Companies that develop, distribute, or deploy AI systems must comply with the requirements of the EU AI Act if their systems are active on the European market. The regulation has been phasing in since August 2024 and will be fully applicable in most parts from 2026 onwards. In this article, we answer the most important questions about implementation: who is affected, what obligations apply, and how companies can approach compliance in a structured way.<\/p>\n
The EU AI Act applies in principle to all companies that develop, provide, or deploy AI systems in the EU, regardless of whether they are based inside or outside the EU. What matters is where the AI system is used or whose interests it affects.<\/p>\n
The regulation distinguishes between different roles a company can take on:<\/p>\n
The deployer role is particularly relevant for many medium-sized and large companies: anyone who uses a high-risk AI system in the workplace is subject to specific information obligations towards affected employees under Art. 26(7) of the EU AI Act. Public and private institutions providing public services are also required, under certain circumstances, to carry out a fundamental rights impact assessment. In short: anyone who uses AI is affected by the EU AI Act, regardless of industry or company size.<\/p>\n
The EU AI Act classifies AI systems into four risk categories: prohibited AI practices, high-risk AI systems, systems with limited risk (transparency risk), and systems with minimal risk. The higher the risk, the stricter the requirements.<\/p>\n
Classification is based on the potential harm an AI system can cause to fundamental rights, safety, or societal values:<\/p>\n
Important: Regardless of risk category, all companies are obliged to ensure AI competence in accordance with Art. 4 of the EU AI Act. This means employees must be enabled to understand and use AI systems appropriately. To build AI competence within your organisation<\/a>, structured training measures are a central building block.<\/p>\n Providers and deployers of high-risk AI systems must meet a wide range of technical and organisational requirements, including risk management, data documentation, transparency, human oversight, and registration in an EU database.<\/p>\n The obligations for providers of high-risk AI systems include, among others:<\/p>\n Deployers of high-risk AI systems bear additional obligations: they must ensure the system is only used for its intended purpose, train employees accordingly, and \u2014 in certain use cases, such as in the area of public services \u2014 carry out a fundamental rights impact assessment under Art. 27. If an employer deploys a high-risk AI system in the workplace, information obligations towards affected employees must also be fulfilled. An ISO 42001 audit<\/a> can help companies systematically align their processes with these requirements.<\/p>\n The EU AI Act entered into force on 1 August 2024 and is being applied in stages. Most core obligations \u2014 in particular those for high-risk AI systems \u2014 will apply in full from August 2026. Prohibited AI practices had to be discontinued by February 2025 at the latest.<\/p>\n The most important deadlines at a glance:<\/p>\n For companies, this means: the time to prepare is short. If you have not yet taken stock of your AI systems, defined responsibilities, or initiated training measures, you should act now to avoid fines and reputational damage.<\/p>\n Practical implementation of the EU AI Act begins with a systematic inventory of all AI systems in use, followed by risk classification, assignment of responsibilities, establishment of an AI management system, and targeted training of employees.<\/p>\n A proven approach is structured around three phases:<\/p>\n The first step is to inventory all AI systems currently used or planned within the company and classify them according to the risk categories of the EU AI Act. At the same time, roles and responsibilities should be defined \u2014 for example, by appointing an AI compliance officer. A skills gap analysis helps identify the training needs of the workforce.<\/p>\n In this phase, processes and documentation for high-risk AI systems are established: risk management, technical documentation, data governance, and human oversight mechanisms. It is advisable to introduce an AI management system \u2014 for example, based on ISO\/IEC 42001 \u2014 which provides a structured foundation for governance, transparency, and continuous improvement. Training programmes are rolled out, and the works council is involved in the process where relevant.<\/p>\n Compliance is not a one-time project but an ongoing process. Regular internal audits, updates to documentation when systems change, and transparent change management ensure lasting conformity. Companies that establish a culture of continuous learning are better equipped to respond to new regulatory requirements.<\/p>\n Violations of the EU AI Act can be sanctioned with fines of up to 35 million euros or 7 percent of global annual turnover, whichever is higher. The level of the penalty depends on the nature and severity of the violation.<\/p>\n The EU AI Act provides for a tiered sanctioning system:<\/p>\n For small and medium-sized enterprises and start-ups, the regulation provides for proportionate fine frameworks. Nevertheless, smaller companies should also take compliance seriously \u2014 because in addition to financial penalties, reputational damage, withdrawal of market access, and civil liability claims are also at stake. Early investment in AI governance and compliance<\/a> is therefore economically sound.<\/p>\n We at mITSM offer practical training programmes that prepare companies and professionals specifically for the requirements of the EU AI Act. Our training portfolio covers all relevant areas:<\/p>\nWhat specific obligations apply to high-risk AI systems?<\/h2>\n
\n
By when must companies implement the EU AI Act?<\/h2>\n
\n
How does practical implementation of the EU AI Act work within a company?<\/h2>\n
Phase 1: Orientation and inventory (0 to 6 months)<\/h3>\n
Phase 2: Building structures and scaling (6 to 18 months)<\/h3>\n
Phase 3: Ongoing compliance and innovation (from 18 months)<\/h3>\n
What penalties are imposed for violations of the EU AI Act?<\/h2>\n
\n
How mITSM supports you with EU AI Act implementation<\/h2>\n