At a glance
- Prohibited AI practices have been banned since February 2025; obligations for providers of general-purpose AI models have applied since August 2025.
- Transparency obligations – such as labelling chatbots and AI-generated content – have applied since 2 August 2026.
- The obligations for high-risk AI were postponed in 2026: to 2 December 2027 and 2 August 2028 respectively.
- Most companies are “deployers”: they need an AI inventory, clear rules and trained staff.
The timetable after the 2026 Omnibus
The EU AI Act (EU 2024/1689) entered into force on 1 August 2024. With the “Digital Omnibus” on AI, the EU mainly postponed the deadlines for high-risk systems in summer 2026. The current status:
| Since / from | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (e.g. social scoring, emotion recognition in the workplace); AI literacy of staff |
| 2 August 2025 | Obligations for providers of general-purpose AI models (GPAI), supervisory structures, penalties |
| 2 August 2026 | Transparency obligations under Art. 50: labelling chatbots, deepfakes and AI-generated content |
| 2 December 2027 | High-risk AI under Annex III, e.g. in recruitment, creditworthiness assessment, critical infrastructure |
| 2 August 2028 | High-risk AI as part of regulated products under Annex I, e.g. machinery and medical devices |
Important: the postponement only affects the high-risk obligations. Prohibitions, GPAI obligations and transparency obligations apply unchanged – as does the GDPR for any AI that processes personal data.
Provider or deployer?
The regulation distinguishes primarily between providers, who develop an AI system or place it on the market under their own name, and deployers, who use it under their own authority. Most companies are deployers: they use an assistant in the office, automate documents or analyse data.
Caution with in-house developments: anyone who substantially modifies a model, offers it under their own brand or uses it for a high-risk purpose can become a provider themselves – with considerably more obligations.
What companies should do now
- Create an AI inventoryWhich AI systems are in use – officially and unofficially? Shadow AI, i.e. private accounts with chat services, is the biggest blind spot in many companies.
- Classify the riskAssign each system to a risk class: prohibited, high risk, transparency obligation or minimal risk. Identify high-risk applications early – 2027 will come sooner than you think.
- Set rulesAn AI policy clarifies which tools are permitted, which data may be entered and who approves. Data protection and information security belong in it from the start.
- Build literacyStaff who work with AI need a basic understanding of its possibilities, limits and risks – appropriate to their role.
- Ensure transparencyMake chatbots recognisable as such and label AI-generated content where the regulation requires it.
When in-house AI makes sense
Not all AI has to come from the cloud. Powerful open language models now run on your own servers or directly on the device. This pays off above all when:
- confidential data is processed – contracts, design data, HR or health data – and not a single byte should leave the company,
- availability matters, even with a poor or no network connection, for example in production, logistics or field service,
- costs should be predictable because usage is high and steady,
- traceability is required: model version, data and logs remain under your control.
Cloud services remain the better choice if you want to get started quickly, usage fluctuates or you need the most powerful models available. A combination often makes sense: sensitive tasks locally, everything else in the cloud – via a common interface.
In our own research, certified by the BSFZ (German Research Allowance Certification Office), we are working on systems that work reliably even offline – including AI functions directly on the device. This experience feeds into our client projects.
Frequently asked questions
Do we have to report our use of ChatGPT & co.?
No, there is no reporting obligation for deployers of ordinary AI applications. You should, however, document and regulate their use and train your staff – and observe the GDPR.
What happens in the event of infringements?
Fines are tiered: up to €35 million or 7 % of worldwide annual turnover for prohibited practices, up to €15 million or 3 % for other obligations. For SMEs, the lower amount applies in each case.
Is local AI automatically GDPR-compliant?
No, but many things become easier: there is no transfer to third parties and no third-country issue. You still need to regulate purpose limitation, deletion concepts and access rights.
Note: This article provides a specialist overview (as of October 2026) and does not replace legal advice. For a binding assessment of your company, we are happy to work with your legal advisers.
Related service