Artifical Intelligence (AI)

The Artificial Intelligence Act (AI Act) entered into force on 1 August 2024 and is being implemented gradually.
2 February 2025 was already relevant for the introduction of AI competencies (Art. 4 AI Act) and for prohibited practices. As a rule, it has applied since 2 August 2026 (Art. 113 AI Act). Further provisions for high-risk systems will be phased in step by step until 2028 (key dates: 2 August 2027, 2 December 2027, 2 August 2028).

The Artificial Intelligence Act (AI Act) regulates – in short – the development, placing on the market and use of AI. It does so with the aim of “improving the functioning of the internal market and promoting the uptake of human-centric and trustworthy artificial intelligence (AI)” (Art. 1 para. 1 AI Act).

The AI Act governs the development, provision, and use of AI with the overarching goal „to improve the functioning of the internal market and promote the uptake of human-centric and trustworthy artificial intelligence (AI)“ (Article 1 para.1 of the AI Act).

Article 5 AI Act lays down a catalogue of prohibited AI practices, such as subliminal influence, deliberately manipulative techniques, exploitation of vulnerability, social scoring, emotion recognition in the workplace and in educational institutions, as well as certain forms of biometric categorisation – all prohibited since 2 February 2025.

The classification of an AI system as a high-risk AI system is governed by Article 6 of the AI Regulation (AI Act). For the year 2026, Article 6 para. 1 can largely be disregarded, as the systems mentioned there will not be classified as high-risk until August 2, 2027 (as indicated in Article 113 lit. c of the AI Act).

The primary criteria for determining whether a system is considered high-risk are outlined in Article 6 para. 2. However, the actual classification is detailed in Annex III of the regulation, which lists specific AI applications that fall under the high-risk category.

Regardless of Annex III, a system is not deemed high-risk if it does not present a significant risk of harm to the health, safety, or fundamental rights of individuals. Specifically, this applies when the system does not substantially influence the outcome of decision-making processes (Article 6 para. 3). This exemption helps ensure that only genuinely impactful AI applications are subject to stringent high-risk requirements.

The AI Regulation (AI Act) defines various roles within the AI value chain, including operators, providers, importers, and distributors, each with specific responsibilities to ensure compliance.

1. Operator: As per Article 3 para. 4, an operator is a natural or legal person, public authority, or other entity that uses an AI system under its own responsibility, except when the AI system is used for personal and non-professional purposes.
2. Provider: Defined in Article 3 para. 3, a provider is an entity (natural or legal person, authority, or organization) that develops an AI system or a general-purpose AI model, or commissions its development, and places it on the market or puts it into service under its own name or trademark, whether for free or for a fee.
3. Importer: According to Article 3 para. 6, an importer is a person or entity established within the EU that brings an AI system to market, which bears the name or trademark of a person or entity established outside the EU.
4. Distributor: As outlined in Article 3 para. 7, a distributor is a natural or legal person in the supply chain who makes an AI system available on the EU market, excluding the provider or importer.

The term "actor" is used in Article 3 para. 8 as a collective term that encompasses all these roles: provider, manufacturer, operator, authorized representative, importer, and distributor. Each actor has distinct obligations to ensure the safe and ethical deployment of AI systems, depending on their role in the AI ecosystem.

As soon as an AI system processes personal data, the GDPR and the AI Act apply in parallel. We assess both layers together instead of dealing with them separately – this saves time and avoids inconsistent results.

If you do not yet have a clear strategy for the use of AI, start with our AI strategy consulting. If you would like ongoing support, an external AI officer is the right choice. For a one-off legal assessment, an evaluation under the AI Act and the GDPR is suitable.