The AI Act (Regulation (EU) 2024/1689) is the first horizontal product safety law for artificial intelligence. It applies to companies that develop, distribute or use AI systems. We advise providers and deployers on classifying their systems, building compliance and in proceedings before supervisory authorities.
Scope of the AI Act
It covers AI systems, meaning machine-based systems that, with some degree of autonomy, infer from inputs how to generate outputs such as predictions, content, recommendations or decisions (Art. 3(1)). Purely rule-based software is generally not covered. General-purpose AI models (GPAI) are regulated separately. The AI Act also applies to providers outside the EU if their system is placed on the market here or its output is used in the EU (Art. 2).
Roles: provider and deployer
A provider develops an AI system, or has it developed, and places it on the market under its own name (Art. 3(3)). A deployer uses an AI system under its own authority in a professional context (Art. 3(4)). Anyone who markets a third-party high-risk system under its own brand, substantially modifies it or changes its intended purpose so that it becomes high-risk becomes a provider (Art. 25).
Risk classes
- Prohibited practices (Art. 5): among others manipulative techniques, social scoring, emotion recognition at work and in education, untargeted scraping of facial images. From 2 December 2026 also AI systems that generate realistic intimate images of identifiable people without consent, and systems generating child sexual abuse material.
- High-risk AI (Art. 6 with Annexes I and III): safety components of regulated products such as machinery or medical devices, and uses in recruitment, education, credit scoring, critical infrastructure and access to public services.
- Transparency obligations (Art. 50): chatbots, synthetic content, deepfakes, emotion recognition.
- All other systems: no specific obligations beyond AI literacy under Art. 4.
Obligations for high-risk AI
Providers need risk management, data governance, technical documentation, logging, instructions for use, human oversight, and accuracy, robustness and cybersecurity (Arts. 9 to 15), plus quality management, conformity assessment, CE marking, registration and post-market monitoring. Deployers must follow the instructions, ensure human oversight by trained staff, check input data within their control, keep logs and inform employees before workplace use (Art. 26). Public bodies and certain private deployers, for example in credit scoring, must carry out a fundamental rights impact assessment (Art. 27).
Transparency obligations under Art. 50
Since 2 August 2026, systems that interact with people must make clear that users are dealing with AI. Deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless it has undergone editorial review. Generative systems must mark their output in machine-readable form (Art. 50(2)); for systems on the market before 2 August 2026 a transition period runs until 2 December 2026.
General-purpose AI models (GPAI)
Since 2 August 2025, GPAI providers have had to keep technical documentation, inform downstream providers, adopt a copyright policy that respects machine-readable opt-outs and publish a summary of training content (Art. 53). Models with systemic risk face additional duties (Art. 55). The GPAI Code of Practice of 10 July 2025 serves as a means of demonstrating compliance. Since 2 August 2026 the AI Office can enforce these duties with fines.
AI Act deadlines after the Digital Omnibus
Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026) mainly postponed the high-risk obligations. Their substance remains.
| Date | What applies |
|---|---|
| 02.02.2025 | Prohibitions under Art. 5, AI literacy under Art. 4 |
| 02.08.2025 | GPAI obligations, governance, penalties |
| 02.08.2026 | General application, in particular Art. 50; AI Office powers over GPAI providers |
| 02.12.2026 | New prohibitions (intimate deepfakes, abuse material); end of transition for marking under Art. 50(2) for legacy systems |
| 02.08.2027 | GPAI models placed on the market before 02.08.2025 |
| 02.12.2027 | High-risk obligations for Annex III systems (previously 02.08.2026) |
| 02.08.2028 | High-risk obligations for AI in Annex I products (previously 02.08.2027) |
Fines and supervision in Germany
Breaches of the prohibitions can be fined up to EUR 35 million or 7 % of worldwide annual turnover, most other breaches up to EUR 15 million or 3 %, and incorrect information to authorities up to EUR 7.5 million or 1 % (Art. 99); for SMEs the lower amount applies. The German AI Market Surveillance and Innovation Promotion Act (KI-MIG) entered into force on 29 July 2026. The Federal Network Agency (Bundesnetzagentur) is the central market surveillance authority, BaFin remains competent for the financial sector, and the Commission’s AI Office supervises GPAI providers.
Compliance roadmap
- AI inventory, including AI features in standard software.
- Role and risk class for each system, documented.
- Exclude prohibited uses, implement labelling under Art. 50.
- AI literacy measures under Art. 4, documented.
- For high-risk systems: gap analysis and timetable to December 2027 or August 2028.
- Supplier contracts: information, documentation, cooperation, liability.
We read technical documentation ourselves: Michael Horak is a qualified electrical engineer, and a colleague is a physicist.
FAQs on the AI Act
Have the high-risk obligations been abolished?
No. The Digital Omnibus postponed them to 2 December 2027 for Annex III and 2 August 2028 for Annex I. SMEs and small mid-caps get relief on documentation and quality management.
Does the AI Act apply to systems already on the market?
For high-risk systems placed on the market before the cut-off date, in principle only after a significant change in design (Art. 111). Prohibitions and transparency obligations apply regardless.
Legal position as of November 2026. Commission guidelines and harmonised standards on the high-risk requirements are partly still in preparation; we will update this page when they are available.
Related topics
- AI law overview
- Obligations for AI providers
- Using AI in your business
- AI literacy under Art. 4 (in German)
Contact us
Would you like to know how your AI systems are classified under the AI Act and which deadlines apply to you? Call us on +49 511 35 73 56-0 or email info@itrechtler.de.