AI compliance and the AI Act

COMPLIANCE & RIGHT · TREATY

The four practical examples · Send request

Artificial intelligence can support research, document verification, customer communication and operational controls. Legal requirements arise both in the development and in the use of such systems. We support companies in selecting, introducing and reviewing AI applications and combine the AI Regulation with data protection, contract law, copyright and operational responsibilities.

Typical counseling events

Employees use generative AI with customer, personnel or company data.
A company introduces a chatbot, a candidate selection or an automated evaluation system.
A supplier wants to market an AI product or substantially change an existing solution.
AI is intended to evaluate evidence of misconduct, transactions or business risks.
Terms and conditions leave open, such as input, output or training data to be used.

Determine the role, system and purpose first

The requirements depend on whether the company acts, for example, as a provider, deployer, importer or distributor. The description used in the contract is not decisive on its own. Own branding, modifications or a new intended purpose may change the legal role. An AI inventory should identify the systems used, their providers, areas of use, data types, user groups and responsible persons.

The legal categories and special rules of application are then examined. These include prohibited practices, the classification as high risk AI, transparency obligations and, where appropriate, specifications for models with a general purpose. Not every AI application is a high-risk system. Conversely, a small enterprise size does not automatically remove the relevant obligations.

AI Regulation: different application deadlines

Regulation (EU) 2024/1689 is to be read together with its amendments. The Digital Omnibus Regulation on AI (EU) 2026/1744 entered into force on 27 July 2026. In particular, the originally foreseen deadlines for high-risk AI have been adjusted.

Many provisions of the AI Regulation have been in force since 2 August 2026; certain provisions were already subject to earlier dates.
The requirements for high-risk CI set out in Annex III referred to in Article 113 shall apply in principle to 2 December 2027.
The corresponding requirements for high-risk AI related to products pursuant to Article 6(1) and Annex I shall in principle apply to 2 August 2028.
Stock systems and individual transparency obligations may be subject to specific transitional rules.

A longer period for certain high risk obligations does not override other rules already applicable. Data protection, protection of discrimination, secrecy and contractual obligations must be respected independently. For a concrete project, we create an overview of the requirements and deadlines tailored to the role and system.

Data protection and employee rights

For personal entries, training data and expenditures, the legal basis, purpose limitation, data minimisation and retention must be clarified. In the case of special data categories, Art. 9 GDPR must be additionally checked. Consent does not solve every question; in the employment relationship, their voluntary nature is to be paid particular attention. A data protection impact assessment may be required if processing is likely to cause a high risk.

Under its conditions, Art. 22 GDPR concerns exclusively automated decisions with legal or similarly significant effect. It is not a general ban on automation. A mere formal human confirmation is not enough to accept a real human decision. In the case of personnel software, the AGG and participation rights of the works council must also be examined.

Transparency, human control and quality

Users need to know for which tasks an application is released and where its limits lie. In the case of chatbots and certain synthetic content, legal transparency or labelling requirements may exist. The results must be reviewed professionally, depending on the intended use; a convincingly formulated edition is not proof of their accuracy.

In the case of an AI-based internal examination, abnormality shall not be treated unchecked as evidence of a rule violation. Account must be taken of traceability, data quality, error rates and possible disadvantages. Decisions on employees and follow-up need a sound legal and actual basis.

Contracts, copyright and trade secrets

Provider conditions should cover usage rights, confidentiality, the use of input for training purposes, security measures, subcontractors, data export and contract termination. Whether an AI result is protected by copyright or affects third-party rights depends on the actual origin and use. A comprehensive freedom of rights cannot be derived solely from machine production.

Liability issues depend, among other things, on contract, breach of duty and applicable statutory liability rules. The responsibility does not disappear by the fact that a decision was prepared by AI. Trade secrets and sensitive information should only be entered in approved applications with appropriate protective measures.

Our services and possible work results

AI inventory and legal role and risk classification.
Project-related overview of applicable obligations and transitional periods.
Examination of AI, cloud and data processing contracts.
Business policy to allow applications, data, releases and controls.
Legal monitoring of data protection and, where appropriate, fundamental rights impact assessments.
Training for responsible application, result control and escalation.

Common questions

Can employees use freely available AI services?

This should be clarified by means of an operational regulation. Service, data types, terms of use and purpose must fit together. A private user account does not automatically provide the necessary safeguards for corporate data.

Is any applicant software high risk AI?

Nope. First of all, it is necessary to examine whether an AI system exists in the legal sense and whether the specific functions are covered by the relevant rules. However, there is a particular need for testing of candidates and staff decisions.

Is a flat-rate labelling of all contents as AI-generated enough?

A flat-rate labelling does not replace an examination of the specific transparency requirement. Similarly, a label does not solve any data protection, copyright or misconduct problems of the content.

Can we have only one application checked first?

Yeah. For a pilot case, a functional description, provider conditions, used data types, user groups and the planned decision-making use are helpful. A targeted testing and approval process can be developed from this.

Release AI applications during operation

It should first be determined what the application is to be used for. A draft text for internal communication raises questions other than the evaluation of applications or a safety-relevant product function. The list of applications should contain purpose, provider, role, data subject and data used. It will be updated in the event of major changes.

Before procurement, contractual terms, data usage, access rights and possibilities for controlling the results are examined. A general provider commitment to comply with the AI Act does not replace the classification of its own use. Roles and obligations may change when developing or marketing under their own name.

An internal rule should describe clearly which information may be entered and when a technical examination of the result is required. In the case of legally or economically important decisions, it must be clear who decides responsibly and how errors are detected and corrected. Copyrights, trade secrets and rights of affected persons are also included in this review.

For the implementation, a mission overview, documented clearance and task-related instructions can be agreed. The pages offer in-depth information Software businesses, Trade secrets and know-how and Contract compliance.

Legal basis and further official information

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Four practical examples

The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.

01 · AI assistant for customer inquiries

A company is planning automatic response plans. Data types, provider conditions, transparency and technical result control are defined before use.

02 · Applicant evaluation by software

The system sorts applications. The specific function is examined in accordance with the AI regulation, data protection and discrimination protection; formal human confirmation does not replace an independent decision.

03 · Source code in the public chatbot

A developer wants to enter confidential code for error analysis. Prior to this release, secret protection, terms of use and possible training usage must be clarified.

04 · Marketing under its own name

A company integrates foreign AI into its own product. It checks whether this creates a different regulatory role and what evidence and contractual information is required.

Your next step

Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.

Send request without mandatory fields →