EU AI Act in Practice: What Companies Need to Know and Do Now

Summary / Excerpt: The EU AI Act is no longer an abstract regulatory project – it is reality. From 2 August 2026, far-reaching obligations apply to companies that use AI. Fines of up to 35 million euros, personal liability of management and new requirements for chatbots on public websites make swift action necessary. This article explains the concrete deadlines, risk levels and obligations – and shows how companies can act proactively now.

What is the EU AI Act – and why does it affect almost every company?

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive law regulating artificial intelligence. It entered into force on 2 August 2024 and takes full effect in stages until 2028. The law applies to anyone who develops, operates, imports or uses AI systems in the EU – regardless of whether the provider is based inside or outside the EU.

If you run an AI-powered chatbot on your website, let employees work with AI tools or make automated decisions, you are affected. According to a survey by the Ifo Institute, 54.5 percent of German companies already use AI technologies. These companies need to act now.

The risk model: four levels, different obligations

The EU AI Act follows a risk-based approach. The greater the potential harm an AI system can cause to society, the stricter the requirements.

Level 1: Unacceptable risk – prohibited

These AI applications are banned entirely:

• Social scoring by public authorities
• Manipulative AI systems that subliminally influence human behaviour
• Biometric categorisation by political opinion, sexual orientation or religious belief
• Real-time facial recognition in public spaces (with narrow exceptions)
• AI systems that exploit vulnerabilities of individuals (age, disability)

Level 2: High risk – strict obligations

AI is considered high-risk in sensitive areas such as HR and recruiting, credit scoring, education and training, medicine and healthcare, critical infrastructure, biometrics, law enforcement and border control, and the administration of justice.

From August 2026, extensive obligations apply to these systems: a risk management system under Art. 9, technical documentation under Art. 11, conformity assessment, registration in the EU database and mandatory human oversight.

Level 3: Limited risk – transparency obligations

This mainly covers chatbots, virtual assistants and generative AI. These systems must be labelled as AI. For companies with a public website, this is the most immediately relevant category.

Level 4: Minimal risk – largely unrestricted

AI-based spam filters or simple recommendation systems are subject to hardly any restrictions.

The timeline: who has to do what, and when?

Important: The competence obligation under Art. 4 has applied since February 2025. Companies must be able to document that employees have been trained in the use of AI. Update: the digital omnibus (EU process) changed that.

Fines and liability: what is at stake for violations

The EU AI Act provides for a three-tier sanctions system:

Category 1 – most serious violations (prohibited AI practices): up to 35 million euros or 7 percent of worldwide annual turnover

Category 2 – high-risk violations and breaches of transparency obligations: up to 15 million euros or 3 percent of worldwide annual turnover

Category 3 – incorrect information provided to authorities: up to 7.5 million euros or 1 percent of worldwide annual turnover

In principle, lower maximum amounts apply to SMEs, with the lower of the two values (absolute amount or percentage) being applicable.

A company qualifies as an SME if it has no more than 249 employees and an annual turnover of at most €50 million or a balance sheet total of at most €43 million. The basis is EU Recommendation 2003/361/EC.

Beware of group affiliation: For a company that is part of a larger group, the headcount and the turnover or balance sheet total of the group must also be taken into account, depending on the size of the shareholding. A subsidiary of a large corporation is therefore not an SME, even if it is small itself.

Particularly critical: Art. 4 of the EU AI Act anchors the personal liability of management. If a company cannot demonstrate sufficient AI competence, managing directors can be held personally liable. Combined with the GDPR and NIS2, cumulative penalties for serious violations can rise to as much as 13 percent of global annual turnover.

Chatbots and AI assistants on public websites

If you operate an AI chatbot on your company website, in a customer portal or in an app, you are directly affected by Art. 50 of the EU AI Act from 2 August 2026. The requirements are clear:

What is mandatory:

• Users must be informed clearly and understandably at the latest at first contact that they are communicating with an AI system (a permanent label in the chat header is sufficient)
• The label must be clearly visible, accessible and not hidden in the footer
• A small note at the bottom of the page is expressly not enough

What a compliant label looks like:

An opening line in the chat such as “Hello, I am the AI assistant of [company]. I answer your questions about [topic] automatically.” meets the requirement. Alternatively, a permanently visible label in the chat header such as “AI assistant”.

Exceptions apply only if it is obvious from the context to an average, informed user that they are talking to an AI – for example with well-known voice assistants such as Alexa or Siri.

What many overlook: AI-generated texts that are published – for example product descriptions, automated reports or social media posts – are also subject to labelling obligations if they appear deceptively authentic and have not been editorially reviewed by a human.

The Munich I Regional Court ruling: AI is liable like an editor

A landmark ruling of 28 May 2026 (LG München I, case no. 26 O 869/26) shows what lies ahead for companies that use generative AI publicly: in preliminary injunction proceedings, the court prohibited Google from spreading untrue factual claims about two Munich publishers in its AI search feature “AI Overviews”. The AI had wrongly attributed information about questionable business practices of other companies to these publishers.

The court classified Google not as an indirect contributor but as a direct infringer. The reasoning: while conventional search results merely display third-party content with a title and a link, the AI feature generates its own running text that summarises several sources. To the average user, this looks like direct information from Google – not like passing on someone else’s content. The note “Created with AI” did not change this attribution.

What this means for companies: If you use generative AI on your website, in your app or in your customer portal that independently produces texts and makes them publicly available, you bear full responsibility under the law on statements for this content. The fallibility of the AI process is no defence. This applies to chatbot answers just as much as to automatically generated product descriptions or FAQ texts.

AI agents: the underestimated risk potential

AI agents are AI systems that do not just answer questions but act independently: they break goals down into subtasks, interact with other systems, read and write files, send emails, book appointments or execute transactions – with minimal human oversight.

This is exactly where a serious problem lies that many companies still underestimate.

Why AI agents are particularly problematic:

First, traceability is limited. The chains of action of autonomous agents often cannot be documented completely. What did the system decide, and when? On the basis of which data?

Second, there is a loss of control. As soon as an agent accesses external systems on its own, errors or misinformation can have cascading consequences that can hardly be stopped manually.

Third, the attack surface increases dramatically. Prompt injection attacks – in which malicious instructions are smuggled into input data – can make agents carry out unwanted actions. OpenAI only responded in June 2026 with a dedicated protection mode against exactly these attack vectors.

Fourth, compliance assessment is complex. The EU AI Act does not explicitly use the term “agentic AI”, but autonomous systems fall under the broad definition of AI in Art. 3(1). Depending on the field of use – financial decisions, personnel management, customer communication – they can be classified as high-risk systems, with all the associated documentation and oversight obligations.

Recommendation: If you use AI agents at all, use them only in clearly defined, documented scenarios that humans can switch off at any time. Define in writing in advance which actions the agent may perform and which it may not. Complete logging of all agent actions is essential.

Why local AI makes the EU AI Act considerably easier

Many of the requirements of the EU AI Act only arise because AI systems use external, cloud-based services and transfer sensitive company data to third parties. A locally operated AI – that is, an AI model that runs entirely on your own hardware or in a private infrastructure within the company – solves many of these problems structurally.

Concrete compliance benefits of local AI:

Local AI systems do not transfer data to external providers. This not only protects trade secrets but also considerably reduces the GDPR effort. Records of processing activities, data processing agreements with cloud providers and third-country transfers (e.g. to the USA) no longer apply.

The documentation obligations of the EU AI Act – especially for high-risk systems – are easier to meet with local systems, because companies have complete control over the model, configuration and training data.

The problem of so-called shadow AI – when employees use external AI services uncontrolled via private accounts – disappears if the company provides a powerful, secure internal alternative.

Local AI can be adapted to company-specific requirements through targeted fine-tuning without sensitive data leaving the company.

Suitable models for business use today include Mistral, LLaMA, Phi or Qwen – depending on requirements, they can even be run on mid-range hardware.

Focused AI systems: less is more

Another aspect that is equally decisive for compliance and security: concentrating on focused AI systems instead of universal all-rounders.

An AI system that does exactly one task very well – for example analysing incoming invoices, categorising support requests or generating product descriptions from database fields – is much easier to classify under the regulation than a system that performs arbitrary tasks.

Focused systems have clearly defined inputs and outputs. They are easier to test and validate. Their risk profile is transparent. Errors can be contained and traced more easily. And the requirements of the EU AI Act – especially risk classification, documentation and conformity assessment – can be met for a focused system with considerably less effort.

Recommendation: Instead of one central AI system that can do everything and is used everywhere, prefer several small, specialised systems with a clear task, defined data access and a documented intended purpose.

Tips and recommendations for companies

Act immediately (mandatory since February 2025): Document which AI systems are used in the company – including AI tools that employees use privately or via external accounts. Start training and document it verifiably.

Implement by August 2026: Check all publicly accessible chatbots and AI assistants for the labelling obligation under Art. 50. Write clear, accessible notices about the AI interaction. Create a complete AI inventory with risk classification. Have contracts with AI providers reviewed by a lawyer.

Structurally recommended: Switch to local or private AI solutions where possible to reduce data risks and compliance effort. Rely on focused, clearly limited AI applications instead of uncontrolled universal systems. Establish clear internal policies on permitted AI use to contain shadow AI. Appoint a person responsible for AI governance in the company.

For AI on public websites: Always have automatically generated public content checked and approved by a human. Only then does the exception from the labelling obligation apply. Remember: under the law on statements – as the Munich ruling shows – generative AI output is attributed directly to the operator.

<figure class="wp-block-pullquote"><blockquote><p>An optimised AI specialises in one use case and is much easier to control and more reliable! </p><cite>See <a href="https://dr-dsgvo.de/ki-apps-statt-prompting-effiziente-loesungen-fuer-konkrete-aufgaben-en/" data-type="post" data-id="29243">AI apps</a>.</cite></blockquote></figure>

Checklist: EU AI Act – where does your company stand?

Basics

• [ ] AI inventory created: which AI systems are used internally and externally?
• [ ] Shadow AI analysis carried out: which AI tools do employees use without IT approval?
• [ ] Risk classification of all AI systems completed (prohibited / high-risk / limited / minimal)
• [ ] AI literacy training of all relevant employees documented (mandatory since Feb. 2025)
• [ ] Person responsible for AI governance appointed

Transparency and website

• [ ] All public chatbots and AI assistants labelled as AI
• [ ] Label visible at first contact, not in the footer
• [ ] AI-generated public content either labelled or editorially reviewed
• [ ] Privacy policy supplemented with AI information

High-risk systems (if applicable)

• [ ] Risk management system under Art. 9 documented
• [ ] Technical documentation under Art. 11 prepared
• [ ] Conformity assessment initiated
• [ ] Registration in the EU AI database checked
• [ ] Human oversight ensured

Contracts and governance

• [ ] Contracts with AI providers checked for AI Act compliance
• [ ] Data processing agreements with cloud AI providers updated
• [ ] Internal usage policy for AI tools created
• [ ] Use of AI agents documented with clear limits on their actions
• [ ] Logging of all AI actions involving personal data ensured

Future-proofing

• [ ] Local AI solutions considered as an alternative to cloud services
• [ ] Focused AI applications in use instead of universal systems
• [ ] ISO 42001 (AI management system) examined as a framework
• [ ] Regular internal AI audits planned

Conclusion: now is the right time

The EU AI Act is no longer a theoretical regulatory project. The first deadlines have already passed, and the next ones are imminent. Companies that act now not only protect themselves against fines – they build trust with customers, partners and authorities.

The good news: if you rely on local AI, focused systems and transparent governance, you not only meet the requirements more easily – you also build a more sustainable, safer and more data-protection-compliant AI infrastructure than any universal cloud service could ever offer. Higher reliability and better quality of AI results come on top.