EU AI Act.
Your obligation.
Our implementation.

Yes. The AI Regulation applies to all companies that use AI systems in the EU or make them available to EU users — regardless of company size or location. SMEs with high-risk systems have the same obligations as corporations, just with longer transition periods. Companies with fewer than 50 employees are exempt from certain transparency obligations, but not from prohibitions or high-risk requirements.

High-risk systems are those that influence decisions in sensitive areas: personnel selection (CV screening, performance evaluation), credit lending, medical diagnosis, biometric identification, critical infrastructure. If your AI system evaluates people or makes decisions with significant impacts, it is likely high-risk. We conduct a free initial risk classification.

Since 2 February 2025 prohibited AI practices are banned (e.g. social scoring, mass biometric surveillance). Since 2 August 2025 the obligations for providers of general-purpose AI models apply. Since 2 August 2026 most remaining obligations apply: the transparency obligations — users must be able to tell they are interacting with AI — and, according to the Regulation, the requirements for high-risk systems under Annex III with technical documentation, conformity assessment and logging. For high-risk systems the EU has discussed a postponement as part of the "digital omnibus"; we check which date applies to your system case by case. As of October 2026.

Violations of prohibitions: up to €35 million or 7% of global annual revenue. Violations of other obligations: up to €15 million or 3% of revenue. False information to authorities: up to €7.5 million or 1.5% of revenue. Market surveillance authorities can additionally order distribution stops and recalls.

No. The EU AI Act distinguishes between provider and deployer. As a company integrating an LLM system into your business processes, you are the deployer and have your own obligations — regardless of whether OpenAI or Anthropic as provider is compliant. Deployers are liable for the specific deployment context, data quality and monitoring of the system.

For an SME with one or two medium-risk AI systems: 4–8 weeks for full compliance including documentation, technical measures and audit trail. High-risk systems with conformity assessment: 8–16 weeks. We start with a 2-day compliance assessment that immediately delivers a concrete action plan.