The EU AI Act for companies: what it requires

Operate AI with technically verifiable controls? WZ-IT implements data flows, roles, model versions, logging and operational boundaries. Legal classification remains the responsibility of the organisation and its advisers. Explore managed AI

The EU AI Act gives artificial intelligence a binding European framework. For organisations, “do we use AI?” is not enough. Role, intended purpose, affected people and resulting risk determine the obligations. This article translates the position after the AI Omnibus entered into force on 27 July 2026 into a practical assessment and implementation plan. It is technical and organisational guidance, not legal advice. As of August 2026.

Table of contents

• What the EU AI Act regulates
• Determine your role first
• The four risk levels
• GPAI: rules for foundation models
• The phased timeline
• What organisations should implement
• What the technical platform should evidence
• How WZ-IT supports implementation
• Sources

What the EU AI Act regulates

The EU AI Act is the European regulation for artificial intelligence. Its core is a risk-based approach: not every AI is treated the same, but according to the risk arising from its concrete use. The higher the risk, the stricter the obligations.

The Act does not classify a system by model or hosting location alone. The same foundation model can sit inside a lower-risk drafting tool and a high-risk recruitment application. Self-hosting does not remove obligations, although it can make versions, data flows and evidence more controllable.

Determine your role first

Obligations differ for providers, deployers, importers and distributors. Many organisations are deployers when using a purchased assistant. Supplying a system under your own name, materially changing it or providing a model can add provider obligations.

Create a short role record for every system:

• Who supplies the model and the application?
• Who determines purpose, inputs, outputs and user groups?
• Is it internal only or supplied to third parties?
• Is the model, safety component or intended purpose materially modified?
• Which documentation comes from the supplier and which evidence must the deployer create?

The four risk levels

The European Commission explains four levels:

• Prohibited practices - applications like social scoring or certain manipulative systems are banned.
• High-risk systems - including certain uses in critical infrastructure, education, employment, essential services and regulated products. Depending on role, requirements cover risk management, data governance, documentation, logging, human oversight, robustness and conformity.
• Transparency risk - people must be informed in specified situations that they are interacting with AI. Further labelling rules apply to certain synthetic content, deepfakes and public-interest text.
• Minimal risk - the majority of applications; largely without special obligations.

Classification follows the intended use rather than the product name. An internal research assistant, a public widget and a candidate-ranking system can use the same model but have very different obligations.

GPAI: rules for foundation models

A category of its own is general-purpose AI models (GPAI) - the large foundation models on which many applications build. Their providers have their own obligations, such as technical documentation and information about the training data; models with systemic risk are subject to additional requirements.

For organisations that only use such models, deployer duties and the application's risk level are central. Self-hosting also requires attention to licence, model card, provenance, version, evaluation limits and updates. Fine-tuning, distillation or own distribution should trigger a fresh role assessment.

The phased timeline

The Act entered into force on 1 August 2024 and generally applies from 2 August 2026. The Commission's current timeline is:

The later high-risk dates were changed by the AI Omnibus, which entered into force on 27 July 2026. Older timelines should therefore not be reused without checking.

What organisations should implement

Start with an auditable inventory rather than a generic policy:

1. Discover systems, including embedded AI in SaaS, support, recruitment and development tools.
2. Record role and purpose, user groups, affected people and permitted data classes.
3. Assess prohibitions and risk, then identify transparency and potential high-risk obligations.
4. Organise AI literacy by role and risk instead of one generic presentation.
5. Retain supplier evidence, including model card, version, limitations, subprocessors and change information.
6. Define operations, human oversight, incidents, logs, retention, updates and shutdown.
7. Reassess changes, because a new purpose, model or data source can change classification.

Data protection, worker participation, copyright, professional secrecy and information security continue to apply alongside the AI Act.

What the technical platform should evidence

Not every system needs full prompt and response retention. Uncritical full logging can itself create data-protection and worker-monitoring risks. The log design should reflect purpose, data class and retention.

Useful technical capabilities often include:

• explicit versions for model, prompt, knowledge base and application,
• separate user, administration and evaluation roles,
• audit trails for model and source changes,
• source traceability for knowledge-grounded answers,
• quality, latency and failure metrics without unnecessary clear-text data,
• approvals and human oversight for consequential actions,
• tested shutdown, rollback and incident handling.

An observability layer such as Langfuse can support traces, versions and evaluation. What it is allowed to store needs a separate decision.

How WZ-IT supports implementation

WZ-IT translates requirements into technology: controlled managed AI infrastructure, model and gateway operations, identity integration, permission-aware RAG, data-minimised observability, and documented update and rollback paths. An internal AI assistant is a common starting point for governed knowledge access.

We provide the technical foundation and system description. Legal role and risk classification, and any required conformity assessment, remain with the responsible organisation and its advisers.

Sources

• European Commission: AI Act risk levels and current timeline
• European Commission: AI Act Service Desk
• EUR-Lex: Regulation (EU) 2024/1689
• German Data Protection Conference: guidance on AI and data protection