Is the AI we use in Salesforce covered by the EU AI Act?

Who is the provider of an agent we build on the platform?

• Whoever puts it into service under its own name.
• Article 3, point (3) makes the provider the person that develops an AI system or has one developed and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge.
• A customer-facing agent you configure and launch under your brand can make you its provider, and Article 50(1) is then yours.
• Article 50 applies from 2 August 2026, the general date in Article 113, second paragraph, except that a provider of a system generating synthetic audio, image, video or text content placed on the market before that date has until 2 December 2026 to comply with Article 50(2) (Article 111(4)).

• Article 50(1): the provider of an AI system intended to interact directly with natural persons designs and develops it so that they are informed they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. The duty does not apply to systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards, unless they are available for the public to report a criminal offence.
• Article 50(5): the information is given in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, and conforms to the applicable accessibility requirements.

Which Salesforce uses are high-risk?

• The ones Annex III lists, whatever platform they run on.
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 5(b) of Annex III: AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud.
• Point 4 of Annex III: AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates, and AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.

What applies to every use?

• Article 4 on AI literacy and the prohibitions.
• Chapters I and II, which hold Articles 4 and 5, apply from 2 February 2025 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• That point keeps two later dates: Article 5(1), first subparagraph, points (ba) and (bb) apply from 2 December 2026, as do Article 5(1a) and (1b).

• Article 4(1), as replaced by Regulation (EU) 2026/1744: providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context of use, and considering the persons or groups of persons on whom the systems are to be used. The obligation does not require them to guarantee any specific level of AI literacy of any individual.
• Article 5(1), first subparagraph, point (a): an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective or the effect of materially distorting behaviour by appreciably impairing a person’s ability to make an informed decision, causing them to take a decision they would not otherwise have taken in a manner that causes or is reasonably likely to cause significant harm, is prohibited.

What about the company that makes the tool?

• Whoever provides the AI system or the general-purpose AI model behind a tool carries the provider’s duties, and they are that provider’s own.
• This page says nothing about how any vendor meets them: nothing here was read from a vendor’s own terms, and the duties above are yours whatever those terms say.