EU AI Act: Compliance for Companies in Germany

Core principle: duties by risk and role

The AI Act is based on risk. It has four tiers:

• Unacceptable risk (banned, Article 5): Examples are social scoring and tricks that exploit people's weak spots. Emotion recognition at work and in education is also banned, with exceptions for medical or safety reasons. So is untargeted scraping of face images to build databases. The Digital Omnibus added AI systems that create intimate images without consent ("nudifiers") or child sexual abuse material. The transition period for this runs until 2 December 2026.
• High risk: AI systems that are safety parts of regulated products (Annex I). Also systems in the areas listed in Annex III, such as hiring and HR, credit checks, education, critical infrastructure and biometrics.
• Limited risk (transparency duties, Article 50): Chatbots must say that they are AI. Deepfakes and some AI-written texts must be labeled.
• Minimal risk: For example spam filters or AI in video games. There are no special duties here beyond AI literacy.

The company's role matters just as much:

• Providers build an AI system or bring it to market under their own name. They carry the most duties.
• Deployers use an AI system under their own authority. This is the typical role of mid-sized companies.

If you make major changes to a high-risk system or sell it under your own name, you can become a provider under Article 25.

Timeline

The Digital Omnibus moved back the deadlines for high-risk systems. It got political agreement on 7 May 2026, Parliament's vote on 16 June 2026 and the Council's on 29 June 2026. It has been in force since 27 July 2026. The new dates are:

• Annex III: 2 December 2027 instead of 2 August 2026
• Annex I: 2 August 2028 instead of 2 August 2027

The transparency duties under Article 50, by contrast, have applied since 2 August 2026.

What deployers actually have to do

For most companies in Germany, these duties come first:

• AI literacy (Article 4): Providers and deployers must help staff who work with AI systems build AI skills. The Digital Omnibus softened the old duty to ensure a "sufficient level" of AI literacy. This duty has applied since February 2025, no matter the risk class. So it also covers chatbots and translation tools. Training based on each person's role is still the best way to meet it.
• Transparency (Article 50): Label chatbots that talk to customers. Disclose deepfakes that you create.
• Deployer duties for high-risk AI (Article 26): Use the system as its instructions say. Have skilled people oversee it. Control the input data and keep the logs it creates on its own. Tell affected staff before you use it at work. Report serious incidents.
• Fundamental rights impact assessment (Article 27): Public bodies need one. So do some private deployers, for example for credit checks or risk ratings in life and health insurance.

Providers of high-risk systems have more duties. Among other things, they must:

• run a risk management system and a quality management system
• prove data governance and keep technical documents
• ensure accuracy, robustness and cybersecurity (Article 15)
• pass a conformity assessment
• register the system in the EU database

Supervision and penalties in Germany

The German AI Market Surveillance and Innovation Promotion Act (KI-MIG) came into force on 29 July 2026. Since then, the Federal Network Agency (Bundesnetzagentur) has been Germany's market surveillance body. It is also the single point of contact and the place for complaints. It has its own independent chamber for AI market surveillance. It also runs an AI service desk and AI regulatory sandboxes. Existing sector regulators stay in charge of some areas.

Fines can reach:

• up to EUR 35 million or 7% of global annual turnover for banned practices
• up to EUR 15 million or 3% for breaches of most other duties

For SMEs, the lower amount applies in each case.

First steps

1. Build an AI inventory: List all AI systems you use or build. Include AI features in standard software and cloud services.
2. Classify: For each system, find the risk class and your role (provider or deployer). Write down why.
3. Rule out banned practices: Look very closely at emotion recognition in HR.
4. Build AI literacy you can prove: Run training based on roles and keep records.
5. Involve vendors: Ask providers for the instructions for use, proof of conformity and facts on data processing. Secure these in your contracts.
6. Set up governance: Assign roles and bring AI into your existing management systems. ISO/IEC 42001 offers a framework you can be certified against. It fits well with an ISMS under ISO/IEC 27001.

Conclusion

For most companies, AI Act compliance does not start with conformity assessments. It starts with a clean AI inventory, a well-argued classification and trained staff. SecTepe helps you build this base and align it with your ISMS and data protection.

Frequently asked questions

Does the AI Act apply if we only use ChatGPT or Copilot?

Yes, as a deployer. Then your main duties are usually to support AI literacy and maybe transparency. The high-risk rules usually do not apply.

Is AI in recruiting automatically high-risk?

AI systems that select, filter or rate job applications are listed by name in Annex III. So in principle they are high-risk. The deployer duties under Article 26 then apply.