AI compliance lawyer in Spain

Yes, though with far lighter duties than those of whoever develops the system. As a deployer, your job is mainly to know which tools you use, with what data and who reviews the output, and to take measures so the team understands the AI it handles: Article 4, as recast in July 2026, is an obligation of means, not one of certifying a given level per person. That is solved with an internal use policy and a couple of sessions, not a months-long project.

A provider is whoever develops the system or places it on the market under their own brand. A deployer — the term the Regulation itself uses, in Article 3(4) — is whoever uses it under their own authority in the course of their activity. The provider carries the technical documentation and the conformity assessment; the deployer carries human oversight, the input data and control over what the system does. Many startups are both at once without realising it, and that is exactly where it pays to look closely.

An initial assessment — tool inventory, risk classification and a list of duties — usually takes a couple of weeks. From there you decide what you implement yourself and what you would rather I draft.

You answer it with documentation, not improvisation. The sooner you have the system register, the internal policy and documented training, the better your position: prior diligence is one of the criteria weighed when setting a penalty, alongside the gravity of the infringement, its duration and the size of the company (Article 99).