Updated on 7 October 2026: we have rewritten this article from our practical perspective. Legal content now appears only as linked primary sources.
Almost every company uses more AI than its licence list shows
"We don't build AI." We hear this sentence a lot when the AI Act comes up. It is usually true. It still doesn't tell you which AI is running in your company.
Check it quickly against your own day-to-day work. Does your sales team use ChatGPT to draft quotes? Is Copilot running in your Office applications? Does your CRM sort customers with an AI feature the vendor added in an update? If you go through these questions honestly, you will usually find far more tools than anyone had on their list.
The AI Act calls companies that use AI systems in a professional capacity "deployers". The definition is in Article 3(4) of the regulation. That is where the check gets its name. Whether the term applies to your company, and with which obligations, is a legal question that we do not answer here. The deployer check is a practical check of how you use AI. It gives you the overview your legal counsel needs to answer that question quickly.
Our experience: the effort lies less in the rulebook and more in getting the overview. Once you know which AI is running in your company, most of the work is behind you.
Deadlines and obligations: where to find reliable answers
Since the AI Omnibus, an EU package of amendments to the AI Act, you often hear that the AI Act has been postponed. Which dates have actually changed is set out by the European Commission, more up to date and more authoritatively than we could. The legal text is on EUR-Lex: the AI Act itself and the amending Regulation (EU) 2026/1744.
In Germany, the Bundesnetzagentur (Federal Network Agency) runs an AI service desk for questions about the AI regulation. It also has a dedicated information page on the AI literacy of employees. For your individual case, your legal counsel is the right point of contact.
For our work, something else counts. You need the inventory whichever deadline happens to apply. That is why we don't advise waiting.
The deployer check in 5 steps: from tool inventory to a list of open questions
The deployer check is not a legal opinion. It is a structured stocktake with the tools you already have, and the practical route to an overview on which your legal counsel can map obligations. You need one responsible person, a spreadsheet and a few weeks of calendar time. The five steps build on each other.
Step 1: Inventory your AI use, including shadow AI
Record every system in which AI is at work. There are three categories:
- Obvious tools: ChatGPT, Copilot and similar assistants that employees use directly.
- Embedded AI features: AI features in software you already use, such as text suggestions in the CRM, automatic prioritisation in the ticketing system or translation functions.
- Shadow AI: tools that business units have introduced without IT approval. You won't find them with a circular email. You find them in conversation. Ask each department specifically what it uses to write texts, create images, screen applications or analyse data.
For each system, note the name, purpose, the department using it and the data that goes into it. That is all the inventory needs to begin with.
Step 2: Flag sensitive use cases
The AI Act does not treat all AI the same. We do not decide ourselves how an individual system should be classified. We sort pragmatically: anything that assesses people (applications, creditworthiness, performance), analyses emotions or categorises people by biometric features gets the note "legal review".
Guidance for mid-sized companies is available from the chambers of industry and commerce (IHKs) and the Mittelstand-Digital centres, among others. For a binding answer, go to the Bundesnetzagentur's AI service desk or your legal counsel. Also mark honestly where you are unsure. Those uncertainties are a result too.
Step 3: Collect open questions for each system
Each system gets a short list of questions that come up in daily work. These are the ones we use:
- Do the people who work with the tool know what it can do and where it gets things wrong? Is there training or guidance that fits how it is used?
- Does the system have customer contact? Can the customer see that they are talking to an AI? There is a separate article on the AI notice in customer service.
- Does your company publish AI-generated images, texts or audio, and who approves them?
- Did you have the chatbot on your website built under your own name, or is it an off-the-shelf product? That question goes on the list for your legal counsel.
- Who checks the results before they take effect?
Your legal counsel handles the legal mapping. With this list, it goes quickly.
Step 4: Name owners
A table without names stays on paper. Name one responsible person for each system. They don't have to come from IT. They should come from the department that actually uses the system. This person answers three questions from now on: What do we use the tool for? What data goes into it? Who checks the results before they take effect? On top of that, the check needs one owner at management level who decides when two departments disagree.
Step 5: Document the gaps
The last step is the most valuable: write down what is missing. Typical gaps are tools without a clear purpose, systems without a named owner, missing training or no rule on which data may go into external AI services.
Prioritise by proximity to the customer. Whatever customers see directly comes first. Next comes everything you flagged for "legal review" in step 2, with enough lead time for that review.
The end result is a working list. Every system is recorded, flagged and has open questions and a name attached, and the open points are prioritised. That lets you steer. From here on, the check becomes a tool.
What the check delivers beyond the question of obligations: your first honest AI inventory
Look at the result once more without the compliance lens. On the table is a list of all the AI tools actually running in your company, including the ones business units use without approval. You also have an overview of who works with what, and an honest marking of the places where rules, owners or clarity about data are missing.
That is exactly the foundation you need for the next steps anyway.
For assessing readiness: whether your company is ready to run AI productively shows in the current state of things. Which processes already touch AI today? Where are results produced that nobody checks? Without an inventory, you are guessing. With one, you can assess.
For governance (the rules and responsibilities for using AI): you can only write rules for systems you know about. A policy that misses how AI is actually used gets ignored. The gaps documented in the check, meaning missing ownership and unclear data flows, are your governance agenda in rough form.
For first agentic workflows: by this we mean processes in which AI carries out steps on its own, within clearly defined limits and with human control at the right points. That takes operational discipline: use according to the instructions, oversight by people who understand the system, control of input data, ongoing monitoring. If you practise these patterns early, you build the capability that productive operation will later depend on.
We rarely see clearly named owners for AI tools. Once you have done the check, you know where you stand and can plan from there, instead of starting from scratch with every AI project.
The same stocktake your legal counsel needs for the question of obligations is the first working step of the transformation. That is where the leverage of the deployer check lies.
From check to operations: governance and approval levels from the start
The result of the deployer check is a list: which AI systems are running in your company, who uses them, with what data, and where are rules missing? The most common mistake at this point is to turn it into a rulebook that disappears into a folder. It works better to derive a simple operating rule from each gap, one that works on Monday morning.
You need two kinds of rules.
First: who may approve what? Not every AI output needs the same level of control. An internal draft is something different from a quote that goes to a customer or an assessment that affects a person. Sort the use cases from your check into two or three approval levels: what can go out without review, what needs a look from the business owner, what does management decide? The idea behind it is simple. For every system there is a named person who is accountable for what it does day to day.
Second: which data may go where? The check has shown which tools your teams actually use, often including the ones nobody officially knew about. The rule for this fits on one page: which data categories (customer data, contracts, HR data, internal figures) may go into which tool, and which into none? Without that page, employees answer the question themselves, each in their own way.
Whatever the classification, we stick to a few principles in our projects: run tools the way the vendor intends, have people oversee the results and keep watching how things run. We apply this to ordinary office tools too. They describe what separates orderly operation from an experiment.
The yardstick for each of these rules is the same: can someone in accounting or a project lead in sales decide within thirty seconds whether what they are about to do is allowed? If so, the rule gets followed. If the answer is a reference to chapter 7, section 3, it gets ignored. Then you are back to the shadow AI the check has only just brought to light.
This is how the check becomes an operating system in the literal sense: documented responsibilities, clear data flows, defined approvals. On this basis you can set up first automated AI processes responsibly, without every new application raising the governance question all over again.
Typical mistakes: waiting, over-regulating, delegating to IT
We come across three reactions to the topic again and again. All three cost more than they save.
Mistake 1: waiting until the legal situation is clearer. Deadlines can change, as the Omnibus showed. You still need the overview of your AI tools, for every further AI decision and for every conversation with your legal counsel. Waiting mainly postpones the benefit.
Mistake 2: over-regulating. The other extreme is a 50-page AI policy, legally watertight and practically unusable. In a company with 100 employees nobody reads it, and what nobody reads steers nothing. The result is standstill: business units keep using AI, they just stop asking. What works is a handful of clear rules from the check result: which tools are approved, which data they must not see, who approves new applications. One page that people follow beats a folder that puts them off.
Mistake 3: treating the check as an IT ticket. IT can list tools. It cannot decide which risks the company takes on, who oversees an AI system and which uses fit the business. Those are questions of organisation and leadership. You can delegate the execution, but the accountability stays with management. That is why the check belongs on management's agenda, with IT working on it.
The pragmatic middle ground is unspectacular: start now, regulate little and assign responsibility clearly.
Your next step: the check as a manageable project
The deployer check is not a year-long project. For a mid-sized company with 50 to 200 employees, the first two steps, the tool inventory and flagging sensitive use cases, can be done in a few weeks. It won't happen on the side, but it is not a major construction site either. One responsible person driving the topic, plus short surveys in the business units, is enough to start.
What you need internally:
- One person with a mandate from management. They don't have to come from IT. What matters more is that they can ask questions across departments and get answers.
- Honest feedback from the business units. The inventory stands or falls on employees naming the AI tools they use unofficially as well. That only works if it is clear that the point is the overview and nobody needs to fear sanctions.
- A simple document instead of a rulebook. A table with tool, purpose, users and a "legal review yes/no" note is enough to start with. For enquiries, the inventory turns into the AI documentation with three documents.
External support is not always necessary. For initial guidance there are free offerings, for example from the chambers of industry and commerce. Outside support becomes useful when nobody internally has the capacity to drive the inventory reliably, or when the result is meant to turn into real operating rules: who approves what and which data may go where. The legal classification of individual systems belongs with your legal counsel. We support them with the inventory.
If you are at this point, we offer a no-obligation governance intro call. We are not selling a product, and you are not committing to anything. Together we look at your inventory or at how to set one up. Afterwards you decide for yourself whether and how to continue. At worst, you have invested one conversation and know where you stand. At best, the deployer check is the start of running AI productively. The AI Diagnostic gives you a first assessment of where you stand.
One question remains either way: do you know today which AI is actually running in your company?
Frequently asked questions
Where do we start? With the inventory. Ask each department what it uses to write texts, create images, screen applications or analyse data, and note the purpose, users and data for each tool. Embedded AI features in the CRM or ticketing system belong on the list just as much as tools running without approval. Everything else builds on this list.
Who should own the inventory? One person with a mandate from management who can ask questions across departments. They don't have to come from IT. In addition, someone from the business unit that uses each individual system takes responsibility for it, because that is where people know what the tool is used for and who checks the results.
Where can we find reliable information on deadlines and obligations? In the primary sources. The European Commission describes the current timeline of the AI Act, and the text of the regulation and its amendment is on EUR-Lex. For questions of classification, the Bundesnetzagentur offers an AI service desk. Your legal counsel clarifies what applies to your company. The links are in the sources below.
Is an AI usage policy enough, or do we need more? A policy is a start. It does not answer the decisive questions, though: which AI systems are actually running in your company, including those without approval? Where are the sensitive use cases? Who owns each system? On top of that, people who work with AI need training or guidance that fits how they use it. A document on the intranet hardly does that. The sensible order is inventory, then getting the open questions answered, then rules that work in daily practice: who may approve what and which data may go where.
How much effort does a deployer check mean for a company with 50 to 200 employees? Less than most people expect. At this size, the inventory and the flagging of sensitive use cases can be done in a few weeks. You need one responsible person with backing from management, short surveys in the business units on how AI is actually used, and a simple table. External support pays off when nobody internally has time to drive the topic, or when the result is meant to become operating rules. You do not need it for the inventory itself.
This article describes our practical perspective. It does not contain a legal assessment; for that, we refer you to the linked primary sources and your legal counsel.