What does the EU AI Act already ask of a B2B company that uses AI?

Who this is for

• B2B companies with 20–150 people, software, IT and consulting firms among them, that use AI and answer security and compliance reviews from their customers.
• Complipath never decides your risk level for you: it shows what the law says, where it says it and what follows, and the decision stays with you.
• You do not have to build AI to be asked about it.

Complipath is software, not consultants. The Sprint, the Trust Setup and the Vendor Audit are done in Complipath, and what they produce stays in your workspace.

What the law already asks of you

• AI literacy (Article 4, as replaced by Regulation (EU) 2026/1744 (the Digital Omnibus on AI)): providers and deployers of AI systems take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their knowledge and the context the systems are used in. It carries no risk qualifier, and it has bound deployers since 2 February 2025 under Article 113, third paragraph, point (a). Who the AI literacy duty applies to.
• Emotion recognition and biometric categorisation (Article 50(3)): if you use such a system, you inform the people exposed to it of its operation and process their personal data under the GDPR. The duty does not apply where the use is permitted by law to detect, prevent or investigate criminal offences.
• Deep fakes and published text (Article 50(4)): you disclose that a deep fake your AI system makes is artificially generated or manipulated, and that AI-written text published to inform the public on matters of public interest is. For an evidently artistic, creative, satirical, fictional or analogous work, the duty is limited to disclosing that such content exists. It does not apply to text that has undergone human review or editorial control where a natural or legal person holds editorial responsibility for it, or to uses authorised by law to fight crime. The four Article 50 duties.
• If one of your systems is high-risk, the deployer duties of Article 26 come on top. The free check tells you which class each of your systems is in, with the article behind it.

How big customers ask

• They put AI questions into their supplier questionnaires and audits: which AI vendors and models you use, whether people are told it is AI, whether personal data reaches a model, whether a vendor trains on your data, and whether a person reviews decisions.
• Complipath answers them from your register, each answer with its source.

The ways in

• Complipath covers the whole EU AI Act, not only security questionnaires: the record of your AI systems and everything the Act asks of you.
• A customer's questionnaire, an audit or your Trust Center is usually where it starts: the AI Act Answer Sprint when a questionnaire is waiting, the Trust Setup before one arrives, and the Vendor Audit when it is your own vendors you need to check.