The EU AI Act in the Mittelstand: What Has Applied Since August 2026 — and What’s Still to Come

The EU AI Act has caused uncertainty ever since it took effect — mainly because it doesn’t apply all at once, but in stages. On top of that, the timeline was changed after the fact. Anyone relying on information from 2024 is working with the wrong deadlines. This article sets out where things stand as of September 2026.

The current timeline

The regulation took effect on August 1, 2024. Its obligations apply in stages:

• Since February 2, 2025: the prohibited AI practices apply, along with the AI literacy obligation under Article 4.
• Since August 2, 2025: the obligations for providers of general-purpose AI models (GPAI), along with the governance and penalty provisions.
• Since August 2, 2026: the transparency obligations under Article 50.
• From December 2, 2027: the full requirements for high-risk systems under Annex III.
• From August 2, 2028: the requirements for high-risk systems under Annex I — that is, AI embedded in products already subject to regulation.

The last two dates are what’s actually newsworthy here: August 2026 and August 2027 were originally planned. They were pushed back through the amendment package known as the “AI Omnibus,” because the technical standards companies are meant to rely on aren’t finished yet. The Commission’s reasoning: rules should take effect once companies actually have the tools to implement them.

For the Mittelstand, that means more time for the most demanding part — but it’s not an all-clear, because the obligations already in force affect far more companies than the high-risk rules do.

Provider or deployer? The fork in the road

The AI Act distinguishes mainly between two roles. A provider is whoever develops an AI system and places it on the market under their own name. A deployer is whoever uses such a system in the course of their own activities.

The typical Mittelstand company using an AI platform is a deployer. The obligations in this role are considerably lighter. But caution is warranted: anyone who substantially modifies a purchased system, or redistributes it under their own name, can slip into the provider role. Anyone offering an AI assistant to customers through their own portal, for instance, should settle this question before going live.

What deployers must actually comply with today

Prohibited practices

Certain applications have been banned since February 2025. Two are particularly relevant for companies: emotion recognition in the workplace, and systems that socially score people based on their behavior. Anyone considering software that measures employees’ mood or attention should look very closely here. Exceptions exist only in narrowly defined cases, such as for safety reasons.

AI literacy under Article 4

This obligation is often overlooked, even though it applies to virtually every company that uses AI. It requires that employees using AI systems on the company’s behalf have adequate competence to do so — measured against their prior training, their role, and the context of use.

There’s no prescribed certificate and no set number of hours. What matters is that people understand what the system can do, where its limits lie, what data they’re allowed to feed into it, and that results need to be checked. A short, hands-on training session built around your own use case makes sense — along with documentation that it took place. That documentation takes ten minutes and, if it ever comes to it, is your evidence.

Transparency obligations under Article 50

The disclosure obligations have applied since August 2026. Two points matter for deployers. First: when people interact with an AI system, they need to know it — unless it’s obvious. So a chatbot on your website needs a notice. Second: anyone publishing so-called deepfakes, or artificially generated or altered content, must label it as such. The same applies to text intended to inform the public, with exceptions for editorially reviewed content, for example.

In practice, that means: a notice on the chatbot, an internal rule for handling AI-generated images in marketing, and a deliberate decision on how you handle AI assistance in published text.

What’s coming for high-risk users

The demanding obligations — risk management, data quality, technical documentation, human oversight, logging, conformity assessment — apply to high-risk systems. For the Mittelstand, Annex III is the one that matters most. It covers, among other things, AI systems used in an employment context: in recruitment, promotion decisions, or performance evaluation.

So anyone considering AI-assisted pre-screening of applications should know that, from December 2027, this use case falls into the highest regulatory tier. That’s not a reason to avoid it — but it is a reason to build it from the start so that human decision-making, traceability, and logging are all in place.

An assistant that drafts text, summarizes information, or searches documents, by contrast, is generally not a high-risk system. The difference lies in the effect on decisions, not in the technology.

How this relates to the GDPR

The AI Act doesn’t replace the GDPR — it applies alongside it. As soon as personal data is processed — and that’s the case with customer emails, job applications, or personnel files — both frameworks apply at the same time. In practice, the GDPR often produces the more concrete requirements: legal basis, purpose limitation, a data processing agreement, a deletion concept, a record of processing activities.

Anyone who already has their data protection management under control has done the larger part of the work already.

A checklist for the coming weeks

• Record which AI systems are actually being used in the company — including the ones nobody signed off on.
• For each system, assign your role: deployer or provider.
• Check whether a given application falls into the employment context or another Annex III area.
• Set out a short usage policy: what data may go in, what may not, and what needs to be checked.
• Run a hands-on training session and document it.
• For each system, clarify the hosting location and the data processing agreement.
• Add the chatbot notice and the rule for labeling AI-generated content.

This isn’t a months-long compliance project. For a mid-sized company, most of it can be done in a few days once someone takes responsibility for it.

Note

This article reflects the state of affairs as of September 2026 and does not replace legal advice. The AI Act’s timeline has already been adjusted once; for binding statements about your specific situation, please consult your legal counsel or your data protection officer. When it comes to the technical implementation — hosting in Germany, a permissions concept, logging — we’re happy to help.

How to document the classification of your systems

The most practically important step is a simple overview. It doesn’t need to look good, but it needs to exist — and it’s the foundation for almost every further question a supervisory authority or a customer might ask.

For each system in use, record: name and provider, purpose of use, departments affected, your role (deployer or provider), whether personal data is processed, the classification (prohibited, high-risk, subject to transparency obligations, or other), the place of processing and the contractual basis, and the responsible person in-house.

For a Mittelstand company, that fits into a table with a handful of rows. The effort isn’t in filling it out — it’s in finding out beforehand what’s actually being used.

Penalties: the order of magnitude

Article 99 provides for three tiers, each as a maximum amount — whichever of the two figures is higher applies:

• Violations of the prohibited practices under Article 5: up to €35 million or 7% of global annual turnover.
• Violations of other obligations by providers, deployers, importers, distributors, and notified bodies: up to €15 million or 3%.
• False, incomplete, or misleading information provided to authorities: up to €7.5 million or 1%.

For small and medium-sized enterprises, including start-ups, Article 99(6) reverses this: whichever of the two figures is lower applies. For a Mittelstand company, that generally means the percentage is the ceiling, not the amount in millions.

For most companies, something else matters more in practice than the size of the fine: more and more clients — especially in the public sector and regulated industries — ask about AI usage as part of supplier due diligence. Anyone without an answer there loses business long before any authority ever investigates.

Frequently asked questions

We only use a standard writing tool. Does the AI Act even apply to us?

Yes, though only lightly. You’re a deployer. What matters most to you are the literacy obligation under Article 4, the ban on certain practices, and — as soon as you communicate externally — the transparency obligations. The demanding high-risk requirements don’t apply to you in this case.

What applies if we offer an AI assistant on our website?

Then you need at least a clear notice that it’s an AI system. You should also check whether offering it under your own name pushes you into the provider role — that depends on how substantially you modify the underlying system and how you present it.

Is our existing data protection documentation enough?

It’s half the battle, but it doesn’t replace classification under the AI Act. Both frameworks apply side by side and serve different purposes: the GDPR protects personal data, while the AI Act addresses the risks of the system itself — including where no personal data is processed at all.

Could the deadlines shift again?

It can’t be ruled out — the current version is already the result of one adjustment. So don’t rely on a date you looked up once; check the current status again before making major decisions. The obligations that already apply today aren’t affected by this either way.

Who in the company should be responsible?

In practice, a named person from management or the quality organization who works together with the data protection officer works well. What matters less is the job title, more the fact that someone is responsible at all.

When you become a provider

The question of role determines the scope of your obligations, and the line is blurrier than many assume. Three situations where a deployer can slip into the provider role:

You operate under your own name. If you make a purchased system available under your own brand — say, as an assistant in a customer portal — that can be enough. The customer sees your offering, not the upstream supplier’s.

You change the purpose. A system intended for one particular use that you then apply to another can make you responsible — especially if the new purpose falls into a high-risk area.

You substantially modify the system. This doesn’t mean configuration, your own templates, or connecting your documents. It means interventions that fundamentally change the system’s behavior.

For typical Mittelstand use — internal assistance based on your own documents — you remain a deployer. But anyone offering an assistant externally should settle this question before launch and document the answer.

What belongs in a usage policy

A lean internal policy serves several purposes at once: it guides behavior, it’s part of your evidence of competence under Article 4, and if it ever comes to it, it’s your proof that you regulated the use. Six points are enough.

• Approved systems by name, with how to get access.
• Data categories in a simple traffic-light scheme: what may go in, what only into approved systems, what not at all.
• Review requirement: Results are checked by a subject-matter expert before use. Nothing goes out unchecked.
• Labeling: how published AI-generated content is handled.
• Prohibited uses in-house — in particular, anything amounting to emotion recognition or scoring of employees.
• A named contact person.

Nothing more is needed to start. A policy that gets read is worth more than a complete one nobody knows about.

The connection to customer requirements

One reason not to put this off has nothing to do with regulators. More and more clients are asking about AI usage as part of supplier due diligence — in the public sector, in regulated industries, and increasingly among larger industrial customers too.

The questions tend to be similar: Do you use AI in delivering your service? Is our data processed in the process? Where? Does it feed into model training? How do you ensure confidentiality? Who bears responsibility for the accuracy of results?

Anyone who has already built the overview from the previous section can answer this in ten minutes. Anyone without one loses time — or loses the contract to someone who answers faster.