EU AI Act: obligations for companies

The EU AI Act in one paragraph

Regulation (EU) 2024/1689, known as the EU AI Act or AI Regulation, is the first comprehensive law on artificial intelligence. It entered into force on 1 August 2024 and applies directly in all Member States. The AI Act regulates AI systems according to their risk: certain practices are prohibited, high-risk systems are subject to strict requirements, transparency obligations apply to others, and most everyday AI applications remain largely unregulated. The obligations on AI literacy and – depending on the use – on transparency are relevant to almost all companies.

In July 2026, the AI Act was amended by Regulation (EU) 2026/1744, the so-called "Digital Omnibus on AI". The most important consequence: the obligations for high-risk systems apply later than originally planned. This guide summarises the situation following this amendment.

Timeline: what has applied since when?

• 1 August 2024: The AI Regulation enters into force.
• 2 February 2025: Prohibitions of certain AI practices (Art. 5) and the AI literacy obligation (Art. 4) apply.
• 2 August 2025: Obligations for providers of general-purpose AI models (GPAI), governance structures and penalty rules apply.
• 27 July 2026: The Digital Omnibus on AI enters into force (published in the Official Journal on 24 July 2026). The newly worded AI literacy obligation applies from this day.
• 29 July 2026: In Germany, the AI Market Surveillance and Innovation Promotion Act (KI-MIG) enters into force; the Bundesnetzagentur (Federal Network Agency) becomes the central market surveillance authority.
• 2 August 2026: Transparency obligations under Art. 50 and most of the remaining provisions apply.
• 2 December 2026: End of the transitional period for machine-readable marking of AI-generated content (Art. 50(2)) for systems placed on the market before 2 August 2026; new prohibition of AI systems for generating non-consensual intimate imagery.
• 2 August 2027: By this date at the latest, each Member State must operate at least one AI regulatory sandbox.
• 2 December 2027: Obligations for high-risk systems under Annex III apply (originally 2 August 2026).
• 2 August 2028: Obligations for high-risk AI in products under Annex I apply, for example in machinery or medical devices (originally 2 August 2027).

What role does your company have?

The AI Act links obligations to roles. Two are particularly relevant for mid-sized companies:

• Providers develop an AI system or have it developed and place it on the market or put it into service under their own name. Anyone who sells their own AI application to customers is a provider.
• Deployers use an AI system under their own authority. This is the normal case: a company uses an AI platform, a chat assistant or an AI module in its software.

There are also importers and distributors. Note: anyone who substantially modifies a high-risk system, changes its purpose or distributes it under their own name can themselves become a provider under Art. 25.

The four risk categories

Prohibited practices (Art. 5)

Prohibited are, among other things, AI systems that subliminally manipulate people or exploit vulnerabilities, social scoring, the untargeted scraping of facial images to build facial recognition databases, and emotion recognition in the workplace and in educational institutions (with narrow exceptions for medical or safety reasons). From 2 December 2026, the prohibition of systems for generating non-consensual intimate imagery is added. The prohibitions are rarely relevant to typical business applications, but everyone should be aware of emotion recognition in the workplace.

High-risk systems (Art. 6, Annexes I and III)

A system is high-risk either as a safety component of a regulated product (Annex I) or through its purpose in one of the areas listed in Annex III. Particularly relevant for companies:

• Employment and HR: AI for selecting job applicants, analysing applications, decisions on promotion or dismissal, allocating tasks based on personal traits or evaluating performance.
• Access to essential services: for example creditworthiness assessment of natural persons or risk assessment in life and health insurance.
• Education: admission, evaluation of learning outcomes, exam proctoring.
• Critical infrastructure, biometrics, law enforcement, migration, justice: not relevant for most mid-sized companies.

By way of exception, under Art. 6(3) a system listed in Annex III is not considered high-risk if it only performs a narrowly defined procedural task, merely improves or prepares a human activity and does not pose a significant risk. This assessment must be documented and the system registered.

Transparency obligations (Art. 50)

Labelling obligations apply to certain systems regardless of risk – details in the next section.

Minimal risk

Most applications – knowledge search, text creation, translation, summaries, spam filters – are not subject to any special obligations under the AI Act. The AI literacy obligation and the GDPR apply nonetheless.

Obligations that already apply

AI literacy (Art. 4)

Providers and deployers must take measures that promote the AI literacy of their staff and of other persons dealing with AI systems on their behalf. The Digital Omnibus on AI reworded the provision: instead of ensuring a "sufficient level" of literacy, it now requires measures that support the development of AI literacy – a particular level does not have to be guaranteed for each individual. The obligation applies regardless of company size and risk category.

In practice, the following has proven effective:

• training on how generative AI works, its limits and risks, such as hallucinations and data protection,
• a short AI policy with approved tools and rules for sensitive data,
• additional briefings for people who use AI results with far-reaching consequences,
• documentation of who was trained and when.

Transparency (Art. 50)

The transparency obligations have applied since 2 August 2026. They affect providers and deployers differently:

• Providers must design systems that interact directly with people (such as chatbots) so that users recognise they are talking to an AI – unless this is obvious. Synthetic audio, image, video and text content must be marked in a machine-readable way as AI-generated.
• Deployers of emotion recognition or biometric categorisation systems must inform the persons concerned.
• Deployers who generate or disseminate deepfakes must disclose that the content has been artificially generated or manipulated.
• Deployers who publish AI-generated text to inform the public on matters of public interest must disclose this – unless the text has been reviewed by a human and is subject to editorial responsibility.

For a company that uses a chat assistant on its own website, this means: visitors should clearly recognise that they are communicating with an AI.

Prohibitions

Check that no prohibited practice is in use – in particular no emotion recognition of employees.

Obligations for deployers of high-risk systems (from December 2027)

Anyone who uses a high-risk system under Annex III, such as AI-supported candidate selection, must under Art. 26, among other things:

1. use the system in accordance with the provider's instructions for use,
2. assign human oversight to competent, trained persons with sufficient authority,
3. ensure that input data, to the extent they control it, is relevant to the purpose and sufficiently representative,
4. monitor operation and inform the provider and authorities in the event of risks or serious incidents,
5. keep automatically generated logs for at least six months, to the extent they are under their control,
6. inform workers' representatives and affected employees before putting the system into service in the workplace,
7. inform affected persons when the system makes or supports decisions about them.

Certain deployers – public bodies and private entities providing public services, as well as deployers of systems for creditworthiness assessment and for risk assessment in life and health insurance – must additionally carry out a fundamental rights impact assessment (Art. 27). Providers of high-risk systems bear the more extensive obligations: risk management, data quality, technical documentation, quality management, conformity assessment, CE marking and registration.

Relief for SMEs and small mid-caps

The Digital Omnibus on AI extends relief for small and medium-sized enterprises and introduces the category of small mid-cap enterprises (small mid-caps). This includes simplified technical documentation, proportionate requirements for quality management, priority access to AI regulatory sandboxes and caps on fines adjusted to company size. This relief mainly concerns providers; for deployers, the obligations hardly change.

Supervision and penalties

In Germany, since the KI-MIG entered into force on 29 July 2026, the Bundesnetzagentur (Federal Network Agency) has been the central market surveillance authority, single point of contact and complaints body. In certain sectors, sector supervisors such as BaFin remain responsible. The Bundesnetzagentur also operates an AI service desk that supports SMEs in particular with classification.

The fines under Art. 99 are tiered: up to 35 million euros or 7 per cent of worldwide annual turnover for prohibited practices, up to 15 million euros or 3 per cent for breaches of other obligations and up to 7.5 million euros or 1 per cent for supplying incorrect information to authorities. For SMEs, the lower of the two amounts applies in each case.

Roadmap for your company

1. Inventory: List all AI systems – including AI functions in existing software such as HR, CRM or accounting systems.
2. Clarify your role: Are you a provider or a deployer? Do you offer customers your own AI functions?
3. Determine the risk category: For each purpose, check Art. 5, Annex III and Art. 50. Document the reasoning.
4. Implement AI literacy: Training, policy, documentation – this affects everyone.
5. Implement transparency: Label chatbots, review AI-generated publications.
6. Prepare for high-risk: If you use high-risk systems, use the time until December 2027 for oversight, logging and informing employees.
7. Dovetail with the GDPR: Much of the evidence overlaps with the data protection documentation. The guide GDPR-compliant AI helps with this.

How AIPE can contribute to implementation

AIPE is a platform for typical business applications such as knowledge search, text creation and automation, which by their purpose are usually not high-risk applications. However, the classification always depends on your specific use. AIPE supports implementation with a central, approved tool instead of scattered individual tools, with roles and permissions per organisation and resource, with answers that cite their sources, and with usage analyses by person and cost centre. Agents can work with approvals for risky actions so that people stay in control – more in the guide AI agents. For AI literacy training, the glossary and the guide AI for mid-sized companies provide a common language.