The EU AI Act is here - what companies need to do now for AI compliance

Regulation becomes real: the EU AI Act comes into force

With the EU AI Act, the EU is creating a comprehensive law to regulate artificial intelligence for the first time. A binding framework has been in place since August 2024 - companies now have 24 to 36 months to set up their AI systems in a compliant manner.¹

Important: The AI Act does not only affect tech companies. Any organization that develops, integrates or uses AI systems can be affected - from industry to SMEs.

Is your company affected by the EU AI Act? Find out!

These questions help with classification:

• Am I using an "AI system" within the meaning of the law?
• Does the law apply to my application?
• Do I have to fulfill certain obligations as a provider or user?
• Is there a risk that my system will be considered "high-risk"?

Clarification does not initially require a legal opinion, but a systematic approach that creates clarity.

Start self-check: four steps to clarity

We have developed four decision trees to help companies get started with the EU AI Act.

1. is it an AI system or an AI function at all?

According to Article 3 of the EU AI Act, the term is deliberately broad: It includes not only deep learning or neural networks, but also rule-based logic, statistical methods and classic machine learning models.²

Important: It's not just a question of whether the system was developed in-house - also purchased or embedded AI functions (e.g. from third-party providers) may be sufficient for the law to apply.

2. does the EU AI Act even apply to my system?

Is the system used or distributed in the EU - directly or indirectly? Systems that are initially only used outside the EU can also become relevant at a later date.³ 

3. how high is the risk of the system?

The greater the potential risk to health, safety, fundamental rights or the environment, the stricter the requirements: 

• Forbidden: z.e.g. social scores, manipulative systems or covert emotion recognition
• High-risk: z.e.g. driver assistance, credit scoring
• Limited risk: z.e.g. chatbots
• Low risk: internal, non-critical applications⁴

4. general-purpose AI: provider or user? 

If your company uses LLMs such as GPT or Alexa, usage obligations apply. Anyone who fine-tunes or further develops models may be considered a provider - with additional requirements.⁵ 

Practical tip:

If the provider of the GPAI is not compliant, the model may no longer be used in the future - even if it is already in operation.

High-risk systems: What to do?

In safety-critical areas (e.g. automotive, medicine), a "high risk" classification is often relevant.^{6 7 8}

Example: An AI system that is used as part of a driver assistance system is very likely to be subject to the stricter obligations under Article 6 in conjunction with Annex I. Annex I.

This means, among other things:

• Comply with usage specifications
• Establish monitoring & logging
• Manage & report security incidents
• Verify technical documentation and risk management^{9 10}