EU AI Act Readiness for Corporate Legal: Classifying Your eDiscovery Workflows – PART TWO

EU AI Act Readiness for Corporate Legal: Classifying Your eDiscovery Workflows – PART TWO

In my last post, we examined the EU AI Act’s risk-based framework and the importance of classifying eDiscovery technologies appropriately. But risk classification only answers one part of the compliance question. Two organizations can use the exact same AI tool and face very different obligations under the Act.

The reason is because the EU AI Act regulates not only the technology itself, but also the role an organization plays in relation to that technology. Whether you are a provider or a deployer can significantly alter your responsibilities. For legal departments and organizations increasingly experimenting with customization, integrations, and generative AI workflows, understanding that distinction is becoming just as important as understanding the technology itself.

The Act assigns duties by role and getting the role right for each tool is what turns a classification exercise into an actual compliance plan. A provider develops an AI system (or has one developed for them) and places it on the EU market or puts it into service under its own name or trademark. Providers carry the heaviest regulatory load. A deployer uses an AI system under its own authority in a professional capacity. If your team licenses a review platform and uses it as intended, you are almost always a deployer. Deployer duties are lighter but still must use the system according to the provider’s instructions, assign competent people to exercise human oversight, retain the logs the system generates, monitor malfunctions and report serious incidents, and inform affected workers before putting a high-risk system into use.

The trap that catches legal departments is Article 25. A deployer can become a provider, inheriting the full provider obligation set, by putting its own name or trademark on a high-risk system, making a substantial modification to it, or repurposing it in a way that makes it high-risk. Fine-tuning a model on your own data or pushing a system beyond its documented intended use can also flip your role. Before customizing, access what you are taking on.

Practical Tips for the In-House Team:

1. Map each tool to a role and write down the rationale. Off-the-shelf tool used as intended → deployer; a system you build, brand, or substantially modify → potentially becomes a provider.
2. Pull the documentation you need from your providers. Instructions for use, human-oversight information, and logging capability are things you rely on to meet your own deployer duties.
3. Route any customization through counsel first. The fastest way to acquire provider obligations by accident is to fine-tune or repurpose a tool without checking whether it changes your role.
4. Classify AI tools broadly but stay proportionate. Cast a wide net at the inventory stage and don’t treat every tool as high-risk. The Act is risk-based by design, and most established eDiscovery workflows are built around meaningful attorney oversight. For example, if you use the Act’s definition of AI, Continuous Active Learning (“CAL”) would fall in the scope of AI tools. CAL runs on continuous human review, sampling, and validation, and search term targeted automated redactions are checked before production. Workflows like these will typically land at the minimal risk tier because a human stays in the loop. The obligations concentrate where oversight thins out; for example generative AI first-pass review that produces work product without meaningful human second pass review prior to production.

The goal is not to relabel your entire toolset as AI and take on obligations the Act never intended. It is to look carefully, document what you find, and apply the tier that actually fits. The exercise usually confirms that traditional review workflows sit outside of the Act or comfortably at the lower tiers and directs your attention to the generative tools that warrant a closer look.

This is the same risk-proportionate lens ProSearch applies to its own AI governance program, and it is where we can help. We can work with your team to inventory your eDiscovery workflows, assign provider and deployer roles, and build the documented, defensible classification the Act expects, without stretching your definition of AI further than the risk actually requires.

A starting checklist:

• If your AI-enabled tools are marketed in the EU, used by an EU presence, or applied to EU data, a documented classification process is the practical first move:
  • Inventory your AI-enabled eDiscovery tools, including the machine-learning tools you may not think of as AI.
  • Map each tool to a provider or deployer role and note where a customization could shift that role.
  • Classify each tool by risk tier, with a documented rationale. Documentation is itself an expectation under the Act, so building the record now saves time later.
  • Confirm the transparency and disclosure obligations for your role, even for limited-risk tools.
  • Re-run the cycle annually. Systems evolve quickly, and generative features are being added to eDiscovery platforms faster than ever.

AI is making legal work faster and is already compressing eDiscovery timelines and costs. The teams that navigate the EU AI Act most smoothly will be the ones that treat classification as routine governance. The EU has taken the lead on comprehensive, cross-border AI regulation, and it will be worth watching what comes next.