Accountants & AI Act: concrete obligations for the deployer

What does the AI Act cover?

The AI Act classifies AI systems into four categories: unacceptable risk (prohibited practices), high risk (extensive obligations), limited risk (transparency obligations) and minimal risk (no specific obligation). It also distinguishes several roles: provider (who develops and places on the market), deployer (who uses the system under its own authority), importer and distributor.

A firm that simply uses third-party software is a deployer. Its obligations are real but considerably lighter than those of the provider, which bears responsibility for technical documentation, risk management, and conformity assessment.

Is the 'Chartered Accountants' sector affected?

Any firm using at least one AI-enabled tool is concerned as a deployer. The vast majority of such use cases fall under limited risk: the main obligation is then to inform individuals that AI is involved and to ensure human oversight.

One particular scenario warrants attention: if the firm uses AI to assess or screen individuals (credit scoring, pre-selection of job candidates), the tool may qualify as high-risk and trigger enhanced obligations — documented oversight, specific information requirements, and log maintenance.

Detailed obligations

Sanctions & risks

The AI Act thresholds are high: up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for failures to meet obligations applicable to high-risk systems, and €7.5M or 1% for providing inaccurate information to authorities. The higher amount applies.

For a deployer such as a law firm, the primary risk is not a prohibited practice but a failure of transparency or oversight regarding a poorly identified high-risk tool — which is why maintaining an inventory is essential.

Application timeline

• 1Entry into force. The regulation entered into force on 1 August 2024.
• 2Prohibited practices. Applicable since 2 February 2025.
• 3General-purpose AI models (GPAI). Obligations applicable from 2 August 2025.
• 4High-risk systems. Main obligations from 2 August 2026, and 2027 for certain systems integrated into regulated products.

Common mistakes in the sector

• 1"The AI Act only targets publishers". Believing that only the provider is concerned, when the deployer has its own transparency and oversight obligations.
• 2No inventory. Not knowing which firm tools embed AI or at what risk level.
• 3Superficial oversight. Displaying human oversight without the employee genuinely having the means to challenge the AI's output.
• 4Silence towards clients. Failing to inform clients about the use of AI in the production of deliverables.

Practical case

A firm deploys an assistant that pre-drafts collection letters and pre-analyses the creditworthiness of debtors on behalf of its clients. The drafting assistant falls under limited risk (transparency). However, the debtor scoring module, which influences a decision affecting individuals, may fall under high risk: the firm must then document human oversight, inform the individuals concerned, and verify that the vendor provides the required documentation.

Compliance roadmap

1. 1

   Inventory. Establish the register of AI systems used by the firm.

2. 2

   Classify. Qualify the risk level of each tool and identify any potential high-risk use cases.

3. 3

   Frame. Draft an AI usage policy, inform clients and staff, and organise human oversight.

4. 4

   Track. Implement vendor documentation retention and, for high-risk systems, maintain audit logs.

5. 5

   Revise. Periodically auditing tools and regulatory developments.

Frequently asked questions