{"id":73422,"date":"2026-08-05T22:33:27","date_gmt":"2026-08-05T20:33:27","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73422"},"modified":"2026-08-05T22:33:27","modified_gmt":"2026-08-05T20:33:27","slug":"eu-ai-act-umsetzung","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/ki-governance\/eu-ai-act-umsetzung\/","title":{"rendered":"Implement the EU AI Act in practice"},"content":{"rendered":"
\"KI-Governance<\/span>

\u2190 AI governance<\/a><\/p>

Implement the EU AI Act in practice<\/h1>

Inventory AI use, structure roles and risks and implement effective governance into operations.<\/strong><\/p><\/div><\/div>\n\n\n\n

The EU AI Act organizes obligations by role, AI system, purpose and risk. Companies should therefore first record their use of AI, delineate provider and deployer roles and check prohibited, transparent and potentially high-risk use cases. This results in governance, documentation, human supervision and technical and organisational measures. Whether a specific system falls within the scope of application or is considered high-risk must be assessed on a case-by-case basis.<\/p>\n<\/div>\n\n\n

Background<\/h2>\n\n
\"KI-Governance<\/figure>
\n

AI is often introduced decentrally: through specialist applications, embedded assistants, in-house developments or external services. Without a reliable inventory, the purpose, data use, those responsible and the models used remain unclear. This makes both risk decisions and controlled operations more difficult.<\/p>\n<\/div><\/div>\n\n\n\n

The essential task is therefore not to pre-emptively assign every AI tool to a category. What is crucial is a repeatable process that captures AI systems before deployment, documents the company's role and context of use, assesses risks, controls approvals and tracks changes in operations.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n

Regulation (EU) 2024\/1689 (AI Act) takes a risk-based approach. It contains, among other things, bans on certain practices, requirements for high-risk AI, transparency obligations for certain systems and rules for providers of general-purpose AI models (GPAI). The specific scope of duties depends not only on the model name used, but also on the role, purpose and context of use, among other things.<\/p>\n\n\n\n

Provider<\/strong> develop an AI system or have it developed and market it under their own name or brand or put it into operation. Deployer<\/strong> use an AI system under their supervision; certain private, non-professional uses are excluded. Roles can vary along a supply chain and must be checked per system.<\/p>\n\n\n\n

For high-risk AI, the AI Act calls for a system of risk management, data governance, technical documentation, logging, transparency and information for deployers, human oversight, accuracy, robustness and cybersecurity. These requirements are not a checklist for every AI system; they concern high-risk AI and must be interpreted in terms of the specific distribution of roles.<\/p>\n\n\n\n

The AI Act stands alongside the GDPR. If personal data is processed, the requirements of the GDPR remain independently applicable. The page GDPR in IT and cloud<\/a> deepens roles, access, protection, deletion and verifiability.<\/p>\n<\/div>\n\n\n

AI Act timeline<\/h2>\n\n
\"Abstrakte<\/figure>
\n
\n\n
1 August 2024<\/summary>

Regulatory status:<\/strong> The AI Act enters into force.<\/p><\/details>\n\n

2 February 2025<\/summary>

Regulatory status:<\/strong> Bans, definitions and measures for sufficient AI competence apply.<\/p><\/details>\n\n

2 August 2025<\/summary>

Regulatory status:<\/strong> Governance rules and GPAI obligations apply.<\/p><\/details>\n\n

2 August 2026<\/summary>

Regulatory status:<\/strong> Many other regulations and the transparency obligations under Article 50 apply.<\/p><\/details>\n\n

2 December 2027<\/summary>

Regulatory status:<\/strong> Rules for high-risk AI in accordance with Article 6 paragraph 2 in conjunction with Annex III apply.<\/p><\/details>\n\n

2 August 2028<\/summary>

Regulatory status:<\/strong> Rules for product-integrated high-risk AI in accordance with Article 6 Paragraph 1 in conjunction with Annex I apply.<\/p><\/details>\n<\/div>\n\n\n\n\n

The current amending regulation (EU) 2026\/1744 determines the application dates mentioned for high-risk AI. When making specific decisions, the current consolidated legal status must be checked.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Role and Risk Triage<\/h2>\n\n
\n\n
In what role does the organisation act?<\/summary>

First classification:<\/strong> Provider, deployer, importer or dealer must be checked based on the specific system and supply chain.<\/p><\/details>\n\n

What risk category is considered?<\/summary>

First classification:<\/strong> First check for prohibited practices, transparency requirements, GPAI reference and possible high-risk AI.<\/p><\/details>\n\n

What follows from triage?<\/summary>

First classification:<\/strong> Document low-risk or other cases; Deepen relevant cases with legal, compliance, data protection and specialist functions.<\/p><\/details>\n<\/div>\n\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n
\"Abstrakte<\/figure>
\n