> AI compliance for software companies: clarify your EU AI Act role, inventory AI systems, meet transparency duties and build an AI management system.

Source: [https://docxpert.io/en/use-cases/ai-software-providers](https://docxpert.io/en/use-cases/ai-software-providers)

# AI compliance for software companies: AI Act | docxpert

## Role first, then obligations

The EU AI Act assigns obligations by role. Software companies are often both: deployers of AI tools in-house and providers of AI features in their own product. If you build a third-party language model into your product and offer it under your own name, you are usually the provider of that AI system.

Simplified overview; the text of the regulation prevails.
| Role | Typical case in a software company | Focus of obligations |
| --- | --- | --- |
| Provider | AI feature in your own product, such as an assistant, a recommendation or an automated assessment | Risk classification, transparency, for high-risk extensive technical documentation and conformity assessment |
| Deployer | Internal use of AI, for example in support, development or recruiting | AI literacy, use as intended, for high-risk human oversight and logs |
| Provider of a general-purpose AI model | Own foundation model made available to others | Specific obligations since 2 August 2025 |

Not legal advice

Classifying role and risk class depends on the specific purpose. docxpert helps document this in a structured way but does not replace a legal assessment.

## What applies when

-   **Since 2 February 2025:** prohibitions of certain practices and the AI literacy obligation for staff.
-   **Since 2 August 2025:** obligations for providers of general-purpose AI models.
-   **Since 2 August 2026:** transparency obligations, such as informing users that they are interacting with an AI system.
-   **From 2 December 2027:** high-risk systems under Annex III, such as AI for recruitment or creditworthiness. The date was postponed by the Digital Omnibus on AI.
-   **From 2 August 2028:** high-risk AI as a safety component of products under Annex I.

For software with digital elements, the Cyber Resilience Act adds obligations; its reporting duties for actively exploited vulnerabilities apply before the remaining obligations. Details on the inventory are in the guide [EU AI Act obligations for companies](https://docxpert.io/en/guides/eu-ai-act-ai-inventory).

## What customers ask

Customers check before authorities do. Procurement and data protection officers send questionnaires on AI use. Typical questions:

-   Which AI features does the product contain, and can they be switched off?
-   Which models and providers do you use, and is customer data used for training?
-   How do you classify the features under the EU AI Act, and how do you justify that?
-   How do you ensure human control for decisions that affect people?
-   How are errors, bias and incidents detected and handled?
-   Do you run an AI management system or plan ISO/IEC 42001 certification?

If you derive these answers from a maintained register and approved policies, you answer faster and consistently. Certification to [ISO 42001](https://docxpert.io/en/standards/iso-42001) can build additional trust but is not a requirement of the AI Act.

## A practical example

An HR software vendor adds an AI feature to its applicant tracking that ranks CVs by fit for the role. The feature very likely falls under the high-risk use cases in Annex III. From 2 December 2027, the vendor needs risk management, technical documentation, logging, rules for human oversight and a conformity assessment.

That sounds far off but already shapes product development today: data, logs and explainability are hard to retrofit. So the company records the feature in the register now, sets the risk class with a justification, starts the technical documentation from the template and answers customer questions by referring to this status.

## How docxpert supports software companies

AI registerIn the [AI register](https://docxpert.io/en/features/ai-register) you record every system with purpose, role, risk class and operating status and see open mandatory requirements per system.

Three frameworks, one baseRequirements from the EU AI Act, ISO/IEC 42001 and the Cyber Resilience Act are available as catalogues and can be linked to the same documents.

TemplatesAI inventory and risk classification, risk and impact assessment, Statement of Applicability, lifecycle with human oversight, technical documentation for high-risk AI and secure development under the CRA.

Evidence AI literacyPlan, assign and evidence AI literacy training under Article 4 with quizzes and attendance in [training management](https://docxpert.io/en/features/training-certification).

Human approvalsAI policies and technical documentation go through review and approval; every step is traceable in the audit trail.

Vulnerabilities and incidentsTrack reports under the Cyber Resilience Act and security incidents with deadlines in [incident management](https://docxpert.io/en/features/nis2-incident-reporting).

## Getting started in four weeks

1.  1
    
    Week 1: inventory
    
    Record all AI features in the product and all AI tools used internally in the register, including purchased software with AI features.
    
2.  2
    
    Week 2: role and risk class
    
    Determine and justify role and risk class per system. Clarify borderline cases with legal.
    
3.  3
    
    Week 3: policies
    
    Create, review and approve an AI policy, transparency notices and rules for human oversight from templates.
    
4.  4
    
    Week 4: literacy and customer evidence
    
    Roll out AI literacy training and derive a standard answer for customer questionnaires from the approved documents.
    

## Frequently asked questions

Am I a provider if I build a third-party language model into my product?

For the AI system you offer under your own name, usually yes. The obligations for the underlying model lie with its provider. Check the individual case legally.

Do I need ISO 42001 certification for the AI Act?

No. The AI Act does not require ISO/IEC 42001 certification. An AI management system does help implement obligations in a structured way and provide evidence to customers.

When do the high-risk obligations apply?

Following the Digital Omnibus on AI, they apply to Annex III systems from 2 December 2027 and to safety components under Annex I from 2 August 2028.

Can docxpert determine the risk class automatically?

No. You determine and justify the risk class yourself. docxpert records the decision and shows the resulting requirements.

## Read next

[AI registerRecord every AI system with role, risk class and requirements – the basis for the EU AI Act and ISO 42001.Learn more](https://docxpert.io/en/features/ai-register) [EU AI Act obligationsRoles, risk classes, AI literacy and the AI inventory – what companies should do now.Learn more](https://docxpert.io/en/guides/eu-ai-act-ai-inventory) [ISO 42001AI management system with AI register, impact assessment, policies and competence records.Learn more](https://docxpert.io/en/standards/iso-42001) [EU AI Act checklistCheck AI inventory, roles, risk classes, prohibited practices and AI literacy.Learn more](https://docxpert.io/en/checklists/eu-ai-act) [Training managementOnline and classroom training, training matrix, reminders, records and effectiveness checks.Learn more](https://docxpert.io/en/features/training-certification)

## Try docxpert free for 14 days

Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards.

[Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)