EU AI Act Compliance: What German Businesses Need to Know Now
EU AI ActRegulation (EU) 2024/1689The EU's regulation on artificial intelligence. It sorts AI systems into risk tiers — prohibited, high-risk, limited-risk and minimal-risk — and attaches different duties to the provider that builds a system and the deployer that uses it. It entered into force on 1 August 2024 and applies in stages; the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk stages later without changing the penalties. Article 99 leaves those at up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches, including the high-risk and transparency duties.Applies toProviders and deployers of AI systems placed on or used in the EU market.Next dateDecember 2, 2026 — Article 50(2) marking of AI-generated content, for systems already on the market on 2 August 2026Read the source text (opens in a new tab)General information about the instrument named, not legal advice. compliance stopped being a planning exercise on 2 August 2026. Enforcement of the general-purpose AI (GPAI) rules is now live, and it reaches far beyond the hyperscalers: OpenAI and Google are not the only companies in scope. If your business fine-tunes, wraps, or embeds a GPAI model into anything operational, the obligations land on you and German enterprise buyers are already asking for proof.
Published: August 2026 · Author: Daniella Esi Darlington · Reading time: ~9 minutes
Disclosure: This article was drafted using generative AI assistance and subsequently edited, verified, and expanded by human legal and tech policy specialists. The organizational case study presented below is a composite hypothetical scenario designed to illustrate compliance risks.
In brief
Enforcement is live: since 2 August 2026 the EU AI Office has been able to request documentation, run audits, order remedies, and pull models from the market. Most German enterprises are in scope, because fine-tuning, wrapping, or embedding a general-purpose AI model makes you a downstream provider rather than a bystander to the foundation model vendors. Penalties reach fifteen million Euros or three percent of global turnover, rising to seven percent for prohibited practices. Informal Confluence notes will not satisfy Articles 9 to 15, which demand structured, version-controlled documentation. Commercial enforcement also arrives first, as German enterprise buyers now require proof of compliance during procurement long before a regulator ever calls. The reassuring part is that a defensible baseline takes roughly four weeks rather than a multi-year restructuring programme.
In this article: we look at what the EU AI Act actually regulates, what changed on 2 August 2026, and how the rules land on a mid-market firm. From there we work through whether your organisation is in scope, the three most common compliance gaps, a practical thirty-day plan, and how Alleina AI supports your governance strategy, closing with related reading and a frequently asked questions section.
What the EU AI Act covers
The European Union Artificial Intelligence Act provides a comprehensive, risk-based framework regulating artificial intelligence across the European market. It categorizes AI applications into four primary risk tiers, summarised below.
| Risk tier | What it covers | Obligation |
|---|---|---|
| Prohibited | Unacceptable threats such as social scoring or covert behavioural manipulation | Entirely banned |
| High risk | Sensitive domains: credit scoring, hiring decisions, medical devices, critical infrastructure | Full conformity duties under Articles 9–15 |
| Limited risk | Chatbots, synthetic media | Specific transparency and disclosure measures |
| Minimal risk | Standard applications such as spam filters and video games | Unregulated |
What counts as a general-purpose AI model?
A General-Purpose AI model is defined as an AI model, such as a large language model, trained on broad data that exhibits significant generality and is capable of performing a wide range of distinct tasks, regardless of how it is placed on the market. Because downstream applications build directly on top of these models, any fundamental flaw or lack of transparency at the core level cascades down to every single product built on that foundation.
What changed on 2 August 2026?
The AI Act originally entered into force in August 2024 with a phased implementation schedule. On 2 August 2026, the formal enforcement grace period for general-purpose AI rules concluded. This marks the transition from policy preparation to active legal oversight.
Under direct enforcement, the European AI Office and national market surveillance authorities — coordinating with German sectoral regulators under the national AI Implementing Act — can now actively request compliance documentation, conduct formal audits, order corrective remedies, and pull non-compliant models off the market entirely. The enforceable obligations that accompany this require general-purpose AI providers to maintain up-to-date technical documentation covering training details and evaluations, to strictly respect copyright laws, to publish comprehensive summaries of training content, and to provide transparent information to all downstream integrators.
Case scenario: how a mid-market firm triggers GPAI and high-risk rules
To understand how these legal obligations land on daily engineering choices, consider the composite example of KruppLogistik AG, a hypothetical mid-sized logistics firm based in North Rhine-Westphalia generating 200 million Euros in annual revenue.
The company decides to build an internal system to evaluate commercial supplier creditworthiness and automate vendor contract reviews. Rather than training a model from scratch, their engineering team takes an open-weights foundation model, fine-tunes it using forty thousand historical vendor records, and exposes it internally via an API copilot.
Through this initiative, compliance gaps emerge immediately. By fine-tuning a general-purpose model and integrating it into an automated workflow that directly evaluates financial creditworthiness, KruppLogistik assumes full legal duties as a downstream provider under the Act, as financial risk assessments fall under high-risk applications.
Furthermore, when an enterprise client requests proof of compliance during vendor due diligence, the team points to scattered developer notes in Confluence. These informal developer entries fail to satisfy statutory standards required for risk management and technical documentation. Consequently, lacking a structured evidence pack, their deal pipeline stalls while legal counsel rushes to complete retrospective assessments under live enforcement standards.
Would your team pass that same due-diligence request today?
Run your first structured AI risk assessment in minutes.
Are you in scope? Common misconceptions
The most common misconception among German enterprise engineering teams is assuming that general-purpose AI rules strictly target foundation model creators. In reality, your organization is directly in scope if you fine-tune or modify a model and deploy it commercially or operationally in regulated domains. The same applies if you embed general-purpose AI into your product stack for automated scoring, customer support copilots, or document intelligence. Even as a pure downstream user you are affected, because you require upstream transparency documentation from your vendors in order to complete your own required conformity files.
Furthermore, operating in regulated markets amplifies this responsibility. BaFin has explicitly confirmed that AI Act obligations sit directly on top of existing operational and risk frameworks such as MaRisk, BAIT, VAIT, and DORADigital Operational Resilience Act — Regulation (EU) 2022/2554The EU regulation on digital operational resilience in the financial sector. It covers ICT risk management, incident classification and reporting, resilience testing, and oversight of third-party ICT providers — bringing those providers into a supervisory perimeter that previously stopped at the financial entity. BaFin's guidance of 18 December 2025 addresses entities subject to Articles 5 to 15 of DORA and places AI systems inside that existing ICT framework rather than a separate regime, examining ICT risk across the whole AI lifecycle — data acquisition, model development and provision, ongoing operation and retirement — with particular weight on third-party ICT risk.Applies toFinancial entities in the EU, and the ICT providers designated as critical to them.Read the source text (opens in a new tab)General information about the instrument named, not legal advice. — see our guide to BaFin and MaRisk AI compliance. Vendor questionnaires from banks and insurers increasingly demand explicit, verifiable proof of AI Act compliance before contracts can be signed.
The three most common EU AI Act compliance gaps
An unmapped AI inventory and widespread shadow AI
Many organizations lack a centralized catalog of their AI pipelines, third-party vendor APIs, and departmental tools. Without a comprehensive catalog, an enterprise cannot accurately classify its risk exposure, which is the necessary first step toward full compliance.
Confusing informal developer documentation with statutory evidence
Across engineering teams in Germany, technical notes are traditionally stored in wikis like Atlassian Confluence. While convenient for daily sprint planning, informal wiki entries do not constitute audit-ready legal evidence. Under Articles 9 through 15 of the AI Act, technical documentation must be structured, version-controlled, and mapped directly to statutory mandates, as set out below.
| Article | What you must be able to evidence |
|---|---|
| Article 9 | A continuous risk management system |
| Article 10 | Data governance and training set audits |
| Article 11 | Formal technical documentation |
| Article 12 | Automated event logging |
| Article 13 | Transparency protocols |
| Article 14 | Human oversight measures |
| Article 15 | Robustness, cybersecurity, and accuracy metrics |
Waiting passively for regulatory inquiries
Commercial enforcement regularly precedes formal regulatory fines. Enterprise buyers in Germany now routinely include AI Act compliance verification in standard procurement contracts. Arriving at sales negotiations without audit-ready documentation threatens core revenue long before a regulatory supervisor ever reaches out.
Your 30-day EU AI Act compliance plan
Achieving compliance does not require multi-year enterprise restructuring, as a defensible baseline can be established over four structured weeks.
| Week | Focus | Deliverable |
|---|---|---|
| Week 1 | Inventory and classification — audit every active AI application, vendor tool, and embedded model across the organization | A centralized AI Risk Register with explicit tier classifications |
| Week 2 | Gap triage — benchmark existing technical documentation against Articles 9–15 legal standards | A Compliance Gap Matrix detailing missing controls and metrics |
| Week 3 | Evidence baseline — assemble versioned model cards, human-in-the-loop protocols, and transparency disclosures | Audit-ready evidence packs for key stakeholders |
| Week 4 | Operationalize governance — assign system governance roles, establish 72-hour incident reporting, update vendor agreements | A sustainable operational governance framework |
During the first week, your team should focus on inventory and classification by auditing every active AI application, vendor tool, and embedded model across the organization, resulting in a centralized AI Risk Register with explicit tier classifications. In the second week, transition to gap triage by benchmarking existing technical documentation against Articles 9 through 15 legal standards, creating a Compliance Gap Matrix that details missing controls and metrics. By the third week, build an evidence baseline by assembling versioned model cards, human-in-the-loop protocols, and transparency disclosures into audit-ready evidence packs for key stakeholders. Finally, during the fourth week, operationalize governance by assigning clear system governance roles, establishing seventy-two-hour incident reporting workflows, and updating vendor agreements into a sustainable operational framework.
How Alleina AI supports your governance strategy
Alleina AI turns EU AI Act compliance into structured software workflows tailored for European enterprises. Guided workflows classify your AI applications against EU AI Act risk tiers within minutes, while an automated documentation engine generates versioned, audit-ready technical files mapped directly to Articles 9 through 15. The platform enables continuous monitoring to track model performance, drift, and bias metrics over time, alongside one-click export functions for structured evidence packs designed for regulators, external auditors, or enterprise buyers. Built specifically for European compliance, the platform provides native support for the EU AI Act, GDPRRegulation (EU) 2016/679 — in German, the DSGVOThe EU's general data protection regulation. Alongside lawful basis, purpose limitation and data-subject rights, Article 35 attaches a data protection impact assessment to processing likely to result in a high risk — which is the provision an AI project meets most often, and the one that overlaps an AI Act risk assessment without being the same document.Applies toAny controller or processor handling personal data of people in the EU.Read the source text (opens in a new tab)General information about the instrument named, not legal advice. requirements, and German sectoral frameworks including BaFin and MaRisk.
Enforcement is already live
Don’t let procurement stall your pipeline.
Join the European enterprises building audit-ready AI governance on Alleina AI. Create your account and complete your first structured risk assessment today.
Built for the EU AI Act, GDPR, BaFin and MaRisk
Prefer to talk it through first? Schedule a technical review with our compliance team →
Related reading on EU AI Act compliance
If you want to go deeper, our EU AI Act Compliance Checklist for High-Risk AI Systems works through the conformity requirements in detail, while German AI Regulation: Navigating BaFin, DORA, and the KI-MIG explains how the national picture fits together. For the inventory problem described above, see Shadow AI: The Hidden Risk in Your Organization, and for regulated financial services specifically, EU AI Act: What Financial Institutions Need to Know Before August 2026. You can also read more about the EU AI Act Readiness Platform itself.
Frequently asked questions
Does the EU AI Act apply to my company if we only use a third-party AI model?
Yes, in most cases. If you fine-tune or modify a model and deploy it commercially, or embed general-purpose AI into your product for automated scoring, customer support copilots, or document intelligence, you are directly in scope. Even as a pure downstream user you need upstream transparency documentation from your vendors to complete your own conformity files.
What are the penalties for EU AI Act non-compliance?
Penalties reach up to fifteen million Euros or three percent of global annual turnover. Violations involving prohibited practices climb to up to seven percent.
What exactly changed on 2 August 2026?
The formal enforcement grace period for general-purpose AI rules concluded. The European AI Office and national market surveillance authorities can now request compliance documentation, conduct formal audits, order corrective remedies, and pull non-compliant models off the market.
Is our Confluence documentation enough to prove compliance?
No. Informal wiki entries do not constitute audit-ready legal evidence. Under Articles 9 through 15, technical documentation must be structured, version-controlled, and mapped directly to statutory mandates.
How do EU AI Act obligations interact with BaFin and MaRisk?
BaFin has explicitly confirmed that AI Act obligations sit directly on top of existing operational and risk frameworks such as MaRisk, BAIT, VAIT, and DORA. They are additive, not alternative.
How long does it take to reach EU AI Act compliance?
Roughly four weeks. The first week covers inventory and classification, the second gap triage, the third the evidence baseline, and the fourth operationalizing governance.
Disclaimer: This article provides general informational commentary on the EU AI Act and does not constitute formal legal advice. Organizations should consult qualified legal counsel regarding their specific statutory obligations.