Question 1

What is the EU AI Act?

Accepted Answer

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law regulating Artificial Intelligence. It was adopted by the European Parliament on 13 June 2024, entered into force on 1 August 2024, and will be fully applied in stages by 2027. Its goal is to ensure safe and trustworthy AI in the EU while fostering innovation.

Question 2

Who does the EU AI Act apply to?

Accepted Answer

The EU AI Act applies to all companies that develop, distribute, or deploy AI systems – regardless of whether the company is based in the EU. What matters is whether the AI system is offered or used in the EU. This covers providers (developers), deployers (users of AI systems), importers, and distributors of AI systems.

Question 3

What risk categories exist?

Accepted Answer

The EU AI Act distinguishes four risk categories:

• Prohibited AI practices – e.g. social scoring, real-time biometric identification in public spaces, manipulative AI systems
• High-risk AI – e.g. AI in HR, credit scoring, education, critical infrastructure, law enforcement, migration
• Limited risk – e.g. chatbots, deepfakes, AI-generated content (transparency obligations)
• Minimal risk – e.g. spam filters, AI-powered games (no special obligations)

Question 4

What penalties apply for violations?

Accepted Answer

Fines are graduated by severity of violation:

• Up to €35 million or 7% of global annual turnover – for using prohibited AI practices
• Up to €15 million or 3% of annual turnover – for violations of high-risk requirements
• Up to €7.5 million or 1.5% of annual turnover – for providing false information to authorities

Reduced caps apply for SMEs and start-ups (Art. 99).

Question 5

What deadlines do I need to be aware of?

Accepted Answer

The EU AI Act is applied in stages:

• 2 February 2025 – Prohibited AI practices must be discontinued
• 2 August 2025 – Requirements for general-purpose AI models (GPAI)
• 2 August 2026 – Main deadline: High-risk AI systems and transparency obligations
• 2 August 2027 – Full application of all provisions, incl. certain high-risk systems per Annex I

Question 6

What counts as an AI system under the EU AI Act?

Accepted Answer

According to Art. 3, an AI system is a machine-based system that operates with varying degrees of autonomy and can produce outputs such as predictions, recommendations, decisions, or content. In practice, this includes tools like ChatGPT, Midjourney, custom ML models, AI-powered chatbots, image generators, voice assistants, and much more.

Question 7

Do I need a separate compliance project for each AI tool?

Accepted Answer

Not necessarily – it depends on the purpose of use, not the tool name. Examples:

• ChatGPT for customer service → 1 project
• ChatGPT + Midjourney + custom ML model (different purposes) → 3 projects
• A platform like Magica using multiple models internally but only for marketing → 1 project
• Same platform, but for marketing AND HR automation → 2 projects (different risk levels)

The purpose and associated risk level determine the obligations – not the brand name.

Question 8

How do I find out the risk level of my AI system?

Accepted Answer

Use our free compliance questionnaire. In just a few minutes, you can record your AI applications and receive an automatic risk classification according to the four categories of the EU AI Act. The result includes specific recommendations and relevant deadlines.

Question 9

I only use ChatGPT for emails – am I affected?

Accepted Answer

Yes, the use of AI-generated content is also subject to the transparency obligations under Art. 50. You must ensure that recipients can recognize when content is AI-generated. The good news: for minimal and limited risk, the requirements are manageable – our questionnaire shows you exactly what to do.

Question 10

Are there facilitations for small companies?

Accepted Answer

Yes! The EU AI Act explicitly provides facilitations for SMEs (small and medium-sized enterprises):

• Art. 62 – Simplified technical documentation
• Art. 57 – Preferential access to AI regulatory sandboxes
• Art. 68 – Reduced conformity assessment fees
• Art. 99 – Adjusted (lower) fine caps

Our tool automatically takes your company size into account and shows you the relevant facilitations.

Question 11

At what size is my company considered an SME?

Accepted Answer

The EU definition for SMEs (Recommendation 2003/361/EC):

• Micro-enterprise: up to 10 employees, annual turnover ≤ €2 million
• Small enterprise: up to 50 employees, annual turnover ≤ €10 million
• Medium enterprise (SME): up to 250 employees, annual turnover ≤ €50 million

Companies with more than 250 employees are considered large enterprises and have the full set of obligations.

Question 12

Why is company size asked in the questionnaire?

Accepted Answer

Company size directly determines which compliance requirements and facilitations apply to you. SMEs benefit from simplified documentation and reduced fees, while large enterprises must meet the full set of requirements. This makes our assessment more accurate and practically relevant for your specific situation.

Question 13

What does the free compliance check offer?

Accepted Answer

The free check includes:

• Recording of all AI systems in use
• Automatic risk classification per EU AI Act
• Detailed action recommendations
• Timeline with relevant deadlines
• PDF report via email

This serves as initial guidance to understand whether and how you are affected.

Question 14

What is a project in the Premium Toolkit?

Accepted Answer

A project in the Premium Toolkit refers to an AI system or AI application that requires its own compliance documentation – not every individual tool within a platform.

Examples:
• You use ChatGPT for customer service → 1 project
• You use a platform with multiple AI models, all for marketing → 1 project
• You use the same platform for marketing AND HR automation → 2 projects (different risk levels)

What matters is the purpose of use and the associated risk level – not the name of the tool or the number of models.

Question 15

What does the Premium Toolkit offer?

Accepted Answer

The Premium Toolkit enables full compliance implementation:

• Technical Documentation (Art. 11 & Annex IV) – 10 predefined sections with AI-powered text suggestions
• Risk Management (Art. 9) – Interactive risk register with severity matrix and AI risk analysis
• Conformity Assessment (Art. 43) – Checklist with 9 checkpoints and evidence tracking
• AI Assistant – Intelligent suggestions for all areas

Question 16

Does this tool replace legal advice?

Accepted Answer

No. Our tool is for informational purposes only and does not constitute legal advice. It provides a well-founded initial orientation and supports you with structured documentation. For binding compliance assessments and interpretation of the EU AI Act for your specific case, we expressly recommend consulting specialized legal advisors.

Question 17

How secure is my data?

Accepted Answer

Your data is stored on a European server (Hetzner, Germany) and is used exclusively for creating your compliance assessment. Transmission is encrypted (SSL/TLS). We do not sell or share your data with third parties. Further details can be found in our Privacy Policy.

Question 18

What are the transparency obligations under Art. 50?

Accepted Answer

Art. 50 obligates providers and deployers of certain AI systems to transparency:

• Chatbots must be labelled as AI – users must know they are interacting with an AI
• Deepfakes and AI-generated content (images, audio, video, text) must be labelled as artificially produced
• Emotion recognition systems must be disclosed

These obligations apply to all risk levels from 'limited risk' onwards.

Question 19

How must I label AI-generated content?

Accepted Answer

The EU AI Act requires that AI-generated or manipulated content (Art. 50(4)) must be machine-readably labelled. In practice, this means:

• Text content: Note such as 'This text was created with AI assistance'
• Images: Metadata labelling and visible notice
• Audio/Video: Labelling as AI-generated, especially for deepfakes

The exact technical standards are still being specified through implementing acts.

Question 20

“Nobody checks this anyway” – Is that true?

Accepted Answer

The risk doesn't only arise from an authority inspection. It's enough if a customer, business partner, data protection officer, employee, or applicant wants to know how AI is being used.

Especially with AI in HR, customer communication, scoring, analysis, automation, or content creation, the question quickly becomes:

“Can you prove how this AI system was evaluated?”

If there's no documentation, it looks unprofessional and risky.

Question 21

What happens if the lack of documentation is only discovered during an inspection?

Accepted Answer

AI compliance is not a single PDF that you create the night before. You need to document:

• Which AI systems are in use
• What they are used for
• What data is processed
• What risks exist
• Who is responsible
• What measures have been taken
• What changes were made later

Retroactively documenting all of this after something has happened is much harder than building it continuously.

Question 22

How severe are the penalties really?

Accepted Answer

The EU AI Act provides for significant sanctions. Depending on the violation, fines of up to €35 million or 7% of global annual turnover, or up to €15 million or 3%, may apply.

Of course, not every SME will immediately face maximum penalties. But the amounts show: legislators take this topic seriously.

Question 23

Is a compliance solution financially worthwhile?

Accepted Answer

A compliance system for €39, €99, or €149 per month is not a large investment compared to potential follow-up costs:

• External lawyer
• Data protection consulting
• Crisis communication
• Customer loss
• Exclusion from tenders
• Retroactive documentation under time pressure
• Reputational damage

The question is not: “Will I be inspected?”
The better question is: “What will it cost me if I'm unprepared?”

Question 24

Where do inspections come from in practice?

Accepted Answer

In practice, oversight often comes not from authorities first, but through other channels:

• Larger clients demand compliance evidence
• Public tenders require documentation
• Data protection officers review AI usage
• Employees ask about AI decisions
• Applicants challenge automated processes
• Partners require evidence in contracts
• Insurers or investors ask about risk management

The tool helps not only against regulatory risks, but also builds trust in the market.

Question 25

Don't you need an overview anyway – even without the law?

Accepted Answer

Even independent of the law, it's dangerous when nobody knows:

• Which AI tools are being used in the company
• Whether employees input customer data
• Whether sensitive data is being processed
• Whether AI results are adopted unchecked
• Whether content needs to be labelled
• Whether responsibilities are clarified

The EU AI Act Check first creates transparency. The Premium Toolkit turns this into a repeatable process.

Question 26

Why is accountability important for management?

Accepted Answer

For management, it's not just about whether everything is perfect. What matters is being able to show:

“We identified the issue, reviewed it, assessed it, and documented our measures.”

Without documentation, you're left with:
“We somehow dealt with it.”

That's not enough in a serious situation.

Question 27

Can compliance be a competitive advantage?

Accepted Answer

Companies that use AI transparently and with documentation can actively leverage this in sales:

“We use AI responsibly and document our systems according to EU AI Act criteria.”

This can be a real advantage with customers, partners, and larger clients.

Question 28

Which of these points does the Premium Toolkit specifically cover?

Accepted Answer

The Premium Toolkit covers all 7 key documentation obligations that become relevant from August 2026:

✅ Which AI systems are in use?
→ Section 1: System Overview

✅ For what purpose?
→ Section 2: Intended Purpose and Scope

✅ With what risk level?
→ Section 6: Risk Management Documentation + interactive Risk Register with severity matrix

✅ With what data?
→ Section 3: Data Management & Governance + Conformity Check Art. 10

✅ With what human oversight?
→ Section 7: Human Oversight + Conformity Check Art. 14

✅ With what measures?
→ Risk Register (mitigation per risk) + Conformity Checks (9 articles with evidence tracking)

✅ With what change history?
→ Section 9: Change Management + automatic Audit Log + Snapshot comparison

Also included: Algorithm & Model Description, Performance Metrics & Validation, Cybersecurity & Robustness, User Instructions, and an AI Assistant that generates text suggestions, risk analyses, and evidence.

Frequently Asked Questions

General – EU AI Act