AI COMPLIANCE · KI. ABER SICHER.

EU AI Act. Pragmatic, not panicked.

The EU AI Act applies - but not every obligation applies to every company. We first determine which risk class your AI systems fall into and which obligations actually follow. Then we implement exactly that: literacy proof, AI policy, governance. No more, no less.

Which obligations apply since when?

SinceWhat applies
02 Feb 2025Prohibited AI practices (e.g. social scoring) and Article 4: companies using AI must ensure sufficient AI literacy among their staff.
02 Aug 2025Obligations for providers of general-purpose AI models (GPAI), governance and penalty rules.
02 Aug 2026General applicability: transparency obligations under Article 50 (label AI chatbots, disclose deepfakes) and obligations for high-risk systems under Annex III.
02 Aug 2027High-risk obligations for AI in regulated products (Article 6(1)).

As of 09/2026. Deadlines may shift through ongoing EU legislation (Digital Omnibus). Factual summary - not legal advice.

Quick check: does the labelling duty apply to you?

Five questions, instant result - no sign-up.

  1. Do you run a chatbot, voice or phone assistant that customers, applicants or partners write or talk to directly?
  2. Do you publish AI-generated or AI-altered images, videos or voices that look real - such as real people, places or events?
  3. Do you publish AI-generated text informing the public on matters of public interest without a human reviewing it and taking editorial responsibility?
  4. Do you use AI to recognise people’s emotions or to assign people to categories based on biometric data?
  5. Do you offer an AI system under your own name - for example your own bot for customers or a generator you built yourself?

The four risk classes

The EU AI Act regulates by risk. The first step of any compliance work is therefore classification: which of your AI systems fall into which class?

Risk classExamplesConsequence
Unacceptable riskSocial scoring, manipulative systemsProhibited (since 02/2025)
High riskAI in recruiting, credit scoring, critical infrastructureExtensive obligations: risk management, documentation, human oversight
Limited riskChatbots, generative AI, deepfakesLabelling duty under Article 50 (since 02 Aug 2026)
Minimal riskSpam filters, simple assistance systemsNo specific obligations - Article 4 (AI literacy) still applies

We classify your AI systems and derive the concrete obligations - as part of the AI CHECK or as standalone compliance consulting.

Our compliance services

AI literacy proof (Article 4)

Structured, documented training with a certificate - the cleanest proof of the literacy obligation. AZAV-compliant and fundable up to 100% via § 82 SGB III.

Go to AI ACADEMY →

Compliance package

Training plus AI policy plus data protection impact assessment (DPIA): the organizational baseline for using AI in your company.

Check funding →

AI governance & ISO 42001

Governance structures, risk analysis, and documented processes - aligned with the international standard for AI management systems (ISO/IEC 42001).

Start with the AI CHECK →

Compliance AI technology

AI agents that audit other AI systems - our award-winning technology approach for continuous control instead of one-off audits.

View AI EXPERT →

Frequently asked questions

Does the EU AI Act apply to small and mid-sized companies?

Yes. The regulation has no general SME exemption. Article 4 (AI literacy) has applied since 02 Feb 2025 to every company using AI - regardless of size. The scope of the remaining obligations depends on the risk class of the systems used, not on company size.

What are the penalties for violations?

Fines of up to €35 million or 7% of global annual turnover for prohibited practices; up to €15 million or 3% for other violations. In addition, there is liability risk if literacy and documentation obligations cannot be demonstrated in case of damage.

Is internal training sufficient proof of AI literacy?

Article 4 does not prescribe a curriculum - it demands organizational responsibility. What matters is demonstrability: a structured, documented training with a certificate is the simplest evidence. Our AZAV-compliant programs deliver exactly that - partly up to 100% government-funded.

Which AI systems does the labelling duty cover?

Article 50 covers four groups: systems interacting directly with people (chatbots, voice assistants, AI telephony), systems generating synthetic audio, image, video or text, emotion recognition and biometric categorisation, and deepfakes. It does not cover purely internal AI analytics with no outside contact. Your role also decides: in the first two cases the provider of the system is liable, in the last two the deployer - you, as the company using it.

Do we have to label our website chatbot as AI?

Yes, unless it is obvious from the context that this is an AI - and the yardstick is stricter than many assume: a window merely labelled "Chat" does not clear it. One sentence when the chat window opens usually suffices. Timing matters: under Article 50(5) the notice must be visible at the first interaction, so an entry in the imprint or terms of use does not qualify.

Do we have to label AI-written text?

As a rule, no. The disclosure duty for text only applies to publications informing the public on matters of public interest - and even there it falls away if the text was reviewed by a human and a natural or legal person holds editorial responsibility. Product descriptions, proposals and professional articles with a named responsible party therefore regularly fall outside it.

What is a high-risk system?

AI systems in the areas listed in Annex III - such as recruiting, credit scoring, critical infrastructure, or access to education - as well as AI as a safety component of regulated products. They carry the most extensive obligations: risk management, data quality, documentation, human oversight.

Does your consulting replace legal advice?

No. We advise on the technical-organizational side: risk classification, literacy building, policies, governance processes. For binding legal questions we work with your law firm or recommend specialized partners.

Article 50 in detail: the four cases of the labelling duty →

Where do you stand on the EU AI Act?

In a free initial consultation we clarify which of your AI systems are affected and which obligations follow - and whether training and consulting are fundable for you.

Your request

By submitting, you agree that we process your details to get in touch. More in our privacy policy.

We handle your data in line with GDPR and never pass it on.

Request a free initial consultation →Go to funding check →