EU AI Act Compliance in Germany

The AI Act in brief

The AI Act (Regulation (EU) 2024/1689) is the EU's horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages.

The Regulation prohibits certain AI practices outright, imposes extensive requirements on high-risk AI systems and their providers and deployers, sets transparency rules for AI that interacts with people or generates content, and regulates providers of general-purpose AI models. In July 2026 the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744), which postponed the high-risk rules, softened the AI literacy duty and added new prohibitions. For companies in Germany, these EU rules now sit alongside the national AI Market Surveillance and Innovation Act (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG), in force since 29 July 2026.

The Regulation applies to providers that place AI systems or general-purpose AI models on the EU market, to deployers that use AI systems in the EU, and to importers and distributors, regardless of where they are established.

Most German companies are deployers: they buy, subscribe to or license AI tools and use them in HR, customer service, marketing, production or finance. Many are also providers, because they develop AI functions for their own products or substantially modify third-party systems. This page explains the risk categories, the timetable after the omnibus, the obligations of providers and deployers, enforcement in Germany and how to organise compliance. For the wider framework, see our data and digital law overview.

Risk categories under the AI Act

Prohibited practices

Article 5 prohibits AI practices considered unacceptable, including manipulative or deceptive techniques that materially distort behaviour and cause significant harm, exploitation of vulnerabilities, social scoring, predicting criminal offences solely on the basis of profiling, untargeted scraping of facial images to build recognition databases, emotion recognition in the workplace and in education (with medical and safety exceptions), biometric categorisation to infer sensitive characteristics and, subject to narrow exceptions, real-time remote biometric identification in public spaces for law enforcement.

The omnibus added prohibitions on AI systems that generate or manipulate realistic intimate images of identifiable persons without their consent, and on systems that generate child sexual abuse material, applying from 2 December 2026. Infringements of Article 5 carry fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Article 99(3)).

High-risk AI systems

AI systems are high-risk either because they are safety components of, or themselves, products covered by EU harmonisation legislation listed in Annex I, such as machinery and medical devices, or because they are used in sensitive areas listed in Annex III.

Annex III covers, among others, biometrics, critical infrastructure, education, employment and workers management, access to essential private and public services such as creditworthiness assessment and life and health insurance pricing, law enforcement, migration and the administration of justice. An Annex III system is not high-risk if it does not pose a significant risk of harm, for example where it only performs a narrow procedural task, but the provider must document that assessment.

Transparency and minimal risk

Article 50 imposes transparency duties: people must be informed that they are interacting with an AI system unless this is obvious; providers of generative AI must mark synthetic content in a machine-readable format; and deployers of deep fakes and of AI-generated text published to inform the public on matters of public interest must disclose that the content is artificially generated or manipulated, subject to exceptions.

These duties have applied since 2 August 2026; the omnibus introduced a four-month transitional period for the marking obligation for generative systems already on the market before that date. All other AI systems are minimal-risk and subject only to the AI literacy rule.

Obligations of providers and deployers

Providers of high-risk AI systems carry the main burden. They must implement a risk-management system, use appropriate training, validation and testing data, prepare technical documentation, ensure logging, transparency and human oversight, meet requirements for accuracy, robustness and cybersecurity, operate a quality management system, carry out a conformity assessment, affix the CE marking, register Annex III systems in the EU database and monitor their systems after placing them on the market. Fines for breaches of these obligations reach EUR 15 million or 3% of worldwide turnover (Article 99(4)).

Deployers of high-risk systems have their own duties: using systems in accordance with the instructions, assigning human oversight to competent staff, ensuring that input data under their control are relevant, monitoring operation, keeping logs, informing workers' representatives and affected workers before using a high-risk system at the workplace and, for certain deployers such as public bodies and providers of credit or insurance scoring, carrying out a fundamental rights impact assessment. A deployer that puts its name on a high-risk system, makes a substantial modification or changes its intended purpose becomes a provider.

AI literacy

Article 4 originally required providers and deployers to take measures to ensure a sufficient level of AI literacy of their staff. As amended by the omnibus, it now requires them to take measures to support the development of AI literacy of staff and other persons dealing with AI systems on their behalf, taking into account their knowledge, experience and the context of use, and expressly does not require them to guarantee a specific level of AI literacy of any individual. In practice, a documented training and guidance programme remains the sensible response; see our insight on AI literacy under Article 4.

General-purpose AI models

Providers of general-purpose AI models must keep technical documentation, provide information to downstream providers, put in place a copyright policy and publish a summary of training content. Providers of models with systemic risk have additional duties on evaluation, risk mitigation, incident reporting and cybersecurity. These rules have applied since 2 August 2025 and are supervised by the European Commission's AI Office. Codes of practice help providers demonstrate compliance, and downstream companies should ask model providers for the information they need to meet their own obligations. See our insight on general-purpose AI provider duties.

AI Act enforcement in Germany

The KI-MIG implements the Regulation's governance provisions in Germany. The Federal Network Agency is the market surveillance authority for the AI Act unless the KI-MIG provides otherwise (§ 2(1) KI-MIG).

Authorities responsible for market surveillance under the product legislation in Annex I Section A, for example for machinery or medical devices, also act as AI market surveillance authorities for AI systems related to those products (§ 2(2)), and BaFin is responsible for AI systems directly connected with regulated financial activities of supervised firms (§ 2(3)). Within the Federal Network Agency, an AI market surveillance chamber decides certain matters (§ 4), and a coordination and competence centre supports the authorities in complex cases (§ 5).

The KI-MIG also establishes a central point of contact and a central complaints office, regulates powers of investigation, provides for AI regulatory sandboxes and testing under real-world conditions (§§ 13 and 14), and contains the German fine provisions for infringements of the Regulation (§ 15). The Act thus gives companies a single main counterpart for most AI questions, while sector regulators remain involved where AI is embedded in regulated products or financial services.

EU AI rules do not displace other laws. The GDPR continues to apply to AI that processes personal data, including the rules on automated decision-making in Article 22 GDPR. Product liability law is being modernised to cover software and AI. Copyright law governs the use of protected works for training, with the text-and-data-mining exception and opt-out in § 44b of the Copyright Act (UrhG). And employment law gives works councils significant rights.

Liability is a further consideration. The new EU Product Liability Directive, which Member States must transpose by 9 December 2026, expressly treats software, including AI systems, as a product, so that defective AI placed on the market after 9 December 2026 can lead to strict liability for death, personal injury, damage to property and, in certain cases, the destruction or corruption of data. Contracts with AI vendors should therefore address recourse, documentation and cooperation in claims, alongside the regulatory duties.

Simplifications for smaller companies

The omnibus extended several simplifications that the original text reserved for SMEs to small mid-cap enterprises (SMCs), defined by reference to Commission Recommendation (EU) 2025/1099, and asked the Commission to issue guidance to minimise the compliance burden. These measures reduce cost, but they do not remove the core requirements for high-risk systems.

Using general-purpose AI tools in the business

Most companies use general-purpose AI through chat assistants, copilots and APIs. As deployers, they are rarely subject to the provider duties for general-purpose AI models, but they must observe the transparency duties when they publish AI-generated content, support AI literacy, comply with the GDPR and protect trade secrets and confidential information entered into prompts.

If they build an AI system on top of a model and place it on the market, they may become providers of that system, with high-risk obligations if the use case falls under Annex III. Internal acceptable-use policies, approved tool lists and contract terms with AI vendors on data use and confidentiality are the basic controls.

The AI Act, works councils and HR

Employment is one of the most important use cases in Germany, both because AI systems for recruitment, promotion, termination, task allocation and performance monitoring are high-risk under Annex III and because German works councils have strong co-determination rights. The introduction of technical systems capable of monitoring employees' behaviour or performance requires the works council's agreement (§ 87(1) no. 6 BetrVG), and the works council must be informed in good time about the planning of work procedures involving AI (§ 90 BetrVG). When assessing AI, the works council may call in an expert, and the law deems this necessary (§ 80(3) BetrVG).

Employers should therefore combine compliance with a framework works agreement on AI that sets rules for introducing new tools, data use, performance monitoring limits and employee training. This approach also helps meet the AI literacy and deployer transparency duties. See our insights on AI tools and works council rights and AI in recruitment and HR.

Building an AI Act compliance programme

1. Inventory: list AI systems developed, purchased and used across the group, including AI features embedded in standard software, and keep the list current as new tools are adopted.
2. Role and risk classification: determine for each system whether the company is provider, deployer, importer or distributor, and whether the system is prohibited, high-risk, subject to transparency duties or minimal-risk.
3. Stop or redesign any prohibited use, such as emotion recognition of employees, and check marketing claims to avoid overstating AI capabilities.
4. Transparency: implement chatbot notices, content marking and deep-fake disclosures now in force.
5. High-risk roadmap: plan conformity assessment, documentation and quality management to meet the December 2027 and August 2028 dates.
6. Contracts: allocate regulatory responsibilities, documentation duties and liability with vendors and customers.
7. Governance: appoint an AI owner, adopt an AI policy, run literacy measures and involve the works council early.

Illustration: a hypothetical German insurer uses a vendor's AI tool to rank job applicants and another to price life insurance. Both are Annex III high-risk uses, so from 2 December 2027 the insurer, as deployer, must ensure human oversight, monitor the systems, inform affected employees' representatives and, for the pricing tool, carry out a fundamental rights impact assessment. The vendor, as provider, must deliver conformity documentation. The insurer negotiates those duties into its contracts in 2026 and agrees a works agreement on the recruitment tool.

How TRW & Co helps

We advise providers and deployers on AI Act compliance in Germany. We help build AI inventories, classify systems and roles, draft AI policies and literacy programmes, and prepare technical documentation and conformity assessment roadmaps with your engineering teams. We negotiate AI clauses with vendors and customers, structure works agreements on AI, and align this work with the GDPR, copyright and product liability. We also represent clients before the Federal Network Agency and other authorities, and advise boards on AI governance and oversight. To discuss your AI governance, please contact us. This page is general information and not legal advice.