Why Copilot brings you under the Regulation
The EU AI Act (Regulation (EU) 2024/1689) distinguishes between who makes AI and who uses AI. Microsoft is the provider of Copilot. But as soon as YOU deploy it within your organisation, you are the deployer. That role does not exist only for large companies: a three-person office that uses Copilot in Outlook falls under it just as much.
Note — this has applied since 2 February 2025
The AI literacy obligation (Article 4) is not a thing of the future. It is already in force. Every organisation that uses AI systems such as Copilot must be able to demonstrate that its staff know enough about them. Most SMEs have not yet put anything in place for this.
But how extensive your obligations are depends on HOW you use Copilot
Here is where the catch lies. Using Copilot to summarise emails is something quite different from deploying Copilot to pre-select job applications or assess customers. The same tool can in one case create only a light transparency obligation and in another fall under the stricter rules for high-risk AI. The AI-generated content you publish externally counts too.
In other words: you cannot read off from a single table what you need to do — it depends on your own situation. That is why AI Act Wise works with a short scan that maps out your specific use and links it to the right articles of the Regulation.
Know within 10 minutes where you stand
The free scan shows which AI your company uses and which obligations that entails. The full report gives you a concrete action plan — exactly what you need to arrange, and when.
Start the free scanFrequently asked questions
Does my company fall under the AI Act if we use Microsoft 365 Copilot?
Yes. Under the EU AI Act (Regulation (EU) 2024/1689), an organisation that uses Copilot is a 'deployer' of an AI system. This applies regardless of your sector or company size — including SMEs and the self-employed.
Which rules already apply right now?
The AI literacy obligation in Article 4 has already been in force since 2 February 2025. Every organisation that uses AI systems such as Copilot must ensure that its staff have a sufficient understanding of them. On 2 August 2026 the transparency obligations, among others, will follow; the requirements for high-risk AI are expected to be postponed to 2 December 2027 (Digital Omnibus, not yet final).
Does Copilot automatically make us a 'high-risk' company?
No — simply using Copilot does not automatically make you high-risk or a 'provider'. Those heaviest obligations rest with Microsoft. Which rules apply specifically to YOU depends on how you use Copilot and other AI. That is exactly what the scan works out for you.
How do I know which obligations apply specifically to my company?
Take the free scan. Based on your own answers, you will see which AI applications you use and which articles they fall under. The full report gives you a concrete, phased action plan.
This page is informational and does not constitute legal advice. The scan is a self-assessment tool based on Regulation (EU) 2024/1689. No rights can be derived from the results.