Update, 4 October 2026: This article records the assessment from June 2026; its outlook and FAQs remain readable as a historical account. The political omnibus agreement has since become amending law: Regulation (EU) 2026/1744 entered into force on 27 July 2026. The main high-risk dates are now 2 December 2027 for Annex III and 2 August 2028 for the relevant product-related requirements. Germany’s KI-MIG has applied since 29 July 2026. Article 50 transparency obligations have applied since 2 August 2026; the limited transition period for certain providers’ obligations under paragraph 2 ends on 2 December 2026. The authoritative sources are the official omnibus regulation and KI-MIG.
LinkedIn ran hot today. Compliance apocalypse, doomsday posts, consulting firms selling their packages in capslock headlines. My inbox this morning: twelve messages from mid-sized companies asking whether they need to shut down their AI pilots on 2 August 2026. The answer is no. They do not need to shut down. But they should invest one focused hour today - not tomorrow, not in July.
The EU AI Act has been in force since August 2024. Its main application stages are known, prepared, and communicated. What actually happens this Wednesday is not the surprise arrival of an unannounced regulation. It is the next milestone in a multi-year, calibrated rollout. Anyone who has been paying attention for the last 24 months is ready. Anyone caught off guard has confused the headlines with reality. That applies to both camps - the alarmists and the head-in-the-sand crowd.
This text is a sober assessment. It is long because the subject is long. It is concrete because most of today's posts were not. It differentiates between startup, SME, Mittelstand, and large corporation, because a high-risk conformity assessment for a three-person team means something different from what it means for a DAX-listed conglomerate. And it calls the thing by its proper name: Robotic & AI Governance is not compliance theatre. It is the precondition for autonomous systems to earn trust in a democratic society. That is the thesis behind everything that follows.
Let us start with the facts that shifted in recent weeks and that are missing from most of today's posts. On 19 November 2025 the European Commission proposed the digital omnibus package, a set of targeted amendments to streamline the AI Act. On 7 May 2026 the Council and the European Parliament reached political agreement. On 13 May 2026 the final compromise text was published. The result: central high-risk obligations are intended to be time-shifted under the political agreement. Formal adoption and entry into force of the amending regulation are still pending. Not because Brussels caved, but because the supporting infrastructure - harmonised standards, notified bodies, market surveillance authorities - is not yet broadly in place. That is grown-up regulatory practice, not retreat.
Concretely: the political agreement provides for postponing the Chapter III high-risk obligations originally scheduled for 2 August 2026. The proposed application date for standalone high-risk systems under Annex III is 2 December 2027. AI systems embedded as safety components in products covered by sectoral EU safety legislation under Annex I are intended to apply from 2 August 2028. That is the single most important correction to today's panic narrative. A mid-sized company using an HR tool with AI-supported applicant screening - a classic Annex III case - would have eighteen months under the agreed timetable to prepare for its applicable deployer obligations. Conformity assessment is generally the provider's responsibility. That is relevant. That is calming. That changes the priority list.
What does take effect on 2 August 2026 is the transparency layer. Article 50 becomes operative: labelling obligations for AI chatbots, deepfakes, AI-generated content in public communication, emotion recognition, and biometric categorisation. Generative AI systems already on the market before 2 August 2026 are intended under the political agreement to receive a transition period until 2 December 2026 for Article 50(2). That paragraph concerns machine-readable, detectable marking; watermarking is one possible implementation. That is the operational reality of this week. Nothing more, nothing less.
In parallel, the GPAI obligations that have been in force for general-purpose AI model providers since August 2025 continue to run. The EU AI Office published draft guidelines on high-risk classification on 19 May 2026 and draft guidelines on Article 50 transparency on 8 May. Providers of generative systems who sign the Code of Practice on Transparency benefit from streamlined supervision and reduced administrative burden. The list of signatories will be published in July 2026, ahead of the Article 50 application date. None of this was in most of today's LinkedIn posts either.
On 11 June 2026 - six days ago - the German Bundestag passed the AI Market Surveillance and Innovation Promotion Act, known as KI-MIG. It still needs to clear the Bundesrat, but the target is clear: entry into force before 2 August. The KI-MIG is Germany's national implementing law for the AI Act. It adds no new substantive obligations; it designates competent authorities and creates enforcement infrastructure.
Three points matter operationally. First: the Federal Network Agency (BNetzA) becomes Germany's central AI supervisory and market surveillance authority outside regulated sectors. Sectoral oversight remains in place - BaFin for AI in finance, BfArM for AI in medical devices, the Federal Data Protection Commissioner (BfDI) for data protection and biometric systems. If your company already deals with one of these authorities, nothing new to look up.
Second: a new body called KoKIVO is being set up - the Coordination and Competence Centre for the AI Regulation, housed at BNetzA. It operates a free AI Service Desk for companies, with particular focus on SMEs. Compliance questions can be raised at a low threshold. This is a structure that is unusual for Germany and one that I have been calling for in keynotes for years. Whether it delivers operationally remains to be seen. But the architecture is right.
Third: KoKIVO runs AI regulatory sandboxes where new applications can be tested under supervisory guidance. SMEs and startups have priority access. Every Member State must establish at least one such testing environment by 2 August 2027. This is a real innovation opportunity, not marketing.
What I appreciate about the German solution: it does not delay, it does not over-centralise, and it creates a clear contact point. What I see critically: the DIHK rightly noted that the emphasis is on administration rather than on supporting innovation. That is the classic German trap, and the KI-MIG risks reproducing it unless KoKIVO acts proactively and quickly.
The AI Act follows a risk-based approach with four tiers. This is the central architecture, and it is decisive, because 90 percent of all AI applications in German companies do not fall into the top two tiers.
Prohibited systems under Article 5 have been banned since February 2025. These include social scoring by public authorities, manipulation through subliminal techniques, exploitation of vulnerabilities, untargeted scraping of facial images from the internet, real-time remote biometric identification in public spaces with narrowly defined exceptions. The omnibus package added an explicit prohibition of AI systems generating child sexual abuse material or non-consensual intimate content, with a compliance deadline of 2 December 2026. If you are not building or deploying such systems, this tier is irrelevant to you. Full stop.
High-risk systems under Annex III form the operationally most important tier for the German Mittelstand. These include AI-supported recruitment and HR decisions, creditworthiness assessment of natural persons, specific safety-critical tasks in the explicitly covered infrastructure, AI in education and law enforcement. The political agreement provides for an application date of 2 December 2027. Providers must prepare documentation, risk management and conformity assessment; deployers have separate obligations. Systems placed on the market before that date and operated without significant design changes are intended to fall under the proposed, limited transition rules - a point absent from today's posts and one that significantly eases the compliance profile of many legacy installations.
Annex I systems, that is, AI as safety component in products already subject to sectoral EU safety legislation - machinery, medical devices, lifts, in-vitro diagnostics, civil aviation - are intended under the political agreement to apply from 2 August 2028. The proposed reform also clarifies the high-risk definition: a safety function can involve preventing or mitigating risks. AI whose failure endangers health and safety can also qualify as a safety component. The other conditions in Article 6 must still be checked. This refinement removes pressure from the system without lowering the protection standard.
Limited risk systems form the second most important category for most companies. Article 50 applies here from 2 August 2026: chatbots, deepfakes, AI-generated content, emotion recognition, biometric categorisation. The point is not prohibition, it is transparency. Users must know they are speaking with an AI. Synthetic media must be identifiable. This is not a technical heavy lift. It is a sign, a notice, a watermark. Companies that already communicate honestly will face minimal additional effort.
Minimal risk means no specific obligations under the AI Act. Spam filters, translation tools, e-commerce recommendation systems, AI in video games, intelligent weather forecasting. This is by far the largest category. Article 4 remains relevant. A simple chatbot may also trigger Article 50 transparency requirements; its actual function is decisive.
One obligation applying to providers and deployers since February 2025 is Article 4: AI literacy. Anyone deploying AI must take measures to ensure to the best of their ability that staff working with it have a sufficient level of competence, knowledge, and understanding. This has applied since February 2025. The original text already requires measures to the best of the provider's or deployer's ability. The political omnibus agreement proposes an explicit duty to support AI literacy without guaranteeing a particular individual's competence. The AI Board will issue recommendations, including common learning objectives.
What does this mean in practice? A documented training concept, regular awareness sessions, clear accountability. It does not require external certification. But it must be demonstrable. A manager who cannot produce training records in the event of an audit has a problem. This is the homework that every CEO should put on the desk this evening.
The fine ceilings sound dramatic. Up to 35 million euro or 7 percent of global annual turnover for violations of the prohibited practices catalogue. Up to 15 million euro or 3 percent for violations of most other obligations, including Article 50. Up to 7.5 million euro or 1 percent for false or misleading information provided to authorities. The political compromise proposes special AI Office enforcement powers, including periodic penalty payments of up to 5 percent of average daily income or turnover to enforce specified measures. The proposed five-year limitation period concerns those particular enforcement powers.
That is the headline. The reality is more differentiated and worth knowing. First: the higher amount generally applies; for SMEs including startups, the lower applies. At 20 million euro turnover the Article 50 ceiling is 600 000 euro if the company meets the SME criteria. Second: the political omnibus compromise proposes that Member States must consider the interests of SMEs and startups in the penalty framework, with specific adjustments. Third: penalty proceedings require intent or negligence. They are not strict liability. Fourth: the German KI-MIG provides for the low-threshold service desk - a clear signal that BNetzA will advise first and sanction later, as long as companies cooperate.
For Mittelstand companies that act cooperatively, document their work, and visibly engage with the topic over the coming months, the practical sanction risk is very low. For those who ignore, wait, and have no answers if an audit comes, it is high. That is the real distribution. It does not fit in a panic headline.
Differentiation is everything here. A consultancy selling every client the same 30-point compliance plan has missed the point. Here are the four realistic paths.
If you are building an AI product, the AI Act is not a burdensome obligation for you. It is a market-ordering framework that arguably protects you more than it burdens you. You compete in a market where large players can no longer deploy data and models at will. That is good for you. Practically: clarify today which risk class your product falls into. If you sit in limited or minimal risk, check the relevant transparency requirements; not every application calls for the same notice. If you fall under high-risk, the political agreement proposes 2 December 2027 for Annex III systems, but start with a light documentation framework now. You have priority access to AI sandboxes. Use them. The Service Desk is free. Ask there first, before paying four-figure consulting fees while your picture is still unclear.
This is the core customer base for the AI Service Desk. You probably use several AI tools - Microsoft Copilot, Google Workspace AI, a CRM with AI features, perhaps an HR tool with a preselection algorithm. Your risk profile is heterogeneous. First task by end of July: an AI inventory. A table with three columns - tool, risk class, internal owner. Second task: check Article 50 labelling wherever you deploy chatbots, generative content, or voice systems. Third task: document Article 4 training. If an HR tool is used for preselection, that is Annex III - the political agreement proposes December 2027 as the application date. Do not delay, but do not panic either.
It gets more complex here. You almost certainly operate at least one high-risk system, often several. Applicant selection can fall under Annex III; predictive maintenance, quality control and credit scoring solely of businesses are not high-risk merely because of those labels. You need an AI governance structure: a named owner, an inventory, a risk management framework for high-risk systems, an audit trail. This is not trivial, but it is doable. Today you should designate a person to structure the topic through end of 2026. That person does not need to be full-time on it but needs a clear mandate and 20 percent capacity. The political agreement proposes adjusted transition rules for legacy systems. Their conditions and limits must be checked for the actual system. Take stock now, plan a version freeze, decide deliberately which systems migrate into grandfathering before the cutoff and which move into full compliance after.
This has presumably been on your agenda for 18 months. If not, you have a problem larger than the AI Act. The requirements are clear: enterprise-wide AI inventory, governance board, clearly defined pathways for foundation model provider relationships, contracts with GPAI providers that regulate disclosure duties and liability, conformity assessment for Annex III systems for which the corporation is the provider, post-market monitoring plans as living documents. Add the interactions with GDPR, NIS2, the Cyber Resilience Act, and sectoral regulation. Compliance here is not a sprint but a running programme. The relevant point: large corporations should not discuss compliance today but strategic options. The political omnibus compromise proposes a clarified one-stop-shop supervision regime for certain GPAI-based systems where model and system come from the same provider. That is an architectural question with consequences for make-or-buy decisions, vendor strategy, location choice. Here Robotic & AI Governance becomes a strategic differentiator, not a cost line.
So this text is more than an assessment, here is a concrete seven-point list for the next six weeks. It is deliberately short. More is fine, but this here is the non-negotiable minimum.
More is good, but this is not negotiable. Companies that tick off these seven points by end of July are in the top tier of compliance readiness in Germany - not because the programme is particularly ambitious but because the majority of Mittelstand firms have not even completed step one.
Anyone treating the AI Act as a compliance burden alone has missed the leverage. Robotic & AI Governance - the term I have worked with for years and that I deliberately keep unified rather than splitting into Robotic Governance and AI Governance - is the institutional answer to the fact that autonomous systems now make decisions in domains where humans alone used to decide. Hiring. Lending. Quality control. Logistics. Care. Education. A society that performs this shift without an ordering framework risks losing trust. A society that performs it with a framework creates the conditions for Generation R - the generation growing up with robots and AI as a given - to find its place in a democratic, value-oriented industrial nation.
This is also why the Magnifica Humanitas encyclical of May 2026 and the AI Act are two voices in the same conversation. The encyclical lays the anthropological foundation - human dignity is not delegable. The AI Act lays the regulatory operationalisation - accountability, transparency, risk gradation. Thinking one without the other misses both. I have laid out the encyclical's implications in the analysis of Magnifica Humanitas. The broader ordering framework in which all of this fits together I have developed in the foundational text on Robotic Governance. Today's LinkedIn posts mostly ignore this dimension. They talk about fines, not about trust. They talk about obligations, not about purpose.
A note on the discourse climate. The AI Act is not perfect. It is in places over-regulatory, in others gappy. The omnibus package addressed several of the sharpest criticisms - the timing shift on high-risk obligations, the SME adjustments on sanctions, the integration with sectoral safety law. There is work left. But the path is recognisably pragmatic. Anyone writing today that the AI Act destroys European AI either has not read the final compromise text of 13 May or has interests other than the truth. Both are legitimate as market positions, but neither is information.
One table. Three columns. Tool, risk class, owner. If you have nothing yet: 30 minutes, now. If you already have something: review, extend, date it. This one hour is the most important AI hour of your year. It is concrete. It is doable without consulting fees. It is the foundation for everything else.
Then, tomorrow morning, a second hour: who owns this? One person, one mandate, a recurring slot in the calendar every four weeks, one hour each, for the next twelve months. That is the minimum programme. More is good. Less is negligent.
I have called them Generation R for years - the generation growing up with robotics and AI not as innovation but as a given. An eight-year-old today speaks with language models as a matter of course, sees autonomous logistics in port operations, knows drones above agricultural fields. That child will enter the labour market in twelve years. They will ask questions we cannot yet adequately answer. They will want to know why we allowed systems to decide whose logic no one can any longer reconstruct. They will want to know why we did not set standards sooner.
The AI Act is the imperfect but real European answer to that coming question. It makes us globally the region with the highest regulatory ambition for AI systems. That is not a burden. That is a position. A position that makes visible our ability to handle autonomous systems in a pluralistic, democratic, ageing industrial society. Anyone who has understood this does not see 2 August 2026 as a threat but as a milestone.
We knew it was coming. Now it is here. It is not as bad as many say today. But there is moderate action required. That is the honest story. It does not fit in a capslock headline. It fits in a long text. Here it is.
This article does not constitute legal advice. It offers expert assessment from the perspective of a professor of business informatics specialising in Robotic & AI Governance. Legal evaluation of any individual case is the responsibility of qualified lawyers, particularly those specialising in IT law, data protection law, and product safety law. The content reflects the state of knowledge as of 17 June 2026 and takes into account the final compromise text of the digital omnibus package of 13 May 2026 and the KI-MIG passed by the German Bundestag on 11 June 2026, which at the time of publication had not yet been considered by the Bundesrat. Changes are possible. Binding information is provided by the competent authorities, in particular the Federal Network Agency (BNetzA) through KoKIVO and the sectoral supervisors BaFin, BfArM, and BfDI.
On that date the transparency obligations of Article 50 of the AI Act become operative. This covers labelling for AI chatbots, deepfakes, AI-generated content in public communication, emotion recognition, and biometric categorisation. The Chapter III high-risk obligations originally scheduled for that date are intended under the political omnibus agreement to be postponed to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Generative AI systems already on the market before 2 August are intended to receive a transition period until 2 December 2026 for providers' Article 50(2) obligations.
Theoretically yes, practically very unlikely. The higher amount generally applies; for SMEs including startups the lower applies. At 20 million euro turnover the Article 50 ceiling is 600 000 euro if the company meets the SME criteria. The political omnibus compromise proposes requiring Member States to consider the interests of SMEs and startups in the penalty framework, with specific adjustments. Penalty proceedings require intent or negligence. Companies that act cooperatively and document their work face a very low sanction risk.
Position at publication on 23 June 2026: The political agreement proposes 2 December 2027 for standalone high-risk systems under Annex III. Provider obligations include - technical documentation, risk management system, conformity assessment, CE marking, post-market monitoring. Embedded AI as a safety component in Annex I products is intended to follow from 2 August 2028. Systems on the market before these dates without significant design change are intended to fall under the proposed transition rules. Deployer obligations differ from provider obligations, and the limits of grandfathering must be checked.
Update, 4 October 2026: The omnibus regulation has been in force since 27 July 2026. The main high-risk requirements for Annex III apply from 2 December 2027.
Position at publication on 23 June 2026: The AI Market Surveillance and Innovation Promotion Act was passed by the German Bundestag on 11 June 2026. It is Germany's national implementing law for the EU AI Act. It designates the Federal Network Agency (BNetzA) as the central AI supervisory and market surveillance authority outside regulated sectors and establishes KoKIVO, the Coordination and Competence Centre for the AI Regulation. KoKIVO operates a free AI Service Desk and organises AI regulatory sandboxes. The law still requires Bundesrat approval, with entry into force targeted before 2 August 2026.
The Federal Network Agency becomes the central contact for AI compliance questions outside regulated sectors. Sectoral authorities retain their competence: BaFin for AI in finance, BfArM for AI in medical devices, BfDI for data protection and biometric systems. At EU level, the EU AI Office holds exclusive supervisory and enforcement competence for AI systems built on GPAI models where model and system come from the same provider - the so-called one-stop-shop oversight from the omnibus package.
You must clearly and visibly inform users on first interaction that they are communicating with an AI. In practice, I recommend a clear, visible notice. Article 50(1) contains an exception where the AI interaction is obvious to a reasonably informed, observant and circumspect person in light of the circumstances and context. The information must precede the first real exchange, be clearly worded, and be visible. This applies from 2 August 2026. Penalties for violations reach up to 15 million euro or 3 percent of annual turnover - generally whichever is higher; for SMEs including startups, whichever is lower.
Position at publication on 23 June 2026: Article 4 obligates all providers and deployers of AI systems to take appropriate measures so that staff working with AI hold the necessary level of AI literacy. This obligation has applied since February 2025 and covers every company deploying AI - regardless of risk class. The original text already requires measures to the best of one's ability; the political omnibus compromise proposes further clarification, that is, a duty to make reasonable efforts rather than to guarantee a result. In practice, I recommend an appropriate, traceable training concept and awareness measures. Article 4 does not prescribe a universal certificate, test or standard participant list. External certification is not required, but demonstrability is.
Build a light compliance foundation today. Concretely: clarify your risk class, document technical decisions, keep an eye on data provenance, write a short model card for each production model. That costs a few hours per month and protects you from significant rebuild work later. You have priority access to the BNetzA AI sandboxes. Use them. The AI Service Desk is free. Ask your questions there before engaging a consulting firm. And keep Article 4 in mind - the competence obligation has applied since February 2025, including to you.
Build an AI inventory with three columns: tool, risk class, internal owner. Most of these tools fall into minimal or limited risk. Check whether you deploy AI-generated content in customer communication - check whether a specific Article 50 transparency case applies. Check whether any tool is used for applicant preselection or HR decisions - that would be Annex III and high-risk, the political agreement proposes 2 December 2027 as the application date. Document Article 4 training. Use the free AI Service Desk at BNetzA for concrete questions.
Position at publication on 23 June 2026: The original AI Act already contains transition rules for certain legacy high-risk systems. The political omnibus agreement proposes adjusting the dates to 2 December 2027 and 2 August 2028. That is not yet amending law in force. Significant design changes, the Article 5 prohibitions and special rules for systems intended for use by public authorities must still be considered. Merely freezing a version does not replace that examination.
Position at publication on 23 June 2026: The Code of Practice on Transparency is a voluntary commitment for providers and deployers of generative AI systems to meet the AI Act transparency obligations and go beyond Article 50. Signatories benefit from focused supervision, higher legal certainty across the EU, and reduced administrative burden. The list of signatories will be published in July 2026. Signing is particularly worthwhile for companies offering or extensively deploying generative AI products, because the code becomes a consistent implementation compass. Registration is via the EU AI Office signatory form.
Both regulations apply in parallel but are constructed differently. The GDPR governs the processing of personal data - it is data-centric. The AI Act governs the placing on the market and operation of AI systems - it is shaped by product safety law. Overlap is the rule, not the exception. An HR tool with AI-supported preselection is simultaneously a GDPR case and an Annex III high-risk case. You therefore need both compliance threads thought together. In practice, the data protection officer and the AI accountable owner should talk to each other, ideally in the same governance forum.
AI regulatory sandboxes are environments in which companies can test new AI applications under supervisory guidance in real-world conditions before full compliance obligations apply. In Germany, KoKIVO at BNetzA organises these sandboxes. Every Member State must establish at least one such testing environment by 2 August 2027. SMEs and startups have explicit priority access. Real-world testing outside the sandbox is also possible for certain high-risk systems. This is a real innovation opportunity - with regulatory backing rather than legal uncertainty.
The political omnibus compromise proposes consolidating oversight of certain GPAI-based systems at the AI Office where the model and system come from the same provider. The proposed exceptions must be considered. This one-stop-shop architecture significantly reduces regulatory fragmentation because providers no longer need to coordinate with different national authorities across 27 Member States. For integrated providers - typically the large foundation model providers - this is a clear simplification. For Mittelstand deployers it means clarity in the supply chain: European oversight of the GPAI provider does not release users from their own obligations as deployers or downstream providers.
GPAI obligations cover providers of general-purpose AI models - foundation models usable across a wide range of tasks. They have applied since August 2025. Providers must supply technical documentation, ensure copyright and data-provenance transparency, provide information for downstream system providers and a public summary of training content, and for systemic-risk models conduct additional safety tests including adversarial testing. Mittelstand deployers using GPAI models via API are not subject to GPAI obligations themselves, but can contractually require disclosure and cooperation rights that ease downstream compliance.
Position at publication on 23 June 2026: The political omnibus agreement proposes regulating AI in machinery more strongly through machinery law and limiting direct AI Act applicability in that context. This change is not yet in force in June. The originally planned interaction between later high-risk requirements and machinery law must therefore be distinguished from the proposed relief. The actual product function and any independent Annex III use case remain decisive.
The AI Act is one of the central instruments of Robotic & AI Governance, but it is not the whole. Robotic & AI Governance is the broader ordering framework that combines regulatory instruments such as the AI Act with ethical standards, technical norms, organisational governance, and societal deliberation into a coherent architecture. The AI Act addresses the regulatory dimension. Standards such as VDA 5050 or IEEE TechEthics initiatives address the technical-organisational dimension. Anthropological documents such as the Magnifica Humanitas encyclical address the normative foundation. Only together do these three layers produce a viable ordering framework for Generation R.
Position at publication on 23 June 2026: The EU AI Act applies directly in all Member States - it requires no national law to take effect. If KI-MIG does not pass the Bundesrat before 2 August 2026, the EU-level obligations remain effective. What would be missing is the German enforcement architecture: the formally designated market surveillance authorities, the AI Service Desk, the sandboxes. The Federal Network Agency could act in practice, but the formal legal enforcement basis would be weakened. In practice a pragmatic transitional solution would probably be found. But it would be a credibility hit that it is in everyone's interest to avoid.
Update, 4 October 2026: KI-MIG has since been adopted and has applied since 29 July 2026.
Position at publication on 23 June 2026: Typical Annex III high-risk applications in companies include: AI-supported applicant screening and HR decisions, creditworthiness assessment of natural persons, specific safety-critical tasks in explicitly covered infrastructure, AI in law enforcement and migration control, AI in education at evaluation or admission stages, remote biometric identification. A full list with practical examples is in the draft guidelines on classification of high-risk AI systems that the Commission published on 19 May 2026.
The AI Act distinguishes between provider and deployer. A provider develops an AI system or has it developed and places it on the market or puts the AI system into service under its own name or brand. A deployer uses an AI system under its own authority - they operate it. The obligations differ substantially. Providers bear the main load on technical documentation, conformity assessment, and risk management. Deployers must operate the system as intended, keep records, observe applicable safety requirements and perform a fundamental rights impact assessment in the cases covered by Article 27, and inform users. For high-risk systems, Article 25 determines when modifications or rebranding lead to a provider role. Not every change to a purchased tool does so automatically; regulatory duties and civil liability must be distinguished.
For startups and SMEs I recommend first contacting the free AI Service Desk at the Federal Network Agency and building your own AI inventory. External consulting becomes worthwhile if you operate or provide a high-risk system under Annex III or Annex I, if you operate at corporate scale, if you bring an AI product to market, or if legal questions overlap with GDPR, product safety, or sectoral regulation. For simple AI use with standard tools such as Microsoft Copilot, Google Workspace AI, or common CRM AI features, external consulting is not initially needed - a clearly structured internal approach implementing this checklist is enough.
Dominik Bösl
Olympiastrasse 6a
DE-86179 Augsburg
E-Mail info@boesl.org
Imprint Privacy Policy ©2026 | Dominik Bösl. All rights reserved.