[Maschinell · Review ausstehend] EU-KI-Verordnung Compliance in 2026: Deadlines, Tools & Checkliste

[Maschinell · Review ausstehend] Introduction: Why "Compliance later" stopped being an option

[Maschinell · Review ausstehend] For two years, the EU-KI-Verordnung was something Rechtlich teams bookmarked and founders deferred. That window has closed. In 2026 the Act is no longer a looming framework; it is an operating reality with enforcement powers, registration duties, and — critically for non-EU companies — extraterritorial reach.

[Maschinell · Review ausstehend] If you are a US or UK SaaS team shipping anything with an AI feature — a support chatbot, a document classifier, an agent that drafts emails — the Act can apply to you even though you have never had an office in Europe. The trigger is not where your company sits. It is where your system'soutput is used in the EU.

[Maschinell · Review ausstehend] This guide is written for exactly that audience: small-to-mid-size B2B teams that need to (1) understand what actually binds them in 2026, (2) classify their exposure without hiring a Brussels law firm, and (3) choose tooling that matches their size. We will walk through the risk tiers, the deadlines that survived the Digital Omnibus reshuffle, a practical Compliance Workflow, and a comparison of the main tool categories.

Suggested external link placement:[Maschinell · Review ausstehend] link "Reg. (EU) 2026/1744" and "Article 50" to the relevant EUR-Lex pages on first mention, per GEO/SEO best practice for YMYL-adjacent Rechtlich content.

[Maschinell · Review ausstehend] The EU-KI-Verordnung in one page: scope, roles, and reach

[Maschinell · Review ausstehend] Who counts as a provider, deployer, or both

[Maschinell · Review ausstehend] The Act assigns duties based on your role. Aprovider[Maschinell · Review ausstehend] develops an AI system and places it on the market under their own name. Adeployer[Maschinell · Review ausstehend] uses an AI system in the course of their activities. Many SaaS companies are both: youprovidethe AI feature to customers anddeployAI internally (say, for support triage).

[Maschinell · Review ausstehend] Why it matters: providers carry heavier documentation, registration, and conformity duties for high-risk systems; deployers carry usage-side duties like human oversight and informing affected persons. Misclassifying your role is one of the most common gaps we see in early self-assessments.

[Maschinell · Review ausstehend] Extraterritorial reach — the clause that catches US and UK teams

[Maschinell · Review ausstehend] Article 2 extends the Act to providers and deployers outside the EU when the output of their AI system is used in the Union. Practical translation: an American company whose AI writing assistant is used by a German customer is in scope for the obligations attached to that use. Penalties can reach the tens of millions of euros or a percentage of global Verwandleover, whichever is higher — the same penal architecture that made GDPR a board-level topic.

[Maschinell · Review ausstehend] What is explicitly banned (and already enforced)

[Maschinell · Review ausstehend] Since February 2025, a short list of practices is prohibited outright: subliminal manipulation causing harm, exploitation of vulnerabilities of specific groups, social scoring by public authorities, untargeted facial-image scraping, emotion recognition in workplaces and schools (with narrow exceptions), biometric categorization of sensitive attributes, and real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions). If any product feature touches these areas, the Compliance question is not "how" but "whether."

[Maschinell · Review ausstehend] The 2026–2028 timeline (post–Digital Omnibus)

[Maschinell · Review ausstehend] The original timeline was modified by the Digital Omnibus regulation, effective July 2026. Here is the schedule that matters as you plan roadmaps:

[Maschinell · Review ausstehend] What this means for a typical SaaS roadmap

• Shipping in 2026:[Maschinell · Review ausstehend] your most likely exposure is Article 50 transparency — telling users they are interacting with AI, labeling synthetic media. This is cheap to implement and increasingly checked.
• Planning 2027–2028 launches:[Maschinell · Review ausstehend] if your use case appears in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration), start the risk-management file now; December 2027 arrives faster than it looks.
• Baueing on foundation models:[Maschinell · Review ausstehend] the GPAI duties from August 2025 flow down through your model vendors' documentation. You inherit evidence obligations you cannot fabricate later — capture vendor attestations now.

Internal link suggestion:[Maschinell · Review ausstehend] link "Article 50 transparency" to your own explainer post (e.g., /blog/ai-act-article-50-disclosure-Checkliste) and the timeline table to the product page https://aiactradar.lxsaihub.com/.

[Maschinell · Review ausstehend] Risk classification: the four tiers, applied to real products

[Maschinell · Review ausstehend] The Act sorts AI systems into four tiers. The tier decides almost everything downstream, so it is worth getting right — and it is also where most self-assessments wobble.

Tier 1 — Unacceptable risk

[Maschinell · Review ausstehend] Already banned (see above). There is no "Compliance path" here; features must be removed or redesigned.

Tier 2 — High risk (Annex III)

High-risk status attaches to specificuse cases[Maschinell · Review ausstehend] , not to AI in general. The Annex III families most relevant to B2B software:

• Employment and worker management[Maschinell · Review ausstehend] — CV screening, promotion scoring, task allocation. If your HR-tech does any candidate filtering, you are here.
• Education and vocational training— admission scoring, exam proctoring.
• Essential private and public services[Maschinell · Review ausstehend] — credit scoring, insurance pricing, benefits eligibility.
• [Maschinell · Review ausstehend] Law enforcement, migration, border control— narrow but absolute.
• Biometrics[Maschinell · Review ausstehend] — identification, categorization, emotion recognition.
• Critical infrastructure— safety-relevant components.

[Maschinell · Review ausstehend] A high-risk classification triggers the full stack: risk-management system, data Governance, technical documentation, logging, transparency to users, human oversight, accuracy/robustness/cyberSicherheit requirements, EU database registration, and conformity assessment.

[Maschinell · Review ausstehend] Tier 3 — Limited risk / transparency duty

[Maschinell · Review ausstehend] This is the tier most SaaS products actually live in. Chatbots must disclose they are AI; synthetic images, audio, and video must be labeled as artificially Erzeugend or manipulated. Since August 2026 this is enforceable — not aspirational.

Tier 4 — Minimal risk

[Maschinell · Review ausstehend] Everything else: spam filters, recommendation ranking, autocomplete. No specific obligations, though voluntary codes are encouraged.

The classification trap

[Maschinell · Review ausstehend] Systems are classified per use case, and one product can straddle tiers — a customer-service assistant is "limited risk," but if the same vendor sells a CV-screening module to an EU customer, that module is high-risk. Spreadsheets break down exactly here. This is the step where classification-first tooling earns its keep: a deterministic engine applied per use case beats an ad-hoc reading of Annex III.

[Maschinell · Review ausstehend] The Compliance Workflow that actually fits a small team

[Maschinell · Review ausstehend] Enterprise programs assume enterprise budgets. A five-person Compliance-capable Workflow (no, you do not need five people — fivesteps) looks like this:

1. Inventory.[Maschinell · Review ausstehend] List every AI feature you ship or use internally, including vendor models. One row per use case.
2. Classify.[Maschinell · Review ausstehend] Map each use case against Article 5 (prohibited), Annex III (high-risk), and Article 50 (transparency). Record reasoning — regulators ask for it.
3. Obligation mapping.[Maschinell · Review ausstehend] For each classified use case, list the duties that attach: documentation, disclosure, oversight, registration, conformity.
4. Evidence collection.[Maschinell · Review ausstehend] Gather what already exists (model cards, DPA summaries, vendor attestations, test reports) and mark what is missing. Regulators judge files, not intentions.
5. Monitoring.[Maschinell · Review ausstehend] The Act is a moving target; the Digital Omnibus proved it. Assign an owner and a cadence (quarterly is realistic) for re-classification and timeline drift.

This is the loopAIActRadar[Maschinell · Review ausstehend] is built around — classify, map, document, monitor — which is why we will use it as the reference point when comparing tools.

Suggested external links:[Maschinell · Review ausstehend] "risk-management system" → Annex III text on EUR-Lex; "conformity assessment" → the Commission's AI Act overview page.

[Maschinell · Review ausstehend] Tool landscape: seven ways to run the program

The market splits into two families:enterprise GRC suites[Maschinell · Review ausstehend] (broad Governance platforms that cover AI among many risk domains) andfocused Compliance tools[Maschinell · Review ausstehend] (narrow, Workflow-first products for the AI Act specifically). Neither family is wrong; the fit depends on your audit posture.

Comparison table

[Maschinell · Review ausstehend] * Indicative as of 2026; verify current pricing on each vendor's site. Enterprise tiers are quote-based.

AIActRadar — deep dive

Funktionen.[Maschinell · Review ausstehend] AIActRadar compresses the five-step Workflow above into a guided product: describe your use case, get a risk-tier verdict mapped to Annex III, receive the obligation list for that tier, upload existing evidence for gap analysis, and Erzeugen a phased remediation roadmap. A change-Verfolgeing module follows Digital Omnibus-era timeline shifts so the December 2027 and August 2028 milestones do not sneak up on you.

Pros

• [Maschinell · Review ausstehend] Classification-first: the hardest step is also the fastest one.
• [Maschinell · Review ausstehend] Evidence-retention guidance built into the roadmap, so documentation accrues as you go rather than in a pre-audit scramble.
• [Maschinell · Review ausstehend] Self-serve pricing that a bootstrapped or seed-stage team can actually approve.
• [Maschinell · Review ausstehend] Timeline Verfolgeing is maintained against the post-Omnibus schedule, not the original one.

Cons

• [Maschinell · Review ausstehend] Not a full GRC suite: if you need SOC 2, ISO 42001, and vendor-risk management in one platform, you will pair it with (or eventually graduate to) a broader tool.
• [Maschinell · Review ausstehend] English-first; multilingual outputs for EU-market filings are lighter than enterprise suites.

Real use case.[Maschinell · Review ausstehend] A UK HR-tech startup preparing an EU pilot for its CV-screening module needed to know, before the sales call, whether the feature was high-risk and what that would cost them. Classification took an afternoon; the obligation map showed data-Governance and human-oversight duties they could partially satisfy with existing model documentation. The gap report went straight into the pilot's Rechtlich annex.

Real use case (second segment).[Maschinell · Review ausstehend] A US agency-services firm uses AI tools for client deliverables. They ran their internal tool stack through classification to produce a one-page "AI Act exposure memo" for EU-bound clients — a cheap artifact that repeatedly unblocked procurement conversations.

[Maschinell · Review ausstehend] When to choose an enterprise GRC suite instead

[Maschinell · Review ausstehend] Pick Holistic AI, Credo AI, watsonx.Governance, OneTrust, or TrustArc when you have: (a) an in-house Compliance function that will operate a platform daily; (b) multiple regulated regimes in scope simultaneously; (c) procurement processes that require SOC 2 reports and enterprise references from your Governance vendor. At that point the suite's weight becomes an asset rather than overhead.

When Vanta-style bundling makes sense

[Maschinell · Review ausstehend] If your near-term Compliance driver is SOC 2 or ISO 27001 — and AI Act work is secondary — Vanta's model of one subscription covering multiple frameworks can be economical. The trade-off is depth: AI-specific classification and Annex III mapping are newer and thinner than in dedicated tools.

Häufige Fragen

[Maschinell · Review ausstehend] Does the EU-KI-Verordnung apply to a US company with no EU office?

Yes, if theoutput[Maschinell · Review ausstehend] of your AI system is used in the EU. Article 2's extraterritorial clause reaches providers and deployers located in third countries whose system output is used in the Union. Enforcement runs through market surveillance authorities and can attach to your EU-facing customers' obligations too — which is why EU buyers increasingly demand AI Act evidence in procurement.

[Maschinell · Review ausstehend] What are the actual deadlines after the Digital Omnibus?

[Maschinell · Review ausstehend] Prohibitions: February 2025 (in force). GPAI: August 2025 (in force). Article 50 transparency duties and GPAI enforcement powers: August 2026 (in force). AI-content marking duties: December 2026. Most Annex III high-risk obligations: December 2027. AI embedded in regulated products: August 2028. Note these reflect Reg. (EU) 2026/1744; verify against EUR-Lex for filing-grade certainty.

[Maschinell · Review ausstehend] How do I know if my product is "high-risk"?

[Maschinell · Review ausstehend] Check your use case, not your technology, against Annex III: employment, education, essential services (credit, insurance), biometrics, critical infrastructure, law enforcement, migration. If you are in any of those families, assume high-risk until a documented assessment says otherwise. If you are a chatbot, writing assistant, or Analytics tool outside those families, your realistic tier is "limited risk" — the Article 50 disclosure duties.

What happens if we ignore it?

[Maschinell · Review ausstehend] Penalty ceilings reach the tens of millions of euros or a percentage of worldwide annual Verwandleover (the higher figure), scaled by violation type. Beyond fines, the practical cost shows up earlier: EU enterprise customers now ask for AI Act posture in Sicherheit questionnaires, and "we're assessing it" increasingly fails procurement.

[Maschinell · Review ausstehend] Can a small team really do this without a law firm?

[Maschinell · Review ausstehend] For classification and obligation mapping — yes, with the right tooling; the risk tiers are rule-based, and a deterministic engine plus a recorded rationale is a defensible starting position. For high-risk systems heading into conformity assessment, or for gray-zone use cases, bring in counselafter[Maschinell · Review ausstehend] you have the classification file — it makes the engagement shorter and cheaper.

[Maschinell · Review ausstehend] Is a "Compliance report" from a tool enough for regulators?

[Maschinell · Review ausstehend] No tool output is a Rechtlich safe harbor. What matters is a documented, current, and coherent program: classification with reasoning, mapped obligations, real evidence, and a monitoring cadence. Tools structure and accelerate exactly that; they do not replace accountability.

[Maschinell · Review ausstehend] Does the UK AI policy landscape require the same work?

[Maschinell · Review ausstehend] The UK has taken a principles-based, sector-regulator approach rather than a horizontal act — so no single "UK AI Act" Compliance file exists today. But if you serve EU users, the EU Act applies regardless of your UK base, and UK regulator guidance is converging on similar transparency expectations. ---

Sources

• [Maschinell · Review ausstehend] EUR-Lex — Regulation (EU) 2024/1689 (EU-KI-Verordnung).eur-lex.europa.eu/eli/reg/2024/1689/oj.
• [Maschinell · Review ausstehend] EUR-Lex — Regulation (EU) 2026/1744 (Digital Omnibus).eur-lex.europa.eu.
• [Maschinell · Review ausstehend] European Commission — AI regulatory framework overview.[Maschinell · Review ausstehend] digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai.