The EU AI Act for mid-sized companies: don't wait for the high-risk deadline.

The AI Act entered into force on August 1, 2024 and applies in stages. Since February 2, 2025, certain practices are banned, and Article 4 requires AI literacy among staff. Since August 2, 2025, obligations apply to providers of general-purpose AI models. They usually fall on the model providers, not their users. Since August 2, 2026, the regulation applies in general, including the transparency obligations under Article 50. The amending Regulation (EU) 2026/1744, known as the AI Omnibus, has been in force since July 27, 2026. It moves the high-risk obligations to December 2, 2027 (August 2, 2028 for AI in regulated products). From December 2, 2026, AI systems that generate intimate images of real people without consent or child sexual abuse material are also banned. So AI literacy and transparency apply today; high-risk obligations only from December 2027.

The regulation separates providers, who develop an AI system and place it on the market or put it into service under their own name, from deployers, who use it under their own authority. Most companies and agencies are deployers. If you offer a system under your own name or substantially modify a high-risk system, you can become a provider yourself. Next comes the classification of each application: prohibited practices, high-risk systems (for example in recruiting or credit scoring), systems with transparency obligations, and minimal-risk systems. The AI Act does not generally require deployers to keep a register of all applications. Without such an overview, though, none of these questions can be answered. It should also cover AI features in standard software and chat services that employees use on their own.

Article 4 affects every company that uses AI, regardless of risk class. Since the July 2026 amendment, they must take measures that support the development of AI literacy among their staff. They do not have to guarantee a specific level for each person. The duty remains, but it asks for measures rather than a provable result. At SUMAX we built a training program around real tasks from each team's own work, and we rewrote the role descriptions. Whoever passes on an AI result unchecked is just forwarding output. Generic examples don't show anyone where errors arise in their own workflow.

For deployers, two transparency duties in Article 50(4) matter most. Deepfakes, meaning AI-generated or manipulated images, audio and video that falsely appear authentic, must be clearly labeled. AI-generated text that informs the public on matters of public interest must be disclosed. That duty does not apply if a person has reviewed the content and someone holds editorial responsibility for the publication. According to the Commission, public health counts as such a matter, and a spell check is not enough of a review. Before approval, we already check content for healthcare clients against German health advertising law, the Heilmittelwerbegesetz, whether a person or a model wrote the draft. If a draft breaks a rule, it goes back. The GDPR still applies alongside the AI Act.

Governance includes money. At SUMAX every AI call from our own applications runs through a dedicated layer between the applications and the AI models and is logged with its cost. Roles and permissions set who may use which model and which data. Budgets cap the spend. The same layer lets us switch models without rebuilding the applications. The foundation for everyone came first: users, permissions and access, with security built in from the start. Tools for individual tasks came after that.

A checklist for leadership, not legal advice. One: is it clear for each application whether the company is a deployer or a provider? Two: is there an overview with purpose, data, role and risk class, including AI in standard software and chat services? Three: does the team learn on the tasks whose results it later reviews? Four: does someone check before publishing whether a deepfake needs a label or AI-generated text needs disclosure? Five: is it settled who may use which model and which data, and what each application costs? Every no is an open item. Classifying a specific system is a job for IT law specialists.