EU AI Act in Practice: The NENNA Guide to AI Compliance and Governance

The European Union has made history with the Artificial Intelligence Act (AI Act for short). The EU Parliament has established a comprehensive legal framework for artificial intelligence for the very first time. This is a set of regulations that sets global benchmarks.

The regulation is a response to the rapid growth and increasing integration of AI into economic and societal processes. The EU wants to ensure that AI technologies improve people's lives, enable innovation, and do not create risks for users and society. In particular, the AI Act excludes applications that are incompatible with European values and ensures controlled conditions for the deployment of high-risk AI systems.

For companies developing or deploying AI, this regulation represents a fundamental change in the compliance landscape. It is worth making a conceptual distinction here: an AI model is the basic technical component. Trained on data, developed by providers such as OpenAI, Google, or Meta, and on its own, it is not yet a ready-to-use solution. An AI system, on the other hand, is the ready-to-use solution that embeds one or more such models and turns them into a specific application, for example for legal research or creating job advertisements, through infrastructure, interfaces, as well as control and monitoring processes. The EU AI Act primarily regulates AI systems, meaning practical deployment, not the model as such. This editorial explains what the EU AI Act specifically regulates, who it affects, and which actionable steps companies need to take now.

What does the European AI Act regulate? Basic principles and protection goals

The EU AI Act is a regulation for governing artificial intelligence, introduced with the aim of promoting human-centric AI in Europe while ensuring a high level of protection for health, safety, and the fundamental rights of citizens. It is not about banning AI per se, but rather about a differentiated regulation depending on the risk of the respective application. The risks and potential uses of AI systems are comprehensively addressed, and companies are obliged to comply with clearly defined standards.

The heart of the regulation is a risk-based approach that classifies AI systems into four categories. The higher the risk of an AI application, the more comprehensive the compliance requirements are. This pragmatic path concentrates the strictest specifications on systems that could actually cause significant harm, while low-risk applications remain largely unregulated.

Timeline and transition periods: Your compliance roadmap

The regulation was published in the EU Official Journal on 12 July 2024 and entered into force twenty days later, on 1 August 2024. Practical application is phased. Regulations on prohibited AI practices have already been in force since February 2025. The majority of the rules will become applicable after one to two years, while the comprehensive obligations for high-risk AI systems were originally planned for August 2026.

However, these deadlines are currently in flux: as part of the European Commission's seventh Omnibus package, the relevant parliamentary committees voted in favour of postponing the high-risk requirements. Specifically, two new dates are proposed: 2 December 2027 for high-risk systems explicitly mentioned in the law (such as those in the fields of biometrics, education, employment, or law enforcement) as well as 2 August 2028 for AI systems falling under sector-specific EU product safety regulations. The plenary of the European Parliament must still approve this, followed by negotiations with the Council of the EU. The final deadlines are therefore not yet legally binding (Steinschaden & newsrooms.ai, 2026).

For companies, this means that the first window of opportunity has already closed. Since the beginning of 2025, organisations have had to ensure they do not develop or deploy prohibited AI systems. The potential extension of deadlines for high-risk requirements provides more planning time. However, it does not release anyone from the strategic preparation that should start now.

Scope: Which companies are affected by the EU AI Act

The regulation applies to everyone who places AI systems on the market or puts them into service in the EU, regardless of where the company is based. An American or Chinese company offering AI services to the European market is subject to the same requirements as a European provider.

In doing so, the EU AI Act distinguishes three relevant roles that are decisive for compliance responsibility:

Providers are companies that develop an AI system and make it available on the market (for example as a SaaS solution). They bear the primary responsibility for compliance with regulatory requirements, transparency, and safety of the system.

Deployers use an AI system in their own operations without redistributing it (for example for internal HR processes or customer service). They are responsible for safe operation and risk control within their context of use.

Users use a model or system "as is", meaning without significant integration of their own, typically for internal purposes. Crucially, the obligations of the EU AI Act are always directed at the AI system and the respective role in handling it, not at the underlying AI model alone. Anyone who integrates a model like GPT-4 into their own application and offers it becomes a provider of an AI system and bears full regulatory responsibility for it.

For the countries of the European Economic Area (Iceland, Liechtenstein, Norway), the adoption of the regulations is still open. Companies with EEA connections should monitor developments closely, as later adoption is highly likely.

Already existing AI systems and general-purpose models are subject to separate transitional arrangements.

The four risk categories: How to classify your AI systems correctly

To understand their own compliance requirements, companies must first classify their AI systems correctly. The regulation distinguishes four risk levels, each with different specifications:

Category 1: Prohibited AI systems (Unacceptable Risk) are at the top of the regulatory ladder. This refers to systems that are incompatible with European values and are therefore completely banned. This category is small but precise. It covers types of applications that severely infringe on fundamental rights and human dignity.

The bans are precisely formulated and affect four specific practices. Systems designed to predict future criminal behaviour of individuals are banned, as are AI applications that manipulate people without their knowledge. An example would be an inaudible tone in lorry cabs that unconsciously prompts drivers to drive longer than is healthy, with AI determining the optimal frequency. Systems that exploit the vulnerabilities of specific groups of people are also prohibited. For example, a smart doll that encourages children to engage in dangerous behaviour. The third prohibited category covers social scoring systems that comprehensively evaluate people based on their social behaviour. The fourth category concerns real-time remote biometric identification in public spaces for law enforcement purposes, though narrow exceptions exist for victim searches, counter-terrorism, or serious crime.

Category 2: High-risk AI (High Risk) forms the core of the regulation. These systems are not banned but are subject to extensive requirements. The high-risk classification arises in two ways. Firstly, AI systems are considered high-risk if they are used in products or safety components that are already strictly regulated, such as medical devices or lifts. Secondly, AI applications in certain sensitive areas fall into this category: biometrics, critical infrastructure, education and vocational training, employment and HR management, access to essential private and public services, law enforcement, migration and border control, as well as the administration of justice and democratic processes.

The European Commission will publish a detailed list of practical examples specifying which applications are considered high-risk no later than 18 months after entry into force, meaning in the near future. For these systems, providers must establish a risk management system, use high-quality data, maintain comprehensive technical documentation, guarantee transparency, enable human oversight, and ensure robustness as well as cybersecurity. The CE marking indicates that the system complies with regulatory requirements.

The technical implementation of cybersecurity requirements requires a deep understanding of current threats to AI systems, particularly for large language models. Evasion attacks, where attackers try to bypass security mechanisms, pose a growing challenge. Companies should implement a multi-layered security approach that combines preventative measures such as secure prompt development, server-side input validation, and continuous threat modelling (Federal Office for Information Security [BSI], 2026).

A central protective mechanism is the automatic masking of sensitive data in prompts and documents. European SaaS platforms offer GDPR-compliant solutions for this, and NENNA.AI even provides a truly data-secure solution that automatically detects and masks sensitive information prior to processing. This prevents personal or business-critical data from being passed on to external AI models. This is because NENNA.AI connects these models via their APIs, but processes the data exclusively within its own, European system infrastructure. This creates an important technical protective layer for compliance with the cybersecurity requirements of the AI Act.

Category 3: AI systems with specific transparency obligations include applications such as chatbots or emotion recognition systems. Here, the duty applies to inform users that they are interacting with an AI, unless this is obvious.

In addition to user information, internal transparency obligations are also relevant: companies must be able to prove which AI systems are used by whom, when, and for what purpose. Especially when using external AI services, compliance with GDPR and the EU AI Act is often difficult to track. Here, European platforms like NENNA.AI with made-in-Germany infrastructure and 100% EU server locations provide a compliant foundation. Through browser integration, AI usage can be centrally controlled and documented across the entire company, making both transparency and accountability obligations significantly easier.

The use of emotion recognition or biometric categorisation systems must also be made transparent. For synthetic content such as deepfakes, there is also a marking requirement, unless this would affect fundamental rights or public interests.

Category 4: AI systems with minimal or no risk are practically not subject to the regulation. Many everyday AI applications fall into this category. The Commission and member states promote voluntary codes of conduct here, leaving compliance to the discretion of the companies.

High-risk AI in practice: Your path to CE marking

For high-risk AI systems, compliance follows a structured process. First, it must be determined whether a system is actually to be classified as high-risk. Subsequently, the provider checks compliance with all requirements of the regulation. A formal conformity assessment procedure documents compliance with the specifications before the system can be fitted with the CE marking and placed on the market.

Providers must establish a quality management system that ensures continuous compliance with all requirements. The technical documentation must contain all relevant information on the system and be continuously updated. Logging functions enable seamless tracking of system behaviour. Following successful conformity assessment, the system is registered in an EU-wide database, the CE marking is affixed, and a declaration of conformity is signed.

General Purpose AI (GPAI): Compliance requirements for foundation models

Another focus is on specifications for General Purpose AI models (GPAI). These large language models or foundation models, trained for a variety of applications, will have to take increased organisational and technical precautions in future. Providers are subject to expanded information and documentation obligations to create transparency about training methods, data sources, and system capabilities.

Post-market monitoring: Continuous compliance after market launch

An often underestimated requirement is continuous monitoring after market launch. Providers must actively and systematically collect, document, and analyse data on the reliability, performance, and safety of their systems throughout their entire lifecycle.

For companies using various AI models in their operations, this represents a particular challenge: controlling and tracking AI usage across all systems. Platforms with central access to multiple AI models like NENNA.AI, which integrate over 300 models from different providers (OpenAI, Anthropic, Google, Mistral, etc.), enable consolidated monitoring and documentation of AI usage. Furthermore, such systems help to control so-called shadow AI usage, meaning the unregulated use of AI tools by employees, which presents a significant compliance risk.

In the event of substantial modifications to a system, a new conformity assessment is required. This applies, for example, if the intended purpose changes or if a continuously learning system begins to learn outside of predefined parameters.

Serious incidents or malfunctions that lead or could lead to fundamental rights violations must be reported to the relevant authorities immediately. Companies should establish robust processes for incident response to enable swift action.

Authorities and enforcement: The EU's new AI governance architecture

The regulation creates a new governance architecture at both EU and national levels. At the EU level, two central institutions are relevant:

The European Artificial Intelligence Board, composed of one representative from each of the 27 member states, coordinates implementation across borders and advises the Commission (AI Act Law, n.d.). In addition, the AI Office of the European Commission monitors and enforces the requirements of the AI Act, particularly for providers of general-purpose AI models (GPAI) (Artificial Intelligence Act, 2024).

At the national level, member states designate competent authorities and set up single points of contact to act as contact points for companies and citizens. In Germany, this is the Federal Network Agency (BNetzA), acting as the market surveillance authority and single point of contact. The Federal Office for Information Security (BSI) has a supporting role in other areas of IT security, but is not the central point of contact for AI Act compliance.

High-risk AI systems are registered in a publicly accessible EU database. This transparency allows authorities, users, and the public to gain insight into the high-risk systems available on the European market.

Violations of the regulation are sanctioned with heavy fines. This makes compliance a strategic necessity, not an optional question.

Regulatory sandboxes and SME support: How the AI Act fosters innovation

The regulation is not exclusively restrictive, but also fosters innovation. Regulatory sandboxes offer controlled testing environments in which companies can develop and test their AI systems under regulatory supervision before they fully hit the market. This tool lowers barriers to entry and particularly enables start-ups and smaller companies to develop innovative solutions without having to meet all compliance requirements immediately.

In addition, the regulation provides for targeted support measures for SMEs, such as advice or simplified documentation requirements under certain conditions. These measures are designed to ensure that regulation does not inhibit innovation, but directs it into orderly channels.

Your AI Act compliance strategy: Steps to take in three phases

Based on the AI Act, companies should establish a structured approach in three phases.

Phase 1: Immediate measures (effective immediately) are already required now. Companies must check whether they develop or deploy prohibited AI systems and, if so, discontinue them immediately. An initial inventory of all AI systems used and developed creates the necessary transparency for further steps.

Phase 2: Medium-term preparation (up to 2026/2027) includes the systematic classification of all AI systems according to risk categories. For high-risk AI, companies should start preparing for conformity assessments, build documentation processes, and establish a quality management system.

A first practical step is the recording of all AI systems used in the company, both officially approved and unofficial tools that employees use independently. It is precisely this shadow AI usage that harbours significant compliance and security risks, as sensitive company data can be transmitted to external services in an uncontrolled manner. European platforms like NENNA.AI address both challenges: through data-protection-compliant alternatives, they create incentives to use official channels, while simultaneously enabling complete transparency of AI use in the company through central access management.

Registration in the EU database and CE marking must take place in good time before the full entry into force of the high-risk requirements.

Phase 3: Long-term compliance structures (from 2027 onwards) secure permanent compliance. Processes for post-market monitoring must be established to continuously monitor the performance and safety of the systems. Incident reporting processes enable rapid reaction to problems. Training programmes ensure that all relevant employees know and implement the requirements. Continuous monitoring of regulatory developments, such as the Commission's announced detailed lists, makes it possible to react to changes in good time.

An often overlooked but crucial aspect for audits is the systematic training of all relevant employees. AI cybersecurity training should be phased according to roles and responsibilities: developers need different knowledge than deployers or compliance officers. These training sessions not only document compliance efforts, but actively reduce security risks caused by human error (BSI, 2026).

Fines and sanctions: What is threatened in case of violations

The regulation provides for a system of sanctions, although the exact amounts of fines are not fully detailed in the available documents. What is clear is that violations of the regulation are sanctioned with heavy fines. This makes compliance not an optional question, but a strategic necessity.

Technological compliance solutions: Where automation makes sense

Particularly when implementing complex compliance requirements like the EU AI Act, traditional documentation and monitoring methods reach their limits. Modern compliance management systems can provide significant relief here. They enable the structured recording and classification of all AI systems in the company, automate documentation processes, and ensure that all required proof is fully available.

Specifically, for the use of external AI services like ChatGPT, Claude, or Gemini in European companies, the challenge of data-protection-compliant use arises. While these services themselves often use non-European infrastructures, specialised European platforms like NENNA.AI enable GDPR- and EU AI Act-compliant access to over 300 such AI models. NENNA additionally protects the data through integrated automatic masking of sensitive data, thereby preventing personal or business-critical information from leaving the European legal infrastructure. For companies with particularly high security requirements, NENNA also offers on-premise solutions that guarantee complete data sovereignty.

Technology-supported compliance becomes particularly valuable in post-market monitoring. Automated monitoring systems continuously capture performance data, detect anomalies, and trigger warnings when predefined thresholds are exceeded. This significantly reduces manual effort while simultaneously increasing the reliability of monitoring.

The management of conformity assessments, preparation for audits, and communication with authorities can also be made much more efficient through specialised software. Integrated workflows ensure that all necessary steps are carried out on time, and central document repositories enable quick access to all relevant information.

Conclusion: Your next steps to AI Act compliance

The European AI Act marks a turning point in the regulation of artificial intelligence. It is not prohibitive, but differentiating. It bans the most harmful and regulates the high-risk, while leaving room for innovation. For companies, this means that anyone who uses or develops AI systems must act immediately. Although the phased application provides a little time, the first phase of bans is already over. Companies should now systematically analyse their AI systems, build their compliance structures, and develop a plan with their technical teams and legal departments on how to meet the requirements. Those who act early avoid expensive restructuring later and can also benefit from support instruments like "regulatory sandboxes".

Compliance is complex, but your solution does not have to be. While you work on your AI Act strategy, AI usage in your company continues. Every day, new risks arise from uncontrolled shadow AI, unprotected prompts, and missing documentation.

NENNA.AI closes this gap from day one: automatic data protection, central control, and complete transparency of all AI activities, compliant and data-secure. Learn more about NENNA.AI and how we support companies in the data-protection-compliant use of AI.

Read everything about shadow AI here!

Sources

AI Act Law. (2024). Article 65. The AI Office: What is it, and how does it work? https://ai-act-law.eu/de/artikel/65/

Artificial Intelligence Act. (2024a). The Act. https://artificialintelligenceact.eu/de/das-gesetz/

Artificial Intelligence Act. (2024b). Overview: The AI Office. https://artificialintelligenceact.eu/de/the-ai-office-summary/

European Union. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L 1689. https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:32024R1689

Federal Office for Information Security. (2026). Evasion Attacks on LLMs – Countermeasures in Practice: A guide to handling prompt injections, jailbreaks, and adversarial attacks (Version 1.0). https://www.bsi.bund.de

Sioli, L. (2021). AI-Presentation-CEPS-Webinar-L.-Sioli-23.4.21.pdf. Shaping Europe's Digital Future.

Steinschaden, J., & newsrooms.ai. (2026). EU AI Act: Strict rules for high-risk systems postponed. Trending Topics. https://www.trendingtopics.eu/ai-act-strenge-regeln-fuer-hochrisikosystem-werden-verschoben/