EU AI Act: What Companies Need to Know  

The EU AI Act follows a risk-based approach: stricter requirements apply to high-risk AI applications than to those that pose a lower risk. The law distinguishes between prohibited practices, high-risk systems, limited-risk systems, and AI systems with minimal or no risk.

Digital Omnibus Update: High-Risk AI Obligations Apply from December 2027

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on July 27, 2026, following its publication in the Official Journal on July 24, 2026. The European Parliament approved it on June 16, 2026, followed by the Council on June 29, 2026.

What’s changing:

• High-risk systems covered by Annex III: December 2, 2027, replaces August 2, 2026.
• High-risk systems covered by Annex I: August 2, 2028, replaces August 2, 2027.
• Article 4: Providers and deployers must promote AI literacy but are not required to guarantee a specific level of proficiency.
• Article 5: Two new prohibitions apply from December 2, 2026.
• SMEs and small mid-cap companies: Simplified technical documentation requirements and capped fines.
• AI Office: Direct enforcement powers for certain AI systems.

Prohibited AI Practices

AI applications that pose ansuch as social scoring. Applications used to monitor individuals that could be exploited for anti-democratic purposes also fall into this category. unacceptable risk have been banned since such as social scoring. Applications used to monitor individuals that could be exploited for anti-democratic purposes also fall into this category.February 2, 2025. Examples include systems usedsuch as social scoring. Applications used to monitor individuals that could be exploited for anti-democratic purposes also fall into this category. for real-time facial recognition and behavioral manipulation, such as social scoring. Applications used to monitor individuals that could be exploited for anti-democratic purposes also fall into this category.

High-Risk AI Systems

AI applications that could pose a significant risk to people’s health, safety, or fundamental rights are classified as high-risk. These systems are subject to strict requirements, and organizations must take a range of measures to mitigate the associated risks.

Examples include AI systems used in critical infrastructure, such as healthcare or transportation. Applications that profile individuals also fall into this category. These include AI-powered recruitment tools that automatically screen applicants and financial systems that assess a person’s creditworthiness.

For systems covered by Annex III, such as those used in recruitment or credit assessments, the obligations apply from December 2, 2027. For systems used as safety components in regulated products covered by Annex I, the deadline is August 2, 2028.

Limited-Risk AI Systems

AI systems that pose a limited risk and interact with people are primarily subject to transparency and labeling requirements. Users must be informed when AI is being used. For example, they must be told that they are communicating with a chatbot rather than a person.

AI Systems with Minimal or No Risk

The EU AI Act does not impose specific requirements on most AI systems because they pose little or no risk to individuals or society. Spam filters in email applications are a typical example.

In principle, all AI systems are subject to documentation and transparency requirements. However, the EU AI Act sets particularly strict requirements for high-risk applications, including:

• A risk assessment covering health, safety, and fundamental rights
• Comprehensive technical documentation and a quality management system
• Oversight of the data used, event logging, mandatory human oversight, and requirements for data accuracy and security
• Transparency for users and/or affected individuals
• A declaration of conformity, CE marking, and registration in an EU database

The first step is to identify which AI systems the company uses. These systems must then be assigned to the appropriate risk category, and the required measures must be implemented.

A centralized digital platform can help companies conduct AI assessments efficiently, manage risks proactively, and maintain audit-ready documentation.

Companies must take measures to promote AI literacy among employees who work with their AI systems. E-learning courses and awareness training can help employees understand the risks and use AI responsibly. Companies should also publish an AI policy and clearly communicate their guidelines.

AI Act compliance is an ongoing process, not a one-time task. Companies should therefore appoint an AI compliance officer to manage and oversee this work. Violations can result in fines ranging from €750,000 to €35 million, or 7% of global annual revenue.

The launch of ChatGPT a few years ago sparked a strong response from both AI enthusiasts and critics. Excitement about early experiments with the tool soon met with warnings about its risks. Leading AI entrepreneurs eventually called for a pause in development to agree on a set of rules for the technology.

In December 2023, the EU reached a provisional agreement on the AI Act after 37 hours of negotiations. Thierry Breton, then European Commissioner for the Internal Market, described the agreement as “historic.” The final text was published on July 12, 2024, and entered into force on August 1, 2024.

Criticism from the Business Community

While the EU takes pride in leading the way on AI regulation, the business community has raised concerns. In June 2023, more than 100 senior European business leaders, including the CEOs of Siemens, Airbus, and ARM, signed an open letter warning that the proposed law went too far.

Their main concern was Brussels’ approach to regulating generative AI. They feared that companies would need dedicated compliance departments just to meet the transparency requirements. The associated costs and workload, they argued, would undermine Europe’s competitiveness and force companies to move operations abroad. In a Deloitte survey of 500 managers, more than half of respondents also said that regulation was limiting their ability to innovate with AI.

Concerns that Europe could fall behind are understandable. Although other economies initially appeared likely to follow the EU’s lead, the situation has since changed dramatically. Shortly after taking office, Donald Trump revoked Joe Biden’s executive order on AI regulation. In January 2025, he joined OpenAI, SoftBank, and Oracle to announce plans to invest up to $500 billion in AI infrastructure through the Stargate project.

Some AI experts believe the EU AI Act could give Germany and Europe a competitive advantage by strengthening customers’ and partners’ trust in the technology. Companies that comply demonstrate that they take their social responsibility seriously, helping build a positive reputation. An ethical approach to AI is also essential for supporting sustainable innovation and preventing misuse.

We are still at the beginning of the AI transformation, and no one can say exactly where it will lead. The EU AI Act is designed to evolve alongside technological advances. That makes it worthwhile to establish AI compliance with clear digital processes and a centralized platform from the outset. Companies will then be better equipped to respond quickly and flexibly to future changes.