The EU AI Act for Businesses

• The EU AI Act, also known as the AI Regulation, classifies AI systems into four risk categories across the EU: prohibited, high, limited, and minimal.

• Prohibited practices and the AI competence requirement have been in effect since February 2025, while obligations for general-purpose AI have been in effect since August 2025.

• The Digital Omnibus postpones the obligations for autonomous high-risk AI systems to December 2, 2027, and for product-integrated high-risk AI systems to August 2, 2028.

• Transparency requirements for chatbots and AI-generated content remain in effect as of August 2, 2026.

• Violations are subject to fines of up to 35 million euros or 7 percent of global annual revenue.

The EU AI Act affects far more companies than the name might initially suggest. The regulation distinguishes four key roles along the AI value chain:

• Providers develop an AI system or have it developed and place it on the market under their own name.

• Operators use an AI system under their own responsibility—for example, a company that uses an AI tool for candidate selection.

• Importers bring AI systems into the EU from third countries.

• Distributors make AI systems available on the market without developing or importing them themselves.

For providers, the “place of marketing” principle applies: Anyone who places an AI system on the market or puts it into service in the EU falls under the regulation, regardless of where the company is headquartered. For operators, the location of their establishment in the EU is what counts. The AI Act even applies to companies with no EU connection of their own if someone in the EU uses the output of their AI system—such as an assessment or score generated abroad.

Companies in regulated and KRITIS-related sectors—such as finance, healthcare, public administration, or energy supply—are particularly affected. It is precisely in these sectors that organizations frequently use AI for high-stakes decisions, such as granting loans, making medical diagnoses, or managing critical processes. For these companies, the obligations under the AI Act carry greater weight because they apply in parallel with existing regulations such as NIS-2 or DORA (Digital Operational Resilience Act).

Since the Digital Omnibus, another new practice has been added to the list of prohibited uses: Effective December 2, 2026, the AI Act will also prohibit AI systems that are specifically used to create non-consensual intimate depictions or abusive images of minors.

In addition to these four classes, there is a separate category: general-purpose AI (GPAI) models, such as the large language models that power many chat applications. Their providers must, regardless of the specific application, provide technical documentation, publish a summary of the training data, and adhere to a copyright compliance policy. For models posing systemic risk—such as particularly powerful foundation models—risk assessments, security tests, and incident reporting are also mandatory.

Hardly any other EU regulation has been so fundamentally revised so soon after its entry into force as the AI Act. On July 27, 2026—just a few days before the originally critical deadline—Amending Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force. It postpones key deadlines and provides relief to smaller companies in particular, without eliminating the fundamental obligations.

Here is the new timeline:

• August 1, 2024: The EU AI Act enters into force.

• February 2, 2025: Prohibited practices under Article 5 and the AI competence requirement under Article 4 become applicable.

• August 2, 2025: Obligations for general-purpose AI models, as well as the requirements regarding governance, designated authorities, and fines, take effect.

• August 2, 2026: The core obligations under Article 50 regarding transparency for chatbots and AI-generated content become applicable.

• December 2, 2026: The requirement to label AI-generated content with a watermark applies to existing systems. As of the same date, the new prohibitions—supplemented by the Digital Omnibus—against non-consensual intimate AI depictions and AI-generated images of child abuse also take effect.

• December 2, 2027: The obligations for standalone high-risk AI systems under Annex III take effect, 16 months later than originally planned.

• August 2, 2028: The obligations for high-risk AI systems integrated as safety components into already regulated products (Annex I) become applicable.

For small and medium-sized enterprises, the Digital Omnibus provides an additional relief measure: They are permitted to reduce the technical documentation required for high-risk AI systems. The fundamental obligation to provide evidence remains unaffected.

Companies should make use of this additional time. Those who are already planning or deploying AI systems in the high-risk sector today will gain a clear advantage by preparing early, once the postponed obligations take effect.

Even though the AI Act, as an EU regulation, is directly applicable, Germany needs its own implementing law to define jurisdictions and establish procedures for imposing fines. The Bundestag passed this law—the AI Market Surveillance and Innovation Promotion Act (KI-MIG)—on June 11, 2026. The Bundesrat approved it on July 10, 2026, and the law entered into force on July 29, 2026.

Under the KI-MIG, Germany centralizes AI oversight at the Federal Network Agency (BNetzA). The agency serves as the central coordinating body, market surveillance authority, and notifying authority for AI in Germany and operates an AI Service Desk as the first point of contact for companies. For particularly sensitive use cases, such as law enforcement or migration, the Federal Network Agency has established an independent AI Market Surveillance Chamber (UKIM). Existing sector-specific supervisory authorities remain responsible in parallel: Those who have previously worked with BaFin (Federal Financial Supervisory Authority) or other sector-specific authorities will continue to work with that authority under the AI Act.