Your business could be using high-risk AI without realizing it.
Cyprus businesses preparing for EU AI Act compliance in 2027 should identify their AI systems, check which ones may be high-risk, and review the applicable legal responsibilities. December 2, 2027, is the key deadline for certain high-risk systems covered by Annex III of the EU AI Act.
Picture a company in Limassol using AI to shortlist job applicants. The software saves hours of work, but its role in hiring decisions may also bring legal obligations.
The question isn’t just whether your business uses AI. It’s what that AI is helping you decide. Understanding that difference now can make compliance preparation much easier.
The EU AI Act doesn’t treat every AI system the same way. Some requirements already apply, and different high-risk categories have different deadlines.
Requirements affect certain high-risk AI systems, particularly those used for sensitive decisions about employment, education, and access to essential services. Affected companies may need to document their systems, ensure human oversight, monitor performance, and establish internal procedures to manage risks. The obligations depend on whether the business provides an AI system or uses one supplied by another company.
A marketing agency using AI to draft social media captions won’t usually face the same requirements as a recruitment company using AI to evaluate job applicants. That’s why identifying the system’s purpose comes first.
Relevant Annex III requirements apply from December 2, 2027, while certain high-risk AI systems embedded in regulated products have until August 2, 2028. Your deadline depends on the system’s legal classification, not simply on whether your business uses AI.
The EU AI Act can apply to startups, small businesses, established companies, and international organizations. Business size alone doesn’t determine whether the high-risk rules apply. What matters is the AI system’s intended purpose and your company’s role.
Here are a few everyday business examples.
These examples aren’t final legal classifications. Some Annex III systems may qualify for exceptions, depending on their purpose and whether they materially influence decisions. Before deciding, assess how the system actually works and what it is intended to do.
Start by understanding the AI tools already used across your business. You don’t need to replace every system or create complicated policies before knowing which obligations apply. These six steps can help you organize the work.
List the AI tools used by each department: HR may use recruitment software, customer service an AI chatbot, finance AI-supported fraud detection. A simple spreadsheet or internal register is enough to start, so you don’t discover an important system only when a compliance question arises.
Review each system against the Act’s high-risk categories. Annex III includes certain uses in employment, education, critical infrastructure, and access to essential services. A tool that schedules interviews may not raise the same concerns as one that assesses a candidate’s suitability. Keep records of your classification decisions.
A provider generally develops or supplies an AI system under its own name or trademark; a deployer uses one under its authority. A Cyprus company selling high-risk recruitment software may have provider responsibilities, while a recruitment agency using it may have deployer responsibilities. Modifications or changes in intended purpose can also affect your role.
Check what the supplier provides and what your contract covers: instructions, technical information, compliance documentation, and how updates, incidents, and assistance requests are handled. A vendor’s compliance doesn’t automatically mean you’ve met your own obligations for operating, monitoring, and overseeing the system.
For covered high-risk systems, you may need procedures for human oversight, monitoring, and recordkeeping. If an AI tool recommends rejecting a job applicant, the employee responsible should understand the system’s limitations and know when further review is needed. Compliance requires procedures employees can actually follow, not just a policy document.
Employees should understand the tools they use, who provides oversight, how to report problems, and where records are kept. Before the deadline, check that your required controls demonstrably work. Some AI Act obligations already apply, so don’t leave awareness until the end of 2027.
Under Article 26 of the AI Act, deployers of high-risk systems must generally retain automatically generated logs under their control for at least six months, unless applicable law provides otherwise.
Use this schedule to organize your initial review. These are suggested planning periods, not statutory deadlines.
Expected result: an AI inventory.
Expected result: a compliance gap assessment.
Expected result: an initial compliance action plan.
Expected result: documented readiness.
Complex AI systems may take longer, especially if they require technical assessments, supplier cooperation, or formal compliance procedures.
The requirements differ depending on whether the company provides a high-risk AI system or uses one. Both roles carry responsibilities, but they aren’t interchangeable.
Deployers generally need to follow the provider’s instructions and ensure appropriate human oversight. Depending on the circumstances, they may also need to monitor the system, maintain relevant logs, and act when problems are identified. Certain uses trigger additional duties: employers using covered high-risk systems in the workplace must meet applicable duties to inform affected workers and their representatives.
Providers generally have broader responsibilities for ensuring covered systems meet the legal requirements before being placed on the market or put into service. These can include risk management, data governance, technical documentation, conformity assessment, and post-market monitoring.
The EU AI Act has been introduced in stages. Several provisions already apply, while certain high-risk requirements have later application dates under the 2026 Digital Omnibus amendments.
Two dates are particularly important for businesses preparing for high-risk AI compliance:
Relevant high-risk systems covered by Annex III, including certain uses in recruitment, education, and other sensitive areas.
Certain high-risk systems associated with regulated products covered by Annex I.
Existing AI systems may qualify for transitional treatment, depending on when the system was placed on the market or put into service and whether significant design changes occur. For the official schedule, see the European Commission’s EU AI Act implementation timeline.
Some existing systems benefit from transitional rules. Whether compliance is required depends on the system’s circumstances, relevant application date, and any significant changes.
Relevant obligations can apply regardless of business size, although certain simplified requirements and support measures exist. The system and the company’s legal role determine what applies.
Not entirely. Vendors may have provider obligations, but businesses using covered systems must still meet their own applicable deployer responsibilities.
The December 2027 deadline gives affected Cyprus businesses time to prepare, but it’s easier to address compliance gaps when you understand them early.
Start by identifying your AI systems, checking their risk classifications, and reviewing the responsibilities that apply to your company. That way, your team can focus on practical measures rather than unnecessary paperwork.
For businesses reviewing their wider governance arrangements, NAKLAW provides corporate legal services. Contact NAKLAW to discuss your circumstances and confirm the appropriate scope of legal assistance.
Still wondering whether your business is ready? Start with one question: do you know which AI tools your team uses and what decisions those tools help make?