The AI Act for associations

Are we a provider or a deployer?

The Act splits everyone who touches an AI system into two roles, and the split decides which duties you have.

You are a deployer if you use an AI system in the course of your work. That is most associations: a staff member pasting a document into a chat window is deploying an AI system. Deployer duties are lighter than provider duties, and most of them only bite when the system is high-risk.

You are a provider if you put an AI system on the market or into service under your own name. An association becomes a provider without noticing when it white-labels something — a "member assistant" badged as the association, built by a vendor, presented as yours. The moment your name is on it and you take responsibility for how it behaves, you have moved role and picked up obligations that belong to a manufacturer.

If you are unsure which you are, that uncertainty is the first thing to resolve. It changes everything downstream, and it is a legal question rather than a technical one — your own counsel should confirm the classification, not a supplier with an interest in the answer.

The four things that reach a membership body

AI literacy (Article 4). In force since 2 February 2025 and the cheapest obligation in the Act. If your staff use AI at work, they must have sufficient literacy for the job they do, and you must be able to show it. There is no prescribed course and no certificate that satisfies it by itself. What a board will ask for is a record: who was trained, on what, when, and what changed in how they work afterwards.

Deployer duties for high-risk systems (Article 26). These apply only if you use an AI system listed as high-risk — the Annex III uses. For an association the ones worth checking are the people-facing ones: recruitment and candidate assessment, creditworthiness checks, education and vocational assessment, and anything used to evaluate a person. A body running accreditation, examinations or a member credit facility should look closely. A body using AI to draft a newsletter does not.

Transparency. If a member is interacting with an AI rather than a person, they should be able to know it. If you publish AI-generated material, say so where it matters. None of that requires a policy document; it requires a decision about what you tell people.

Governance. There is no single article called "governance", which is why it gets skipped. But every duty above is evidenced by a named owner, a written policy and a record. An association that cannot say who is responsible for AI in the building has not discharged anything, however well the individual staff behave.

The dates, and what the deferral did and did not change

1 August 2024 — Regulation (EU) 2024/1689 entered into force.

2 February 2025 — the prohibited practices in Article 5 began to apply, and so did Article 4 on AI literacy. The literacy duty has been live for well over a year.

2 August 2025 — the general-purpose AI obligations in Chapter V began to apply to the model providers.

27 July 2026 — Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force. It moved the high-risk timetable: Annex III to 2 December 2027, Annex I to 2 August 2028.

Read that last line carefully, because it is where most organisations lost the thread. The Omnibus deferred a deadline. It did not repeal a duty, and it did not touch Article 4 — which is the one that already applies to you.

The evidence a board will ask for

Not a policy. Evidence. In practice, five items:

One — a list of every AI system in use, including the free ones staff signed up to themselves.

Two — who owns each of them, by name.

Three — a literacy record: who was trained, on what, when.

Four — a written policy that says what staff may and may not put into an AI tool.

Five — where member data goes when it is used, stated plainly enough that a trustee can understand it.

An association that can produce those five things on request is, in practice, in better shape than most of the sector. Producing them is a few days of work, not a programme.

Where member data actually goes

The AI Act does not require you to keep data in your building. That is a different question, and it is the one members ask.

When a staff member pastes a member list, a complaint or a case file into a public AI tool, that text leaves the building. Whether it is retained, used for training, or read by a human reviewer depends on the provider’s terms — not on your intentions, and not on the contract you think you have. Your GDPR obligations and your members’ expectations apply to that transfer regardless of what the AI Act says about it.

The practical answer is not "ban AI". It is to decide, in advance, which material may go to a rented service and which may not — and then to have somewhere the second category can go. That is what a machine in your own office is for: not sovereignty as a slogan, but a place to put the work that cannot leave.