployer duties.
"We're not an EU company" is not the exemption people think it is. The Act reaches you the moment output is used in the EU — scoring EU customers, screening EU applicants.
Two duties already apply to essentially everyone: AI literacy for staff (Article 4, in force since Feb 2025) and transparency where people interact with AI (Article 50, from 2 Aug 2026).