The EU AI Act in Practice: How Companies Are Preparing for New AI Rules

In 2024, the European Union became a pioneer in AI regulation by approving the landmark EU AI Act. While the Act officially entered into force in May 2024, its full implementation is staggered, and 2026 is a critical year for many businesses. While prohibitions on certain unacceptable AI systems have been in effect since late 2024, the main obligations for high-risk AI systems will largely become applicable by mid-2026. This means preparation time is running out, and companies using or developing AI must act swiftly.

What Does 'High-Risk' System Mean Under the AI Act?

The foundation for understanding your obligations is identifying whether your AI system falls into the 'high-risk' category. The Act primarily defines high-risk AI systems in two groups: AI systems used in products subject to existing EU harmonization legislation (e.g., medical devices, aircraft safety components) and systems used in eight specific areas with the potential to significantly impact fundamental rights or safety. These include critical infrastructure, education, employment, migration management, and systems for credit scoring and access to services.

It's not always black and white. For instance, an AI system for personalized marketing recommendations might not automatically be high-risk. However, if it affects consumers' access to essential services (e.g., selectively preventing them from seeing certain offers based on AI profiling), it could become so. It is precisely in these nuances that the greatest challenge lies.

Case Study: An E-commerce Company and AI Personalization

Consider a mid-sized e-commerce company that uses an advanced AI system for personalizing product offerings to its customers. This system dynamically adjusts displayed products, prices, and recommendations based on purchase history, browsing behavior, and demographic data. In 2025, the company decided to prepare for the AI Act and conducted an internal audit. They found that while the system primarily boosted sales, in some cases where the AI model unintentionally excluded certain customer groups from accessing promotional offers or cheaper product variants, it could potentially be classified as high-risk.

Action Taken: The company had to redesign its algorithms to ensure transparency, non-discrimination, and the possibility of human oversight. They implemented a robust monitoring system that tracks the impact of personalization on different demographic groups and prevents unintentional exclusion. Processes for data logging and risk assessment were established. The entire preparation and implementation of these changes took approximately 10 months and required an investment of 150,000 EUR in software modifications and legal consulting.

Outcome: The company avoided potential fines (which can reach up to 7% of total worldwide annual turnover or 35 million EUR, whichever is higher) and gained a competitive advantage in trustworthiness and an ethical approach to AI. The implemented processes also improved data quality and personalization accuracy, leading to an 8% increase in conversions in the tested group.

Checklist: First Steps Towards AI Act Compliance

If your company uses or develops AI, it's time to act. Here's a simplified checklist to get started:

1. AI System Inventory: Map all AI systems your company uses or develops. Where are they deployed? What data do they process?
2. Risk Assessment: For each system, assess whether it falls into the 'high-risk' category according to the AI Act definitions. Focus on potential impacts on fundamental rights, safety, and transparency.
3. Gap Analysis: Compare your current state with the AI Act requirements (risk management, data quality, technical documentation, human oversight, transparency, cybersecurity).
4. Action Plan: Create a concrete plan to address identified shortcomings. Who will be responsible? What steps will be taken? What is the timeline?
5. Documentation: Begin building robust technical documentation for each AI system, including a description of its purpose, architecture, data used, and testing methodology.
6. Training: Ensure relevant employees (developers, managers, legal professionals) are trained on the requirements of the AI Act.

Consequence of Inaction and the Business Bridge

Ignoring the EU AI Act is not an option. Inaction can lead to astronomical fines, reputational damage, and loss of customer trust. Even the regulatory investigation itself can be a significant burden for a company, both financially and in terms of time. What seems like a bureaucratic hurdle is actually an opportunity to strengthen ethical standards and build trust in AI. This is precisely where a general guide is no longer sufficient. With the implementation of the AI Act, companies often struggle with interpreting complex legal texts and translating them into practical technical and procedural changes. At one-o-one.cz, we assist clients with AI system audits, risk identification, and setting up compliance processes that not only meet legislative requirements but also support innovation and business goals.

A Reasonable Next Step

Start with a thorough inventory of all AI systems within your company and conduct a preliminary assessment of their risk level. If you are unsure how to interpret the definitions of 'high-risk' systems for your specific use cases, or how to effectively set up compliance processes, consider consulting with experts specializing in this area. Don't wait until the last minute; a proactive approach always pays off in the long run.

FAQ

• Q: When exactly do the main obligations for high-risk AI systems come into effect?
• A: Most of the main obligations for high-risk AI systems will apply 24 months after the Act's entry into force, meaning by mid-2026. For systems falling under existing EU harmonization legislation, it might be even earlier.
• Q: What is the difference between an AI system provider and a deployer according to the AI Act?
• A: A provider is someone who develops or places an AI system on the market. A deployer is someone who uses an AI system in the course of their professional activity. Both have different, but complementary, obligations under the Act to ensure compliance.
• Q: Can companies rely on AI system suppliers to ensure full compliance?
• A: While AI system providers have primary responsibility for their systems' compliance with the AI Act, deployers also have obligations, for example, regarding human oversight, monitoring, and documentation. Relying solely on suppliers is risky; mutual cooperation and a proactive approach are necessary.