An article by Johannes Pföstl, Senior Consultant at UnternehmerTUM
The EU AI Act is coming – and with it the world’s first comprehensive legal framework for the use of artificial intelligence. As a consultant at UnternehmerTUM, I work every day with startups, companies, and innovators who are asking: What does the new law mean for us? Here, I share the most important insights – concise, clear, and practical.
A Far-Sighted Law – With Clear Requirements
The EU AI Act pursues an ambitious goal: It aims to protect the fundamental rights of EU citizens while enabling innovation and strengthening Europe’s position as a leading AI location. The regulation is coming into force in stages from 2025 – with an impact on almost every company that uses or develops AI, and on small and medium-sized enterprises in particular.
The Risk-Based Approach: Four Levels, Four Different Sets of Requirements
What sets the EU AI Act apart is its risk-based approach: AI systems are not regulated across the board but are divided into four risk classes depending on their potential for harm – from “minimal risk” to “unacceptable risk”.
Basic principle: The greater the risk to individuals or society, the stricter the regulatory requirements. A helpful rule of thumb: The more human interaction or intervention in personal areas of life an AI system involves, the higher its risk classification.
The four categories at a glance:
- Unacceptable risk: AI systems with an unacceptable potential for harm – such as social scoring or manipulative behavioral control – will be prohibited.
- High risk: AI applications with a significant impact on people’s lives or living conditions – for example in recruiting, education, or safety-critical facilities – are subject to strict requirements, such as documentation, testing, and monitoring obligations.
- Limited risk: Applications such as chatbots or personalized advertising must meet transparency requirements – for example, users must be able to see clearly that they are interacting with an AI.
- Minimal risk: For everyday AI solutions with little intrusion – such as spell checkers or AI-assisted text suggestions – there are few or no regulatory requirements.
My tip: Check early on which risk class applies to your AI systems – this will save you time and effort during implementation later.
Provider or Deployer? Your Role Matters
Whether you develop AI systems yourselves or “only” use them: The AI Act sets clear requirements for both roles. Providers, for example, must submit documentation and risk assessments. Deployers must ensure that AI applications are used responsibly within the company – including building skills in the team.
AI Literacy: The New Must-Have for Companies
A key point that is often underestimated: AI literacy. The AI Act requires people who work with AI to have a “sufficient level” of know-how. What exactly this means is deliberately left open by the legislator – this calls for entrepreneurial responsibility and due diligence. My recommendation: Develop internal training concepts and make AI literacy part of your corporate culture.
Getting Started: Three First Steps
- Take stock: Which AI systems do you use? Which risk class applies?
- Build compliance: Clarify transparency obligations, technical documentation, and responsibilities.
- Establish governance: Set up processes for risk assessment, training, and monitoring.
Tools such as the EU AI Act Compliance Checker or the Risk Classification Database by appliedAI can help. And for the final classification, a legal review is worthwhile – especially for high-risk use cases.
My Conclusion
The EU AI Act will rewrite the rules of the game for AI in Europe. Those who act now have the chance to secure their legal position early and build trust with customers and partners.
At UnternehmerTUM, we’re happy to help you classify your AI projects – from strategic advice to concrete implementation.
Do you have questions or would you like to talk about your specific use case? Feel free to write to me directly: johannes.pfoestl@unternehmertum.de
