www.simplify-data.de
The EU AI Act is the first comprehensive set of rules for artificial intelligence in the EU. It affects not only software vendors but also companies that use AI tools day to day, such as chatbots, text generators or recruitment software with AI features. This article gives you an overview of risk categories, obligations and deadlines (as of November 2026).
Please note: this article is general information, not legal advice. For an assessment of your specific situation, consult a qualified lawyer.
What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and, as an EU regulation, applies directly in every member state. Its obligations are phased in over several years rather than all at once.
In July 2026 the regulation was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The Omnibus is part of a simplification package from the European Commission and mainly pushes back the deadlines for high-risk AI.
Provider or deployer: what is your role?
The AI Act distinguishes between several roles. Two of them matter for most small and mid-sized businesses:
- Provider: an organisation that develops an AI system, or has one developed, and places it on the market under its own name. This includes offering a self-built AI tool to your customers.
- Deployer: an organisation that uses an AI system under its own authority in a professional context. A company running an AI chatbot on its website or letting staff work with an AI assistant is usually a deployer.
Providers carry far more obligations. Deployers have their own duties too, particularly for high-risk systems and transparency.
The four risk categories
The AI Act classifies AI systems by risk. The higher the risk, the stricter the rules.
| Risk category | Examples | Consequence |
|---|---|---|
| Unacceptable risk | Social scoring, emotion recognition in workplaces and schools, untargeted scraping of facial images for databases | Prohibited |
| High risk | AI in recruitment, credit scoring, exam grading, AI as a safety component of regulated products | Strict requirements |
| Transparency risk | Chatbots, AI-generated images, audio and video, deepfakes | Disclosure and labelling duties |
| Minimal risk | Spam filters, AI in video games, most everyday applications | No specific obligations |
According to the European Commission, most AI systems in use today fall into the minimal-risk category. For many SMEs, AI literacy and transparency duties are therefore the main concerns.
Key dates
The table below reflects the changes made by the Digital Omnibus (as of November 2026):
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices and the AI literacy duty (Art. 4) |
| 2 August 2025 | Rules for general-purpose AI (GPAI) models and governance |
| 2 August 2026 | Transparency obligations (Art. 50), start of enforcement |
| 2 December 2026 | New ban on AI generating non-consensual intimate content and child sexual abuse material; grace period ends for content marking by systems placed on the market before August 2026 |
| 2 December 2027 | High-risk obligations for Annex III use cases (e.g. employment, education, creditworthiness) |
| 2 August 2028 | High-risk obligations for AI in regulated products under Annex I (e.g. machinery, medical devices) |
Originally, the Annex III high-risk obligations were due to apply from August 2026. The delay buys time, but the substantive requirements remain the same.
AI literacy under Article 4
Since February 2025, providers and deployers must take measures so that their staff can handle AI competently. This applies to every company that uses AI systems professionally, regardless of the risk category.
The Digital Omnibus softened the wording: companies must take measures to support their employees' AI literacy, but they are not required to guarantee a specific level of competence for each individual. The Commission is to publish practical examples.
In practice, this can include:
- training on how the tools you use work, where their limits are and which errors are typical
- internal rules on which data may be entered into AI tools
- a documented record of who has received which training
Prohibited practices
Certain AI applications have been banned since February 2025. They include manipulative techniques that push people into harmful decisions, social scoring, emotion recognition in the workplace (with narrow exceptions for medical or safety reasons) and untargeted scraping of facial images from the internet. From December 2026, the Digital Omnibus adds a ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material.
For most businesses these bans are not an everyday issue. Still, check tools used in HR, such as software that claims to analyse emotions in video interviews.
Transparency obligations
The transparency obligations in Article 50 have applied since August 2026. For deployers this mainly means:
- People must be able to tell that they are interacting with an AI system, for example a chatbot, unless this is obvious anyway.
- Deepfakes, meaning AI-generated or manipulated images, video or audio that appear authentic, must be disclosed as such.
- AI-generated text published to inform the public on matters of public interest must be labelled, unless it has undergone human editorial review and someone holds editorial responsibility.
Providers of generative AI must also ensure that generated content is marked in a machine-readable way as AI-generated.
High-risk AI: what applies from December 2027
If you use AI for hiring decisions, credit decisions or other areas listed in Annex III, more extensive obligations apply. Providers must, among other things, demonstrate risk management, technical documentation, logging and a conformity assessment.
Deployers must use the system in line with its instructions, ensure human oversight by trained people, keep logs and inform affected employees. The Omnibus includes relief for SMEs, such as simplified technical documentation for providers.
General-purpose AI models (GPAI)
GPAI models are large models, such as those behind ChatGPT, Claude or Gemini, that can be used for many different tasks. The obligations for these models have applied since August 2025 and are aimed at model providers: technical documentation, information for downstream providers, a copyright compliance policy and a summary of training data. Models with systemic risk face additional duties.
If you only use such a model or integrate it into your own applications, these obligations generally do not apply to you directly. You should, however, check that your vendor meets them.
Supervision and fines in Germany
In Germany, responsibilities are set out in the KI-MIG (Germany's act on AI market surveillance and innovation promotion) of July 2026. Under this act, the Federal Network Agency (Bundesnetzagentur) is generally the central market surveillance authority, while BaFin, the financial supervisor, is responsible for certain areas such as financial services.
The AI Act provides for fines of up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, with lower caps for other infringements. For SMEs, the lower of the two amounts applies in each case.
Checklist: what to do now
- Take inventory: list every AI tool used in your company, including free tools that staff have adopted on their own.
- Clarify your role: for each tool, are you only a deployer, or also a provider because you pass it on to customers?
- Assign a risk category: pay particular attention to HR applications and decisions about customers.
- Build AI literacy: plan training sessions and document them.
- Implement transparency: label chatbots and AI-generated media.
- Write an internal policy: define which tools and which data are permitted.
- Monitor deadlines: the rules are still evolving, and further Commission guidelines will follow.
How Simplify Data can help
Simplify Data, based in Kiel, supports companies in Schleswig-Holstein, Hamburg and across Germany in introducing AI and automation. We help with the technical inventory and with choosing suitable tools; the legal assessment belongs with a law firm. Learn more on our page about AI solutions for businesses.