For IT consultancies · Written by Yobel Tzegai · Last checked 8 November 2026

What does the EU AI Act ask of an IT consultancy that uses AI in client projects?

Using ChatGPT, Copilot and other AI at work makes your consultancy a "deployer": AI literacy measures under Article 4 have bound you since 2 February 2025. Developing an AI system and putting it into service under your own name makes you its "provider". Complipath (complipath.io) keeps the record.

Software that does the work for you: we answer your customers' AI questionnaires, audit your AI vendors and set up your Trust Center. A person checks every answer. You keep the system.

Book a 20-min intro call20 minutes with the founder.Get my risk classes, free

Who this is for

IT consultancies and software houses that use ChatGPT, Copilot and other AI tools in their own work and in client projects, and get AI questions from their clients.

Complipath is software that does the work for you, not consultants: the register, the classification and the answers to your clients are kept in your workspace.

What the law already asks of you

AI literacy (Article 4, as replaced by Regulation (EU) 2026/1744 (the Digital Omnibus on AI)): providers and deployers of AI systems take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their knowledge and the context the systems are used in. It carries no risk qualifier, and it has bound deployers since 2 February 2025 under Article 113, third paragraph, point (a). Who the AI literacy duty applies to.
A register of the AI tools you use and the systems you build for clients is how you see which duty applies where: which tools staff use, in which projects, with which vendor.
Deep fakes and published text (Article 50(4)) and emotion recognition or biometric categorisation (Article 50(3)) add disclosures when you use AI that way. The four Article 50 duties.

When you become the provider in a client project

Article 3(3): the provider is the one that develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. A client who has a system developed by you and puts it into service under its own name is its provider.
Article 25(1), for high-risk AI systems: a distributor, importer, deployer or other third party is considered the provider, with the provider obligations under Article 16, if it puts its name or trademark on a high-risk AI system already placed on the market or put into service (without prejudice to contracts that allocate the obligations otherwise), makes a substantial modification to one so that it remains high-risk, or modifies the intended purpose of an AI system that was not high-risk so that it becomes high-risk. When a deployer becomes a provider.
Article 50(1): the provider of an AI system meant to interact directly with people designs it so they are told they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person given the circumstances and context. It does not apply to systems authorised by law to detect, prevent, investigate or prosecute criminal offences, unless they are available for the public to report a criminal offence.
Article 50(2): the provider of a system that generates synthetic audio, image, video or text marks the outputs in a machine-readable format and detectable as artificially generated or manipulated. It does not apply where the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics, or where it is authorised by law to fight crime.

How your clients ask

Clients put AI questions into their supplier questionnaires and audits: which AI tools you use in their project, whether their data reaches a model, whether a vendor trains on it, and who reviews what the AI produces.
Complipath answers them from your register, each answer with its source.

What Complipath does for you

The register of every AI tool and system, with its owner and vendor, and its classification with the article it rests on.
AI literacy: a path per role, and a record of who has completed it.
Your clients' questionnaires: the AI Act Answer Sprint when one is waiting, the Trust Setup before the next one arrives.
Your AI vendors checked: the Vendor Audit sends your requirements to each vendor and reports with a source behind every answer.

Starter

€499 a month

or €4,990 a year. Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
The Free plan is for one AI system and one user, with no end date

Get my risk classes, free

All plans

Questions

Does the EU AI Act apply to an IT consultancy that only uses ChatGPT and Copilot?

Yes, as a "deployer". Article 4 asks every deployer to take measures that support the AI literacy of the staff who operate and use AI systems on its behalf, at any risk level. Article 50(3) and 50(4) add disclosures for certain uses. What else applies depends on the systems and their class.

When does a consultancy become the provider of an AI system it builds for a client?

When it places the system on the market or puts it into service under its own name or trademark (Article 3(3)). A client who has the system developed and puts it into service under its own name is the provider. For high-risk systems, Article 25(1) adds three cases that make another party the provider.

Can you answer our clients' AI questionnaires for us?

Yes. The AI Act Answer Sprint answers the EU AI Act part of one questionnaire within 48 working hours from when we have everything, each answer with its source in the law, in your client's own file format. The Trust Setup sets up your register and Trust Center before the next one arrives.