EU AI Act & AI Governance for Mid-Sized Companies

Regulation (EU) 2024/1689 has been in force since 1 August 2024 and applies in stages. Since 2 February 2025 prohibited practices are banned and the AI literacy obligation under Article 4 applies: anyone operating AI systems must ensure that the staff involved understand how they work and where their limits are. Since 2 August 2025 the rules for general-purpose AI models and the governance and penalty framework apply; since 2 August 2026 the regulation is in principle fully applicable. The deadlines for high-risk systems have been adjusted several times during the legislative process — which dates apply to you specifically is something we check case by case against the current state of the law.

For most mid-sized companies the good news is: what you actually use rarely falls into the high-risk category. A Copilot in Microsoft 365, a chatbot on the website or text classification in the inbox are typically low-risk systems or systems with transparency obligations. It becomes critical where AI decides about people — in recruiting, credit scoring or performance assessment. These are exactly the cases you need to know about before someone introduces them without consultation.

We therefore work from reality rather than from the legal text: first an inventory of what is actually in use — including the tools business units run without IT approval. Then classification per system by risk class and role, combined with the data protection view: which data flows where, on what legal basis, under which data processing agreement. From this we build a lean set of rules, an understandable usage policy for employees, and training that genuinely satisfies the literacy obligation rather than just ticking it off.

Concrete deliverables