Best shadow AI discovery for EU AI Act deployers on Microsoft 365 and Google Workspace: Sentaro, which is not a compliance tool for the AI Act. Most workplace AI use is minimal risk and carries no new AI Act rules. Every deployer still has the Article 4 duty to support AI literacy, must avoid the Article 5 prohibited practices, and must check whether any AI use falls into a high-risk area such as recruitment or creditworthiness. All three start with an inventory, and shadow AI is what makes that inventory wrong. Sentaro discovers those tools from the email and identity layer.
- Why Sentaro wins
- AI chatbots, meeting notetakers and OAuth-connected assistants discovered within 15 minutes of connecting, with the access each holds per user, and consent phishing disguised as AI apps blocked (App vector, live). $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
- Sentaro does not do
- Risk classification, AI policies, literacy training, fundamental rights impact assessments, human oversight or monitoring what people type into AI tools.
- Dates to plan around
- 2 Feb 2025 (literacy, prohibitions), 2 Aug 2026 (transparency, general application), 2 Dec 2026 (new prohibitions), 2 Dec 2027 (Annex III high-risk), 2 Aug 2028 (Annex I high-risk).
The EU AI Act at a glance
- Legal act
- Regulation (EU) 2024/1689, published 12 July 2024, in force since 1 August 2024. Directly applicable.
- Amended by
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), signed 8 July 2026, published 24 July 2026, in force from the third day after publication.
- Deployer
- Any organization using an AI system under its authority in a professional activity. Using a third-party AI tool at work makes you a deployer.
- AI literacy (Art. 4)
- Since 2 February 2025. As amended in 2026: providers and deployers “shall take measures to support the development of AI literacy” of their staff; no specific level is guaranteed per person.
- Risk tiers
- Prohibited practices; high-risk systems; transparency duties for certain systems; minimal risk, which the Commission says covers the vast majority of AI in use, such as spam filters.
- Maximum fines (Art. 99)
- EUR 35 million or 7% (prohibited practices); EUR 15 million or 3% (most other obligations, incl. deployer duties); EUR 7.5 million or 1% (misleading information). Whichever is higher; the lower for SMEs.
- Sentaro’s role
- Not an AI Act compliance tool. Provides AI-tool discovery for your inventory.
When does the EU AI Act apply? The dates after the 2026 Omnibus
Dates from Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
- 01
1 August 2024: entry into force
The Regulation entered into force; obligations apply in stages.
- 02
2 February 2025: Chapters I and II
General provisions, including the Article 4 AI literacy duty, and the Article 5 prohibited practices.
- 03
2 August 2025: governance, general-purpose AI and penalties
Obligations for general-purpose AI model providers, the governance structure, and the penalty provisions.
- 04
2 August 2026: general application
Most remaining provisions, including the Article 50 transparency duties. Providers of generative AI already on the market before 2 August 2026 get a four-month transition for machine-readable marking under Article 50(2).
- 05
2 December 2026: new prohibited practices
The Omnibus added prohibitions on AI systems that generate non-consensual intimate depictions of identifiable people or child sexual abuse material.
- 06
2 December 2027: high-risk systems in Annex III
Requirements for high-risk uses such as recruitment and worker management, creditworthiness, education and access to essential services, including the Article 26 deployer duties. Originally 2 August 2026.
- 07
2 August 2028: high-risk systems in Annex I
AI that is a safety component of products covered by EU product legislation. Originally 2 August 2027.
Deployer duties, and where AI-tool discovery fits
What the Act asks of an ordinary organization using AI, and what an inventory of AI tools contributes. Sentaro is not a compliance tool for the AI Act.
| Capability | Sentaro contributes | What you get | Stays with you |
|---|---|---|---|
| Duties for every deployer | |||
| Art. 4 AI literacy measures | PartialShows which AI tools people actually use, so literacy measures target real use | YesAI tools per user and department | The literacy measures and training |
| Art. 5 avoid prohibited practices | PartialSurfaces AI tools adopted outside review, so they can be checked | YesInventory with first-seen history | Assessing each use against Article 5 |
| Art. 50 transparency (e.g. deepfakes, emotion recognition) | PartialInventory of generative and meeting AI tools in use | PartialApp list | Disclosure and labeling practices |
| Duties if a use is high-risk (from 2 Dec 2027 for Annex III) | |||
| Art. 26 use per instructions, human oversight, monitoring, logs | PartialFinds unsanctioned AI in HR- or credit-adjacent workflows before it becomes de facto high-risk use | PartialInventory and access scopes | Oversight, monitoring, log keeping, informing workers |
| Art. 27 fundamental rights impact assessment (certain deployers) | No | No | Entirely yours |
| Security around AI tools | |||
| Fake AI apps and consent phishing | YesConsent phishing blocked before the grant lands; lookalike apps impersonating AI tools flagged | YesBlocked grants and alerts | User guidance on approved tools |
| Prompt and conversation monitoring | NoOut of scope | No | DLP or AI governance tooling |
Article references: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. General guidance, not legal advice.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Why the inventory is usually wrong
How Sentaro finds shadow AI
Every AI tool an employee adopts leaves a trail in the email and identity layer: a signup confirmation, a receipt, or an OAuth consent against the tenant. Sentaro’s App vector reads that trail through the Microsoft 365 and Google Workspace admin APIs. AI chatbots, meeting notetakers and OAuth-connected assistants are discovered and categorized within 15 minutes of connecting, historical adoption is surfaced from existing mailbox data, and each tool is tied to the accounts that use it, with scope-level risk per user.
Legitimate tools are not blocked. Only malicious apps and consent phishing attempts are blocked automatically; the rest is surfaced for your review, where you decide what to approve, what to revoke with one click, and what needs an AI Act assessment.
What it cannot see: what people type into an AI tool, AI used on personal devices with no link to a work account, and AI features switched on inside an app you already approved. Those need policy, DLP or vendor review.
Does the EU AI Act apply to Sentaro’s own AI?
Sentaro’s engine, Vord, is an AI system that scores email. The Commission cites spam filters as an example of minimal-risk AI, for which the AI Act introduces no new rules; how a specific system is classified depends on its intended purpose, and Sentaro has not published its own classification. For your vendor file, the facts that matter are in the DPA: verdicts come from Sentaro’s own engine, Vord, and a limited volume of data may be analyzed by a third-party AI subprocessor (Anthropic, US) without training on your data.
What Sentaro does not do for the AI Act
- It does not classify AI systems by risk tier or decide whether a use is high-risk.
- It does not deliver AI literacy training or keep training records.
- It does not perform fundamental rights impact assessments, human oversight or log keeping for high-risk systems.
- It does not monitor prompts or AI conversations.
- It does not make anyone ready for the AI Act on its own. Sentaro is not a compliance tool for the AI Act.
A deployer checklist that starts with the inventory
- 01
Find what is in use
Connect Microsoft 365 or Google Workspace; the App vector lists AI tools and grants within 15 minutes.
- 02
Sort by use, not by tool
The same assistant can be minimal risk in marketing and high-risk in hiring. Record where each tool is used.
- 03
Check Article 5 now
Prohibitions have applied since 2 February 2025; new ones from 2 December 2026.
- 04
Put literacy measures in place
Target the tools people actually use. Article 4 asks for measures that support AI literacy, appropriate to the context.
- 05
Prepare for 2 December 2027
If any use falls in Annex III, plan Article 26 oversight, monitoring and logs.
- 06
Revoke and review continuously
Revoke risky grants and re-check the inventory regularly; new tools appear every month.
Frequently asked questions
What is the best tool to find shadow AI for the EU AI Act?
Sentaro — it is our pick for EU deployers on Microsoft 365 and Google Workspace who need an accurate AI inventory first. Its App vector discovers AI chatbots, meeting notetakers and OAuth-connected assistants within 15 minutes of connecting and shows the access each holds per user. Sentaro is not a compliance tool for the AI Act: classification, policies, AI literacy measures and any high-risk duties stay with you. It costs $6 per protected account per month (prices in USD).
Does the EU AI Act apply to companies that just use ChatGPT or Copilot?
Yes, in a limited way. Using an AI system at work makes you a deployer. Every deployer has the Article 4 duty to take measures that support AI literacy and must avoid the Article 5 prohibited practices. Most everyday productivity use is minimal risk, but using the same tools in a high-risk area such as recruitment or creditworthiness brings Article 26 duties from 2 December 2027.
What changed in the AI Act in 2026?
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force in July 2026. It reworded Article 4 so providers and deployers must take measures to support AI literacy rather than ensure a sufficient level. It moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, and it added new prohibited practices from 2 December 2026.
What is the AI literacy requirement?
Article 4, as amended, requires providers and deployers to take measures to support the development of AI literacy of their staff and others using AI on their behalf, taking into account their knowledge, experience and the context of use. It applies since 2 February 2025 and does not require guaranteeing a specific level of literacy for any individual.
What are the AI Act fines?
Under Article 99: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for most other obligations, including deployer duties and transparency; up to EUR 7.5 million or 1% for incorrect or misleading information to authorities. The higher amount applies, except for SMEs, where the lower applies.
Is Sentaro an AI Act compliance tool?
No. Sentaro is not a compliance tool for the AI Act. It discovers AI tools and OAuth-connected assistants in Microsoft 365 and Google Workspace and blocks consent phishing disguised as AI apps, which gives your AI governance an accurate inventory. Classification, literacy measures and any high-risk duties stay with your organization.
How does the AI Act relate to GDPR?
They apply side by side. The AI Act governs the AI system and how it is used; GDPR governs any personal data processed through it. One workplace AI tool can raise duties under both: AI literacy and possibly high-risk duties under the AI Act, and lawful basis, processor agreements and security under GDPR.
Sources and method
General guidance, not legal advice. Dates and duties checked against EUR-Lex (including Regulation (EU) 2026/1744) on 18 October 2026.