01 · Timeline
What really applies when
The EU AI Act becomes applicable in stages. The Digital Omnibus postponed central deadlines for high-risk systems in May 2026 – but not all obligations. Anyone only looking at the postponed deadline overlooks what already applies.
- Since 2 February 2025
Art. 4 AI literacy & Art. 5 prohibited practices
Every company using AI must ensure that staff have demonstrable basic AI knowledge. Eight practices are prohibited – including subliminal manipulation, emotion recognition at the workplace, social scoring. Anyone who has not documented the training obligation is already in breach.
- Since 2 August 2025
GPAI obligations, supervisory authorities, penalty framework
Obligations for providers of general-purpose AI models apply. Actual enforcement by the Commission only starts on 2 August 2026 – one year after applicability.
- From 2 August 2026
Transparency obligations under Art. 50 – central date
Chatbots must identify themselves as AI, deepfakes and AI-generated content on public-interest topics require labelling. This deadline is not affected by the Digital Omnibus. At the same time, the BSI as German market surveillance authority starts active inspections.
- 2 December 2026
Machine-readable labelling & watermarks
The technical watermarking obligation for synthetic content under Art. 50(2) has been brought forward or specified – depending on the final trilogue outcome.
- Expected 2 December 2027
High-risk obligations Annex III – not yet final
The Digital Omnibus postpones full obligations for stand-alone high-risk systems (including recruitment, credit scoring, critical infrastructure) by more than a year. Without a Digital Omnibus adopted and published in the Official Journal before 2 August 2026, the original deadlines remain in force.
- Expected 2 August 2028
High-risk AI in regulated products (Annex I)
Extended transition for AI embedded as a safety component in already regulated products – such as machinery, medical devices or lifts.
Recommendation
Don't wait for the postponed deadline – use the time gained: inventory AI systems, classify risks, build governance structures. Keep Germany in view in parallel – the KI-MIG as national implementation law was adopted by the Federal Cabinet in February 2026 and regulates market surveillance by the BSI.
02 · Framework
Four risk classes, four obligation levels
The EU AI Act does not regulate the technology as such, but the concrete use case and the risk it creates. The classification determines all subsequent effort.
Prohibited
No use allowed
Social scoring, subliminal manipulation, emotion recognition at the workplace, biometric categorisation by sensitive attributes – regardless of company size.
High-risk
Full obligation catalogue
Recruitment, credit scoring, critical infrastructure, education, insurance. Risk management, data quality, human oversight, conformity assessment, registration.
Limited risk
Transparency under Art. 50
Chatbots, deepfakes, AI-generated texts on topics of public interest. Users must be able to recognise that they interact with AI.
Minimal risk
No specific obligations
Most internal assistance and workflow tools, spam filters. Good practice and documentation still recommended.
Roles – who is actually affected?
Four actors along the value chain: provider, deployer, importer, distributor. Most SMEs are deployers – with reduced but real obligations under Art. 26. "My provider will take care of it" is no free pass: transparency towards customers, data protection and control over the deployment context remain your own duty.
Recommendation: when in doubt, document as high-risk
Document all AI applications from the start as if they were classified as high-risk. This provides safety, eases later audits – and makes the classification verifiable instead of asserted once.
03 · Action pressure
What SMEs must do now concretely
Regardless of how the high-risk deadlines finally develop: these six points are already mandatory today or will be by 2 August 2026.
01 · Demonstrate AI literacy
Art. 4 has applied since February 2025 to everyone using AI tools on behalf of the company – procurement, sales, engineering. A documented training concept is the most frequently underestimated obligation.
02 · Full inventory
Not only officially introduced tools count. Shadow AI and AI functions embedded in SaaS solutions belong in the inventory too – otherwise risk classification stays incomplete.
03 · Risk classification per use case
Assess high-risk-related and rights-relevant cases first, simple internal tools last.
04 · Prepare transparency notices
Chatbots, image generators and text automation need clear front-end notices by 2 August 2026 – regardless of the outcome of the Digital Omnibus.
05 · Governance skeleton
Define roles, approval processes, documentation duties and escalation paths – in writing, but lean enough not to undermine agility.
06 · Review contracts with AI providers
Commitments on data quality, evidence support and liability belong in every contract. As deployer you remain responsible for how the system is used at your company.
04 · Risk
Sanctions, liability and the role of the BSI
Penalty framework
Prohibited practices: up to €35M or 7% of global annual turnover. High-risk violations: up to €15M or 3%. False statements to authorities: up to €7.5M or 1%. Reduced caps apply to SMEs and start-ups.
Market surveillance by the BSI
Germany regulates national implementation through the KI-MIG. The BSI takes over market surveillance and has announced active inspections from August 2026 – with the power to impose fines, operating bans and recalls.
Responsibility of executive management
As with NIS2, compliance shifts from an IT topic to a management task. Ultimate responsibility for AI-based decisions always lies with the company and its leadership – not with the tool provider.
05 · Our perspective
Compliance as an operating system, not a project
AI compliance is not a bureaucratic topic. It is a competitive advantage – if embedded in the organisation from the start rather than treated as an afterthought.
AI without governance
- Tools are introduced, decision paths remain unchanged
- Nobody knows who is responsible for which AI system
- Documentation only emerges when the auditor asks
- Regulatory pressure hits an unprepared organisation
AI with embedded governance
- Clear roles, approvals and decision paths from the start
- Documentation as by-product of good processes, not extra effort
- Early warning system detects regulatory and operational risks together
- Compliance becomes a sales argument towards customers, banks, partners
Preventive · Guardrails before deployment
Define roles, policies, data standards, approvals and no-go zones before AI is rolled out broadly.
Proactive & detective · Detect risks early
Systematically track regulatory developments like the Digital Omnibus. Make usage, outputs and deviations traceable through reviews, audits and monitoring.
Reactive · Ready to act on incidents
Clear escalation paths, corrections and communication when something goes wrong – organisationally secured instead of improvised.
These four layers are not an add-on to our Path-to-Resilience approach – they are its regulatory foundation. And they are the prerequisite for hybrid organisations of humans and AI agents to scale trustfully at all: transparent AI decisions and embedded governance are not the opposite of speed, but its foundation.
06 · Pitfalls
Avoid common mistakes
Mistake 1 · Waiting for the postponed deadline
As long as the Digital Omnibus is not finally adopted and published, the original deadlines by 2 August 2026 apply in case of doubt.
Mistake 2 · Only capturing official tools
Otherwise shadow AI and AI features embedded in SaaS products remain a blind spot.
Mistake 3 · Treating compliance purely legally
Without operational anchoring in processes and leadership, every documentation stays theoretical.
Mistake 4 · Underestimating Art. 4
The obligation on AI literacy has applied since February 2025 – independent of the high-risk debate.
07 · Implementation
The roadmap to AI-Act readiness
Four phases make the path to compliance plannable – and at the same time create the governance structure required for scalable AI use anyway.
| Phase | Timeframe | Core outcomes |
|---|---|---|
| 1 — Inventory | 0–6 weeks | Complete inventory of all AI systems (incl. shadow AI), role clarification provider/deployer, first gap analysis on transparency, documentation and data quality. |
| 2 — Governance skeleton | 6–12 weeks | Roles, approval processes, documentation standards. Demonstrable Art. 4 training concept for all AI-using employees. |
| 3 — Prioritised implementation | 3–6 months | Transparency notices live, high-risk preparation where relevant, contract adjustments with AI providers, first internal audits. |
| 4 — Monitoring & early warning | ongoing | Regular reviews, regulatory tracking (Digital Omnibus, KI-MIG, BSI practice), audit readiness as a permanent state instead of a project. |
Note: this whitepaper serves as strategic orientation and does not constitute legal advice for the individual case. For binding legal assessments we recommend consulting specialised law firms.