[Maschinell · Review ausstehend] EU-KI-Verordnung Compliance Checkliste for kleine Teams (2026)

[Maschinell · Review ausstehend] This is a practical engineering-and-operations Checkliste, not Rechtlich advice. Confirm anything material with counsel.

[Maschinell · Review ausstehend] The EU-KI-Verordnung does not switch on all at once, and that is exactly why kleine Teams get it wrong. Your deadline depends onwhat your system does and which role you play[Maschinell · Review ausstehend] — provider or deployer — not on the date the regulation was signed. Most teams we talk to cannot answer the first question an auditor asks: which articles apply to this system, and by when? For the binding Rechtlich text, see Regulation (EU) 2024/1689 (eur-lex.europa.eu).

The EU-KI-Verordnung, defined

[Maschinell · Review ausstehend] The EU-KI-Verordnung (Regulation (EU) 2024/1689) is the world’s first comprehensive, risk-based law regulating artificial intelligence — it classifies systems by potential harm and attaches obligations that scale with that risk.[Maschinell · Review ausstehend] For a small team, the practical question is never “is the Act in force?” but “which of my systems fall into which risk tier, and by when?”

[Maschinell · Review ausstehend] “The AI Act is the world’s first comprehensive AI law, built on a risk-based structure that sorts systems from minimal to unacceptable risk.”
[Maschinell · Review ausstehend] — European Commission, “AI Act” (digital-strategy.ec.europa.eu)

[Maschinell · Review ausstehend] “The EU-KI-Verordnung does not switch on all at once, and that is exactly why kleine Teams get it wrong. Your deadline depends on what your system does and which role you play — provider or deployer.”
[Maschinell · Review ausstehend] — LX AI (Xingliang Li), LX Micro-SaaS Factory

The dates that actually bind you

[Maschinell · Review ausstehend] The phasing below follows Regulation (EU) 2026/1744 (the “Digital Omnibus”,eur-lex.europa.eu[Maschinell · Review ausstehend] ), in force from 27 July 2026, which revised several application dates.

The six-step Checkliste

1. Inventory every AI system.[Maschinell · Review ausstehend] Include the ones a contractor shipped, the model behind a support widget, and anything calling a third-party API. Teams routinely miss half their surface area.
2. Assign a role per system.[Maschinell · Review ausstehend] Provider (you Baue/place it on the market) or deployer (you use it). The obligations differ sharply, and getting this wrong misroutes everything downstream.
3. Classify risk.[Maschinell · Review ausstehend] Check Art. 5 prohibitions first, then Annex III high-risk categories, then Art. 50 transparency. A generic support chatbot is usually minimal-risk — it changes character if it screens CVs, scores credit, or does emotion inference.
4. Map obligations to dates.[Maschinell · Review ausstehend] For each applicable article, write down the binding date from the table above. This converts a vague worry into a schedule.
5. Close the documentation gap.[Maschinell · Review ausstehend] Even at minimal risk you need to be able to showwhy[Maschinell · Review ausstehend] you classified it that way. A one-page rationale per system is usually enough and is what auditors ask for first.
6. Re-check on a cadence.[Maschinell · Review ausstehend] The dates moved once already. Set a recurring review, and re-verify before each milestone in the table.

Five mistakes we see repeatedly

• Using the original dates.[Maschinell · Review ausstehend] The Digital Omnibus pushed Annex III high-risk to 2 Dec 2027. Plans built on the pre-Omnibus 2026 date are planning against a deadline that no longer exists.
• [Maschinell · Review ausstehend] Confusing “obligation applies” with “enforcement starts”.[Maschinell · Review ausstehend] GPAI obligations applied from 2 Aug 2025, but enforcement powers only became exercisable from 2 Aug 2026. Both dates matter; they are not the same thing.
• [Maschinell · Review ausstehend] Assuming “we are outside the EU” means out of scope.[Maschinell · Review ausstehend] If your system's output is used in the EU, you are likely in scope regardless of where you are incorporated.
• Treating Compliance as a one-off.[Maschinell · Review ausstehend] Adding a feature can move a system into a new risk tier. Re-classify on material change.
• Buying a “100% compliant” badge.[Maschinell · Review ausstehend] No tool can certify that. Distrust any product that claims to.

Where tooling genuinely Hilfts

[Maschinell · Review ausstehend] The tedious part is not understanding the regulation — it is repeating steps 1–4 across a dozen systems and keeping them current. That is the part worth automating.

• AIActRadar[Maschinell · Review ausstehend] classifies each system's risk tier and maps the applicable obligations to their phased deadlines with article citations, producing a risk register and a dated roadmap.
• AgentPolicy[Maschinell · Review ausstehend] converts your written policy into checks your agents actually enforce, which matters once you have autonomous systems acting on their own.
• AgentRedTeam[Maschinell · Review ausstehend] simulates prompt injection, tool abuse and data exfiltration against those agents, since Art. 15 robustness expectations do not stop at documentation.

[Maschinell · Review ausstehend] All three have a free tier, so you can validate the classification on one system before committing to anything.

Häufige Fragen

[Maschinell · Review ausstehend] Does the EU-KI-Verordnung apply to a small team outside the EU?

[Maschinell · Review ausstehend] It can. The Act reaches providers placing AI systems on the EU market and deployers whose systems produce output used in the EU, regardless of where the team is incorporated. If your model's output is used by people in the EU, assume you are in scope and check your role.

[Maschinell · Review ausstehend] When do high-risk Annex III obligations actually apply?

[Maschinell · Review ausstehend] Under the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026), high-risk Annex III obligations apply from 2 December 2027, later than the original 2026 date.

Is a generic support chatbot high-risk?

[Maschinell · Review ausstehend] Usually not. A generic customer-support chatbot is typically minimal or limited-risk. It becomes higher-risk when it is used in Annex III contexts such as employment decisions, credit scoring, or essential services, or when it does biometric or emotion-related processing.

Do GPAI obligations apply now?

[Maschinell · Review ausstehend] GPAI obligations have applied since 2 August 2025, but enforcement powers for GPAI only became exercisable from 2 August 2026. Transparency obligations under Article 50 also apply from 2 August 2026.

[Maschinell · Review ausstehend] Do I need to watermark AI-Erzeugend content?

[Maschinell · Review ausstehend] Obligations covering marking and detection of AI-Erzeugend content, including the prohibition on certain subliminal or deceptive techniques (NCIC), apply from 2 December 2026.