Question 1

Does the EU AI Act also apply to small and medium enterprises?

Accepted Answer

Yes. The AI Regulation applies to all companies that use AI systems in the EU or make them available to EU users — regardless of company size or location. SMEs with high-risk systems have the same obligations as corporations, just with longer transition periods. Companies with fewer than 50 employees are exempt from certain transparency obligations, but not from prohibitions or high-risk requirements.

Question 2

What is a "high-risk AI system" and am I affected?

Accepted Answer

High-risk systems are those that influence decisions in sensitive areas: personnel selection (CV screening, performance evaluation), credit lending, medical diagnosis, biometric identification, critical infrastructure. If your AI system evaluates people or makes decisions with significant impacts, it is likely high-risk. We conduct a free initial risk classification.

Question 3

What specific technical measures do I need to implement and by when?

Accepted Answer

Since 2 February 2025 prohibited AI practices are banned (e.g. social scoring, mass biometric surveillance). Since 2 August 2025 the obligations for providers of general-purpose AI models apply. Since 2 August 2026 most remaining obligations apply: the transparency obligations — users must be able to tell they are interacting with AI — and, according to the Regulation, the requirements for high-risk systems under Annex III with technical documentation, conformity assessment and logging. For high-risk systems the EU has discussed a postponement as part of the "digital omnibus"; we check which date applies to your system case by case. As of October 2026.

Question 4

What does non-compliance with the EU AI Act cost?

Accepted Answer

Violations of prohibitions: up to €35 million or 7% of global annual revenue. Violations of other obligations: up to €15 million or 3% of revenue. False information to authorities: up to €7.5 million or 1.5% of revenue. Market surveillance authorities can additionally order distribution stops and recalls.

Question 5

Is it sufficient if my AI provider (OpenAI, Anthropic) is compliant?

Accepted Answer

No. The EU AI Act distinguishes between provider and deployer. As a company integrating an LLM system into your business processes, you are the deployer and have your own obligations — regardless of whether OpenAI or Anthropic as provider is compliant. Deployers are liable for the specific deployment context, data quality and monitoring of the system.

Question 6

How long does compliance implementation take for a typical SME?

Accepted Answer

For an SME with one or two medium-risk AI systems: 4–8 weeks for full compliance including documentation, technical measures and audit trail. High-risk systems with conformity assessment: 8–16 weeks. We start with a 2-day compliance assessment that immediately delivers a concrete action plan.

EU AI Act.
Your obligation.
Our implementation.

Where does your AI system sit?

Unacceptable risk

High risk

Limited risk

Minimal risk

What that looks like in practice

From assessment to production.

Risk Classification

Technical Documentation

Audit Trail & Logging

Monitoring Dashboard

Human Oversight

Transparency Layer

The deadlines are already running.

EU AI Act entered into force

Prohibitions apply

General-purpose AI models

Transparency and high-risk obligations apply

High-risk AI in regulated products

From assessment to full compliance.

Your systems stop copying data to each other

Build compliant — from day one.

Frequently asked questions about EU AI Act compliance.

How we think about this

Can your process be automated?

EU AI Act.Your obligation.Our implementation.