Blog

AI agents in business: what the AI Act and GDPR require

AI agents in business need no new legal category. Which rules of the AI Act and the GDPR apply depends on the agent's purpose and your role.

Credit scoring AI high-risk: when does it really apply?

Credit scoring AI high-risk under Annex III point 5: only credit checks on natural persons and life or health insurance count, not motor or property.

EU AI Act technical documentation: Who must prepare it?

EU AI Act technical documentation under Annex IV is a provider duty. Deployers are not covered unless they become providers themselves under Art. 25.

Is ChatGPT GDPR Compliant? What Companies Must Know in 2026

Is ChatGPT GDPR compliant? It depends on plan, contract and inputs. What Free, Plus, Business and Enterprise allow, and what companies need to put in place.

AI in Recruiting: What the New High-Risk Guidelines Mean for HR

"The AI only pre-sorts, people decide." Under the Commission's draft guidelines, that is no longer enough. Which HR tools count as high-risk, what has been prohibited since February 2025, and why using ChatGPT to rank applicants is the biggest trap.

AI governance: who decides what inside the company

AI governance rarely fails for want of rules — it fails because nobody is named who may decide. Why the EU AI Act fixes the role per system rather than per company, which four decisions need an owner, and why an AI committee is usually the wrong answer for a mid-sized business.

Deletion policies for AI systems: what must be kept and what has to go

The EU AI Act requires logs to be retained, the GDPR requires personal data to be erased — and both mean the same file. The four retention obligations in the AI Act, how Art. 17(3)(b) GDPR resolves the conflict, and why an AI system needs four data categories in a deletion policy rather than one.

What E-Learning Really Delivers: The Evidence Beyond the Marketing Numbers

"60 percent faster development", "80 percent higher retention": trace the most-quoted e-learning figures back and they run in circles between vendor blogs. What current DACH surveys actually show, which four advantages hold up to evidence, and where e-learning falls short of the classroom.

Buying AI: the documentation the provider has to deliver

Deployer obligations under Article 26 can only be met with documentation the provider has to supply: instructions for use, declaration of conformity, CE marking, EU registration. Which evidence to demand at procurement, when a buyer slips into the provider role, and what belongs in the contract on top.

EU AI Act Fines: How High They Really Are and Who They Hit

EU AI Act fines: €35m, €15m or 3 percent? What really applies to SMEs, who enforces it in Germany, and how the actual amount is determined. Longer summary (newsletter or LinkedIn intro): The penalty provisions of the AI Act have applied since August 2025, and since August 2026 the Federal Network Agency has been conducting market surveillance in Germany. That makes the question of fine levels a practical one. The headline figures are real but rarely explained: Article 99(6) reverses the standard rule for SMEs, so the lower of the two amounts applies rather than the higher. For a company with €12 million in turnover, a transparency breach caps at €360,000 rather than €15 million. The Digital Omnibus added a paragraph 6a in July extending that reversal to small mid-caps, with one catch almost no one has picked up: it covers paragraphs 4 and 5 but not paragraph 3, so prohibited practices remain exposed to the full amount. The article also sets out the ten criteria under Article 99(7) that determine the real figure, four of which depend directly on a company's own documentation, and closes on the point that an ordered shutdown usually costs more than the fine itself.

AI Phone Assistants in Companies: EU AI Act, Data Protection and AI Governance in Practice

AI phone assistants can automate calls, coordinate appointments and pass information to CRM, calendar or ticketing systems. At the same time, they raise questions around Article 50 of the EU AI Act, data protection, risk classification and responsibilities. In this article, we explain what companies should consider when introducing and operating these systems.

One AI System, Two Registers: Why Your AI Inventory and Your GDPR Record Belong Together

Your AI recruiting tool sits in the DPO's record of processing activities and in IT's AI list. Two files, two versions, maintained by two people who rarely talk. Which entries are captured twice, why the provider/deployer and controller/processor roles do not map onto each other, and how to record once and output both views.

AI Literacy Under Article 4: The Obligation That Has Applied Since February 2025 and Is Now Being Enforced

Article 4 has required providers and deployers to ensure AI literacy among their staff since February 2025. Since August 2026, market surveillance authorities have been enforcing it. What the Digital Omnibus actually changed, who is covered, and what is expressly not required.

Article 50 Applies from 2 August: What Changes for Companies Now Kategorie: EU AI Act · Reading time: approx. 7 min

The Digital Omnibus postponed the high-risk deadlines, but not Article 50. From 2 August 2026, companies must disclose when people are talking to an AI or looking at AI-generated content. Which four scenarios are covered, which exceptions actually hold up, and what the narrow transition period until December really covers.

What Actually Happens in an EU AI Act Audit? The Evidence Companies Should Have Ready

"We'll document that when it comes up" isn't a good answer once it actually comes up. What evidence companies typically need to produce under the EU AI Act — and how to prepare without turning it into a months-long project.

Shadow AI in the Workplace: The Real Compliance Risk of 2026

Marketing uses ChatGPT, developers use Cursor, sales uses Claude, HR uses Copilot, support uses Perplexity — and nobody in the company has the full picture. Why Shadow AI is becoming the central compliance risk of 2026, and how companies can regain visibility.

Labeling AI Content and Meeting Transparency Obligations

The European Commission has published its Code of Practice on labeling AI-generated content. This gives companies clearer guidance on how chatbots, deepfakes, and AI-generated text must be transparently labeled starting in August 2026.

The Omnibus Deal Is Done: What Really Changes for the EU AI Act Now

On 7 May 2026, Parliament and Council agreed on the Digital Omnibus on AI. The high-risk obligations shift to December 2027 and August 2028. What exactly was decided, which new bans are added, and why the extra time is no reason to pause.

The Forgotten AI Act Obligation: Accessibility for High-Risk AI Systems

Article 16(l) of the EU AI Act obliges providers of high-risk AI to ensure accessibility under the European Accessibility Act and Web Accessibility Directive. Why this often-overlooked obligation becomes a product safety and liability question, and what providers and deployers should do now.

Commission Clarifies High-Risk Classification: The Filter Mechanism and Its Limits

On 19 May 2026, the EU Commission published its draft guidelines on high-risk classification under Article 6. What the Article 6(3) filter mechanism allows, which three loopholes the Commission closes, and what companies should review now.

New EU Guidelines: When AI Systems Suddenly Become High-Risk

The European Commission’s new draft guidelines could classify significantly more AI systems as high-risk than previously expected. Why chatbots, copilots, and general-purpose AI systems may now become compliance-critical — and what companies should do next.

AI in Recruiting: Why It's High-Risk Under Annex III and What HR Leadership Must Do Now

AI in recruiting and workforce management is high-risk under Annex III of the EU AI Act. What that means for HR leadership, which tools are affected, and which strategic decisions need to be made at C-level now.

After Go-Live: What Deployers of AI Systems Actually Have to Do

An AI system going live isn't the end of compliance, it's the start of ongoing operations. The six obligations that continue, how to organize post-market monitoring under Art. 72, and when a deployer unintentionally becomes a provider.

What Happens If I Classify Wrong? Liability, Fines and Audit Risk Under the EU AI Act

A wrong AI risk classification has consequences across three dimensions: personal liability of management, fines of up to €15 million, and audit risk in market surveillance. A factual overview of what the EU AI Act and national law provide for.

From Pilot to Production: The 7 Most Common Compliance Gaps in Industrial AI

Most problems do not appear during the proof of concept but during the move into operations. These seven gaps show up again and again in industrial AI - and they are exactly where AI Act readiness often breaks down.

What Industrial Companies Really Need to Prepare Before August 2, 2026

Many industrial companies are still waiting for standards, guidance, or more legal clarity. That is understandable - but operationally too late. This article shows what can and should already be prepared before August 2, 2026.

Why “Limited Risk” Is the Most Underrated Topic in the EU AI Act

Most discussions about the EU AI Act focus on high-risk systems. In reality, the biggest challenge for companies lies elsewhere: limited risk. This article explains why this category matters most—and why it’s often overlooked.

EU AI Act in Practice: How a SaaS Company Documents Its AI Systems

How should a SaaS company document its AI systems? This article explains the practical requirements of the EU AI Act and how structured documentation ensures audit readiness.

Why Blackbox AI in FinTech Becomes a Risk (and What You Need to Do)

Blackbox models are widely used in FinTech – especially in credit scoring, fraud detection, and pricing. With the EU AI Act, this becomes a problem: decisions must be explainable, documented, and auditable. In this article, we outline the key risks and what companies need to do to stay compliant.

AI Compliance Software 2026: Which Tool Fits Your Company?

Enterprise platform, GRC tool, or specialized solution? The AI compliance software market is crowded. We break down the four categories, compare strengths and limitations, and show which tool fits which company size.

EU AI Act Risk Levels Explained: Minimal, Limited and High-Risk

What do minimal risk, limited risk and high-risk mean under the EU AI Act? This article explains how companies can classify AI systems in practice and avoid common mistakes.

AI Act for Startups-What small companies need to know in 2026

The EU AI Act applies to startups too. But it includes real relief: lower fines, sandbox access, simplified documentation. What founders need to know in 2026, from the provider vs. deployer question to risk classification.

EU AI Act Checklist: 7 Steps to Compliance by August 2026

From AI inventory to risk classification to an exportable compliance report: 7 concrete steps to get your company EU AI Act compliant by August 2026. With timeline, common mistakes, and a takeaway checklist.

Simpleact Pilot Programm

Test SimpleAct for 30 days with your team, your AI systems, and a jointly defined scope. You decide at the end.

August 2026 Is Coming: If You Don't Know Your AI Tools, You'll Pay for Them

ChatGPT, Copilot, Canva AI, recruiting tools, CRM systems – five AI tools almost every company uses. But which EU AI Act risk class do they fall into? We break it down – practical, no legal jargon.

Excel Has Hit Its Limits: Why Manual Lists Can't Keep Up With AI Documentation