EU AI Act fully in force: What now becomes a priority for executives

The EU AI Act has been fully applicable since August 2, 2026. What was phased in over two years is now enforceable law: the obligations for high-risk systems are applicable, national supervisory authorities have been designated, and the full penalty framework is active: up to 35 million euros or 7% of total worldwide annual turnover for prohibited practices, and up to 15 million euros or 3% for violations of other obligations. Furthermore, since February 2025, the AI Literacy requirement according to Article 4: Anyone using AI must ensure the competence of their employees – and document it.

Why this is a management priority

AI compliance is not a task that can be delegated to the IT department. The management bears the legal compliance obligationShe must ensure that the company complies with applicable law and is liable to the company if organizational duties are breached (§ 43 GmbHG, § 93 AktG). Anyone who does not know today which AI systems are running within their own organization has a governance problem, not a technical problem. In parallel, the implementation of NIS2 increases the personal responsibility of executive management for cyber risks – the direction of the legislator is clear.

What user companies must do now

Most companies are not AI developers, but User – referred to as "Deployer" in the terminology of the law. Obligations still apply in this case:

• Demonstrate AI competence: Employees must understand the capabilities of the systems used, where their limits lie, and what the risks are. This must be established as a documented process, not as a one-time training session.
• Ensuring transparency: If a system interacts with humans (e.g., a chatbot on your website), this must be recognizable as an AI interaction.
• Maintain system registers Which AI systems are in use, in which risk class, and with which data? Without this overview, robust governance is impossible, as is providing a reliable response to a request for information from the supervisory authority.
• Organize human oversight: Who reviews AI results before they reach customers? For high-risk applications (such as AI in HR), human oversight is now a strict requirement under the EU AI Act.

Enforcement: What has changed since August 2nd

Supervisory authorities are issuing audit and information requests, and the grounds for fines are applicable. A transitional arrangement currently being discussed in Brussels ("Digital Omnibus") could extend certain high-risk deadlines. This has not been decided, and it does not change the core obligations for users (competence, transparency, registers). Those who start in an organized manner do not have to react – those who start disorganized react under time pressure.

Three upcoming steps

• Inventory: Which AI systems are in use, both officially and unofficially (see our guide on Shadow AI)? The system register is the foundation for any further measure.
• Categorize: What risk class do these systems have? Most office applications fall into "minimal". However, this must be formally documented, not assumed.
• Enablement: AI Literacy is mandatory and, at the same time, the most cost-effective opportunity to realize the productivity gains of AI in the first place.

Note: This article is not a substitute for legal advice. It serves as an initial orientation; the binding examination of your situation should be handled by experts.

← all guides