Which EU AI Act obligations already apply to my business?
In short
Three sets of EU AI Act obligations already apply to your business: since 2 February 2025 the bans and the duty to support your staff's AI literacy, since 2 August 2026 the labelling of chatbots and AI content. Duties for high risk AI, for example in recruitment, only apply from 2 December 2027. Breaches can cost up to 15 million euros or 3 percent of turnover.
The EU AI Act does not require any insurance. Published premiums in Germany for cover relevant to damage caused by AI at work, as of October 2026.
Example
Typical range
IT professional indemnity, sum insured 125,000 euros, turnover up to 30,000 euros
190 euros a year
IT professional indemnity, sum insured 1 million euros, turnover up to 250,000 euros
440 to 590 euros a year
Cyber insurance, small business with 1 million euros turnover, sum 500,000 euros
from about 600 euros a year
Cyber insurance, trades or restaurants up to 500,000 euros turnover
from about 400 euros a year
Premiums from a published premium table and a cost overview.
Your premium depends on sector, turnover, sum insured and IT security.
Worked example
Trades business with 12 staff, uses a chatbot and a text generator
This is where a typical deployer stands under the EU AI Act in October 2026.
AI literacy
short training for the 4 users, recorded in writing
Banned practices
not affected, no emotion recognition
Chatbot on the website
AI notice at first contact
AI images of real customers in adverts
label as AI generated
High risk duties
not affected, no use in staff decisions
The business meets the obligations that apply today with a few hours of work. Only if it uses AI for candidate screening will further duties follow from 2 December 2027.
Who the EU AI Act applies to
The EU AI Act, Regulation (EU) 2024/1689, mainly distinguishes providers, who develop an AI system or offer it under their own name, and deployers, who use it in their own business. Most small and medium sized businesses are deployers: they use a chatbot, a translation tool or a text generator.
For deployers the EU AI Act obligations that apply today are manageable. The heavy duties with risk management, technical documentation and conformity assessment fall mainly on providers of high risk AI, and they do not apply yet.
What the Digital Omnibus changed in July 2026
With Regulation (EU) 2026/1744 of 8 July 2026, in force since 27 July 2026, the EU amended the AI Act. Duties for high risk AI under Annex III were postponed to 2 December 2027, those for AI in products under Annex I to 2 August 2028.
The AI literacy duty in Article 4 was also softened. Providers and deployers now have to take measures that support the development of AI literacy among their staff. They expressly do not have to guarantee a specific level for each individual. A new ban applies from 2 December 2026 to AI systems that create intimate images of an identifiable person without consent.
EU AI Act obligations that apply today
The table shows what a business that only uses AI has to do right now. What counts is always which AI you use and for what.
Obligation
Applies since
What you actually do
Support AI literacy (Article 4)
2 Feb 2025, softened since 27 Jul 2026
train or brief staff who use AI and keep a record
Avoid banned practices (Article 5)
2 Feb 2025
no emotion recognition of staff, no social scoring, no manipulative AI
Make chatbots recognisable as AI (Article 50 (1))
2 Aug 2026
notice at the latest at first interaction, mainly the provider's duty
Disclose deepfakes (Article 50 (4))
2 Aug 2026
label AI generated images, videos or voices of real people
Disclose AI text on matters of public interest
2 Aug 2026
not needed if a human reviews it and takes editorial responsibility
Not yet in force: high risk AI from December 2027
If you use AI for staff decisions, such as sorting job applications, promotions or performance reviews, you will be using high risk AI under Annex III. From 2 December 2027 deployers must, among other things, follow the instructions for use, assign human oversight, keep logs and inform staff in advance.
There is time until then, but not unlimited. If you buy a recruitment tool today, get the vendor to confirm in writing how it will meet the EU AI Act requirements from December 2027.
Fines and liability under the EU AI Act
Banned practices can be fined up to 35 million euros or 7 percent of worldwide annual turnover, breaches of other duties including transparency up to 15 million euros or 3 percent (Article 99). For small and medium sized businesses the lower amount applies. The Act itself sets no separate fine for breaching Article 4.
A lack of AI literacy can still be costly: if staff misuse AI and cause damage, German courts will ask what care the business took. Whether a policy covers fines at all depends on its terms, so do not rely on it. Professional indemnity (Vermögensschadenhaftpflicht) can cover customer claims after an AI error.
Help with insurance cover
Norman Nammert works as an insurance broker (Versicherungsmakler) and arranges professional indemnity, general liability and cyber insurance, checking whether your policies cover the use of AI in your business. The insurer pays the commission, so the advice is free for you.
Step by step
List which AI tools are used in the business and for what.
Check whether any of them falls under the bans, such as emotion recognition of staff.
Train staff who use AI and record what you did.
Label chatbots and AI generated images, videos or voices of real people.
If AI rates candidates or staff, plan for the duties from 2 December 2027.
Have your liability and cyber policies checked for AI clauses.
Checklist
List of all AI tools in use
No banned practices in use
AI literacy training done and recorded
AI notice in the chatbot and on AI content
High risk use checked and 2 December 2027 noted
Common mistakes
Assuming the EU AI Act only affects software makers
Confusing the postponement of high risk duties with a postponement of all duties
Publishing deepfakes in adverts without a label
Buying a recruitment tool without asking how it will comply from December 2027
Questions and answers
Frequently asked
Does the EU AI Act apply to my business if it is small?
Yes, there is no minimum size.
Small and medium sized businesses get some relief, for example the lower maximum fine.
Do I need an AI literacy certificate?
No.
Since the July 2026 amendment you must take measures to support AI literacy;
the Act requires no specific level or certificate.
Did the Digital Omnibus postpone all deadlines?
No.
Mainly the high risk duties moved, to 2 December 2027 and 2 August 2028.
The transparency duties have applied since 2 August 2026.
Do I have to label every AI text?
No.
Deployers must disclose AI text that informs the public on matters of public interest,
unless a human has reviewed it and takes editorial responsibility.
Who enforces the rules in Germany?
Since 29 July 2026 the Federal Network Agency (Bundesnetzagentur) is the central market
surveillance authority, with sector regulators keeping some areas.
Will insurance pay an AI Act fine?
Do not count on it.
Whether a policy covers fines depends on its terms.
What can be insured are third party claims after an AI error.
