Who is responsible for AI use in an organisation?

In brief

Responsibility for AI use belongs first to the organisation in the role it has under the AI Act, not to one job title. The AI Act’s Article 3 separates roles such as provider and deployer, and Article 26 gives specific duties to deployers of high-risk AI systems. The Act does not require a role called AI officer, but an organisation usually needs a named practical owner who can coordinate risk classification, instructions, oversight, records and escalation. That person must understand the AI Act duties, bias and transparency risks, and the data protection boundary for automated decisions.

Responsibility starts with the organisation’s role, not a person’s title

An AI system is software that uses inputs to produce outputs such as predictions, recommendations, content or decisions. A simple example is a tool that ranks job applications or suggests which customer request should be handled first. The legal question is not first who in the organisation likes AI. The first question is what role the organisation has in relation to the system.

The AI Act’s Article 3 defines several roles. The most important split for daily governance is between the provider and the deployer.

A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, except for personal non-professional use. In plain language, a software vendor may be the provider, while a municipality, employer or company using the system in its own process may be the deployer.

This split matters because duties follow the role.

Situation	Likely role to check	Practical question
The organisation buys an AI recruitment tool and uses it in hiring	Deployer	Is the system used as instructed, with trained human oversight?
The organisation sells an AI system under its own name	Provider	Are provider duties for design, documentation and conformity handled?
The organisation changes a system’s intended purpose so it becomes high-risk	Provider duties may arise	Has the change moved responsibility under the AI Act’s Article 25?
The organisation imports or distributes a high-risk AI system	Importer or distributor	Have the required checks and information duties been handled?

The AI Act’s Article 25 is especially important for organisations that customise systems. A deployer, distributor, importer or other third party can be treated as the provider of a high-risk AI system if it puts its name or trademark on the system, makes a substantial change to a high-risk system, or changes the intended purpose of another AI system so that it becomes high-risk. This means procurement alone does not settle responsibility. Changes made after purchase can change the legal role.

AI governance therefore starts with an inventory. Each AI use case needs an owner, a purpose, a role assessment and a risk classification. The organisation also needs to know whether the system is used in a context where people’s health, safety or fundamental rights may be affected.

An AI officer is the practical owner, even though the AI Act does not use that title

The AI Act does not name a mandatory AI officer. It does not copy the data protection model by creating one fixed title for every organisation. Instead, it places duties on providers and deployers, and it requires competence from the people who act for them.

The AI Act’s Article 4 requires providers and deployers to take measures to support the development of AI literacy among staff and other people responsible for AI operation and use on their behalf. That is the wording of Regulation (EU) 2026/1744, in force since 27 July 2026; the 2024 text required best efforts to ensure a sufficient level. The competence must take account of their technical knowledge, experience, education, the context of use and the people or groups affected by the system. More on this general staff duty is covered in Article 4 of the AI Act: what your staff must know about AI.

This is why the practical AI officer role exists. It is not a statutory title. It is a governance function. The organisation needs someone who can connect legal, technical and operational work.

A practical AI owner usually needs to be able to:

• identify whether the organisation is provider, deployer, importer or distributor;
• classify AI use as prohibited, high-risk, limited-risk or lower-risk under the AI Act structure;
• check whether the system is used according to the provider’s instructions;
• make sure human oversight is assigned to people with competence, training and authority;
• ensure employees and affected people receive required notices where the Act requires them;
• keep track of logs and monitoring duties for high-risk systems;
• recognise when data protection, procurement, human resources, communications or information security must be involved.

This role cannot be only technical. A model may work well in a test but still be unsuitable in a workplace process. It also cannot be only legal. The person must understand what the system actually does, what data goes in, what output comes out and who relies on it.

High-risk use changes the competence needed

High-risk AI is the point where responsibility becomes more concrete. The AI Act’s Article 6 sets the classification rules. A system can be high-risk because it is used as a safety component of a product covered by listed Union harmonisation law and the product needs third-party conformity assessment. In addition, systems in Annex III are treated as high-risk unless the specific exception in Article 6 applies.

Annex III includes areas that many organisations recognise from ordinary operations. These include biometric identification where allowed by law, safety components in critical infrastructure, education access and assessment, recruitment and employment decisions, access to essential public services and benefits, creditworthiness, certain insurance pricing, emergency call assessment and several law-enforcement uses.

For a municipality, the high-risk question may arise in public-service eligibility, benefit decisions, education or critical infrastructure. For a company, it may arise in recruitment, worker monitoring, work allocation, credit scoring or insurance contexts. The same type of tool can carry different risk depending on its intended use.

For deployers of high-risk systems, the AI Act’s Article 26 sets operational duties. These duties include appropriate technical and organisational measures to use the system according to instructions. They also include assigning human oversight to natural persons with the necessary competence, training and authority, and giving them the necessary support.

Article 26 also covers monitoring. The deployer must monitor the operation of the high-risk system on the basis of the instructions for use. If the deployer has reason to consider that use according to instructions may lead to a relevant risk under the Act, it must inform the provider or distributor and the relevant market surveillance authority without undue delay and suspend use. If the deployer identifies a serious incident, it must also report it first to the provider and then to the importer or distributor and the relevant market surveillance authorities.

Logs matter as evidence and for investigation. Article 26 requires deployers of high-risk systems to keep automatically generated logs that are under their control for a period appropriate to the intended purpose, and at least six months unless other applicable Union or national law, especially data protection law, provides otherwise.

If the deployer is an employer, Article 26 adds a workplace notice duty before putting a high-risk AI system into service or using it at work. Employee representatives and the workers concerned must be informed that they will be subject to the high-risk AI system.

Public authorities also have a specific high-risk duty in Article 26. Where they are deployers of high-risk systems, they must comply with registration duties referred to in the Act. If they intend to use a high-risk system that is not registered in the European Union database where required, they must not use it and must inform the provider or distributor.

Competence also covers bias, transparency and data protection

AI responsibility is not only a procurement checklist. It includes the risks created by data, outputs and human reliance on the system.

Bias means a pattern that can make outcomes unfair for some people or groups. A simple example is a recruitment tool that learns from past decisions and repeats an old pattern that disadvantaged a group of applicants. The AI Act’s Article 10 requires data governance practices for high-risk AI systems that use training, validation and testing data. Those practices must address possible biases that are likely to affect health and safety, negatively affect fundamental rights or lead to discrimination prohibited by Union law. They must also include appropriate measures to detect, prevent and mitigate such biases.

Human oversight is another competence area. The AI Act’s Article 14 requires high-risk AI systems to be designed and developed so that natural persons can effectively oversee them during use. Oversight is meant to prevent or minimise risks to health, safety or fundamental rights. In practice, the human reviewer must understand the system’s capabilities and limits, recognise over-reliance on the output, interpret the output correctly and be able to ignore, correct, reverse or stop the system where needed.

Transparency has two layers. For high-risk systems, the AI Act’s Article 13 requires instructions for use that give deployers relevant, accessible and understandable information. This includes the intended purpose, performance limits, accuracy and other information needed to interpret outputs and use them properly.

For some AI systems, Article 50 creates direct transparency duties toward people. If a system is intended to interact directly with natural persons, the provider must ensure that people are informed that they are interacting with an AI system unless this is obvious in the context. Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to the system. Deployers of systems that create or manipulate deepfake image, audio or video content must disclose that the content is artificially generated or manipulated. Public-interest text generated or manipulated by AI also has a disclosure duty unless the exception in Article 50 applies.

Data protection is a separate but connected boundary. The General Data Protection Regulation’s Article 22 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, where the decision has legal effects or similarly significant effects. The same article lists exceptions and requires safeguards in certain cases, including at least the right to obtain human intervention, express a view and contest the decision. Basic staff understanding of this boundary is covered further in What data protection skills must every employee have?.

The AI Act’s Article 26 also links high-risk AI to data protection impact assessment work. Where relevant, deployers must use the information supplied under Article 13 to comply with the duty to carry out a data protection impact assessment under the General Data Protection Regulation.

Where responsibility does not mean unlimited duty

AI responsibility has limits. This matters because exaggerated duties are hard to manage and hard to evidence.

First, the AI Act does not require every organisation to appoint a person with the title AI officer. The duty is to organise competence and responsibility around the organisation’s actual role and AI use. A named owner is often sensible, but the title itself is not the legal obligation.

Second, not every AI use is high-risk. The AI Act’s Article 6 and Annex III define high-risk categories. Some systems may be lower-risk. Some Annex III systems may fall outside high-risk classification if they do not pose a significant risk of harm to health, safety or fundamental rights and meet the conditions in Article 6. However, profiling of natural persons in an Annex III use case is always treated as high-risk under Article 6.

Third, a deployer is not automatically responsible for all provider duties. Provider duties under the AI Act include conformity work, technical documentation, quality management, CE marking where required and other obligations. A deployer has its own duties. The boundary can change, however, if the deployer makes the changes described in Article 25.

Fourth, human oversight does not mean that any employee may approve any AI output. For high-risk AI, Article 26 requires oversight by natural persons with the necessary competence, training and authority. Article 14 explains what effective oversight must enable. This is a real role, not a rubber stamp.

Fifth, transparency does not always mean the same notice in every case. Article 50 sets specific transparency duties for specific systems and contexts. Article 13 sets information duties for high-risk systems toward deployers. The correct notice depends on the system and the use.

The practical answer is therefore structured responsibility. The organisation needs a clear owner for AI governance, but the owner is not a substitute for management, procurement, information technology, human resources, communications, data protection and process owners. The owner coordinates the evidence. The organisation remains responsible for using AI in the role and risk category that the law assigns to it.