EU AI Act: What Mittelstand companies need to know now

The EU AI Act (Regulation (EU) 2024/1689) has been in force since August 2024 and takes effect in stages. For many Mittelstand companies, that triggers mixed feelings: relief that there are finally clear rules, but also uncertainty about what it actually means.

This article is the pragmatic take, not a legal opinion, but an overview for managing directors and IT leads who want to know what's coming.

As of June 2026. The deadlines for high-risk systems were pushed back with the "Digital Omnibus"; formal adoption is still pending.

The short answer up front

If you're a typical Mittelstand company using AI for standard applications (say, data analysis, document search, service chatbots or sales support), then most of the obligations are manageable for you. The strict requirements mainly hit providers and users of "high-risk AI" as well as prohibited applications.

The most important obligation for nearly all companies: AI literacy among your staff. That has applied since February 2025.

The four risk tiers: briefly explained

The AI Act divides AI systems into four categories:

Prohibited AI practices: social scoring by public authorities, manipulative systems, real-time facial recognition in public spaces (with exceptions). These applications have been banned since February 2025.

High-risk AI: AI systems used in critical areas, such as recruitment, creditworthiness assessment, medical devices or education. Here, extensive obligations apply around risk management, data quality, transparency and human oversight. The original deadline of 2 August 2026 was pushed back in 2026 with the "Digital Omnibus": to 2 December 2027 for most high-risk systems (e.g. recruitment, creditworthiness assessment) and to 2 August 2028 for AI embedded in products (e.g. medical devices). The relevant planning horizon is therefore the end of 2027. That's no reason to wait, though: you should start taking stock of your AI systems now.

Limited-risk AI: chatbots and AI-generated content above all. Transparency obligations apply here: users must know they are interacting with an AI. These transparency obligations take effect from 2026 (labelling of AI-generated content by the end of 2026).

Minimal risk: most AI applications in the Mittelstand fall under this: spam filters, recommendation systems, simple classifiers. No specific obligations from the AI Act apply here, but of course GDPR and other rules still do.

What does this mean for typical Mittelstand use cases?

Knowledge assistants and chatbots for internal use

Limited risk. You need to make sure users know they are interacting with an AI. For purely internal applications, this is usually unproblematic.

Automated document review and classification

In most cases minimal risk. It becomes critical when the classification has consequences under employment law (e.g. employee evaluation) or affects access to essential services.

Forecasting and prediction models

Minimal risk. It becomes high-risk when the predictions are used for personnel decisions, lending or similar areas.

Generative AI for marketing and content

Limited risk. You need to label content when it is AI-generated and conveys a strong impression of authenticity (deepfakes in particular).

The AI literacy obligation: what you need to do now

Since February 2025, the rule has been: providers and deployers of AI systems must ensure that their staff who use or supervise AI have an adequate level of AI literacy.

What that means in detail isn't spelled out. In practice it means: documented training for all staff who use AI systems, covering how it works, its limits, risks and accountability.

That is exactly the training we offer: the Nao Training Hub includes an AI-literacy programme under Art. 4, with your own rules and tools, a final quiz and a certificate as evidence per participant.

What you should do next

1. Inventory. Which AI systems are you already using today? Microsoft Copilot, ChatGPT use in sales or AI features in standard software all count too.

2. Risk classification. Classify each system according to the four risk tiers.

3. Training. Make sure your staff who use AI get documented foundational AI training. The Nao Training Hub shows what such training looks like with your own content, quiz and certificate.

4. For high-risk systems: consult specialised advice. This article is definitely not enough here.

What we can offer you

If you're planning AI systems or already running them, we address the regulatory questions early in Getting started with AI and in development projects, so they are reflected in concept and architecture.

We offer AI-literacy training under Article 4 through the Nao Training Hub: as a self-paced course on our platform or as live training, with your content, a final quiz and a certificate.

1. Book an intro call for a concrete assessment of your AI landscape.

2. AI readiness check for an initial baseline.