The EU AI Act Applies to You — Even If You Don’t Build AI | Antonina Burlachenko (STAR)

Most companies are certain the EU AI Act is somebody else’s problem. They are wrong — and the vendor contract they are relying on will not save them.On 2 August 2026 the EU AI Act becomes enforceable across Europe, and a few weeks out, Brussels moved the headline deadline to 2027 and 2028. The whole market exhaled. In this episode, Amer Altaf sits down with Antonina Burlachenko, Head of Regulatory Consulting at STAR — who audits and certifies these systems for a living — to explain why that exhale is the trap.If your company runs an AI hiring tool, scores customers, automates a decision, or has wired AI into its operations, you may already be in scope — not as the AI lab, but as a deployer, and sometimes, without ever realising it, as a provider. We get into the deployer‑versus‑provider line that catches almost everyone, the Article 25 clause that quietly turns a buyer into a manufacturer regardless of what the contract says, what is still legally binding on 2 August 2026, and why the documentation you need cannot be faked at the audit. It ends, as every episode does, with a falsifiable prediction we write down and come back to.In this episodeWhy the EU AI Act binds ordinary companies that do not think of themselves as “AI companies”The three ways you can become a “provider” without knowing it — and why your indemnity clause does not stop itWhat actually counts as “high‑risk” AI under Annex IIIWhy a US company with no European office can still be caughtWhat the moved deadline did — and did not — change, and what stays live on 2 August 2026The evidence you have to capture from week one, because you cannot reconstruct it laterISO 42001: real protection, or a badge for the website?Antonina’s prediction for the first real enforcement actionTimestamps00:00  The EU AI Act trap hiding in "we don't build AI"00:55  Why this law applies to you03:09  Who Antonina is and why she'd know05:28  The one thing that makes the room go quiet07:11  How a buyer becomes the "manufacturer" (Article 25)09:37  What actually counts as "high-risk" AI11:26  No EU office? You're still in scope13:42  Provider or deployer: where the line sits14:55  "I just bought Copilot — am I a provider?"17:22  What a deployer must do every single week19:46  The vendor contract that's worth nothing23:33  What Brussels actually changed — and what it didn't25:58  Reprieve, or a longer run-up to the same wall?27:47  What's still binding on 2 August 2026?30:05  Start now, wait — and did the EU get it right?37:01  Why you can't fake the evidence at the audit40:47  Three things to write down from week one43:50  ISO 42001: real armour or website badge?47:16  Chicago to Germany — caught anyway49:10  One company, three rulebooks51:04  What calm companies have that the panicking don't53:15  Her prediction: the first enforcement action54:42  Time machine: what she'd tell her 2024 selfThree lines worth the click“For all three cases, the contract is not important. The responsibility lies with whoever is the provider.” — on why your vendor indemnity does not transfer the risk.“How do you document control of that bias after the fact? I have no idea.” — on why AI compliance evidence has to be captured as you go.“You don’t have a choice.” — on why the Act reaches you wherever you are headquartered.About the guestAntonina Burlachenko is Head of Regulatory Consulting at STAR, where she leads a team taking regulated products to market and building the quality, information‑security and AI‑management systems underneath them — across medical‑device regulation, the Cyber Resilience Act, GDPR and the EU AI Act. Her work spans advisory, internal audits and the due‑diligence assessments investors commission before they invest. Connect with Antonina on LinkedIn.Read, watch, and go deeperRead the companion essay: The EU AI Act Already Applies to You — the full written analysis, with sources → [link]Watch on YouTube: [video link]Listen: [Apple Podcasts] · [Spotify]Sources: EU AI Act, Article 25 · Annex III high‑risk uses · Gibson Dunn — the Digital Omnibus deferral (May 2026) · European Commission — AI regulatory framework · ISO/IEC 42001The Control Layer publishes weekly — decision‑grade analysis on AI, cybersecurity, and technology sovereignty, written for the board paper, not the timeline. Every episode ends with a prediction we write down and call in writing. Subscribe free, and you will be here when we find out whether Antonina was right.[Subscribe free]The Control Layer is written and hosted by Amer Altaf, Founder & CEO of Arkava and Managing Editor of The Control Layer.#EUAIAct #AIgovernance #AIcompliance #ISO42001 Get full access to The Control Layer at thecontrollayer.arkava.ai/subscribe