The EU AI Act as a To-Do List for Organizations

The EU AI Act came into force on 1 August 2024. Most obligations apply from 2 August 2026. That sounds like time – but it's clearly too short in practice if an organization only reacts when the deadlines hit.

What surprises me again and again in conversations with organizations: many think the EU AI Act is a topic for large corporations. For data protection officers, legal departments, IT compliance teams. Not for an association with twelve employees or a social-services organization with thirty.

That's wrong. The EU AI Act applies to every organization that uses or wants to introduce AI systems. Including small and medium-sized businesses, NGOs, associations and social-services providers.

What the EU AI Act means in practice

The EU AI Act classifies AI systems by risk class. The higher the risk, the stricter the requirements. For most organizations, three aspects are particularly relevant:

1. AI literacy becomes mandatory.Organizations must ensure that the people who use AI understand the basics. This includes knowledge of how AI works, its limits, risks and responsible application. AI literacy is no longer optional – it's a regulatory requirement.

2. Transparency and documentation.Which AI systems are in use? For what? Which data flows in? Which decisions are influenced by AI? These questions must be answerable. Not in extensive documentation – but in a traceable overview.

3. Risk assessment.Not every AI application is risky. But the organization must be able to estimate where particular caution is required. This applies especially to applications that evaluate people, prepare decisions or process sensitive data.

Why legal perfection isn't the point

Many organizations wait until the legal situation is fully clarified. That's understandable, but strategically wrong. The EU AI Act doesn't require legal opinions for every application. It requires awareness, structure and traceability.

Concretely, that means:

• A list of the AI systems in use

• A rough risk assessment for each application

• Clear usage rules for the team

• A responsible person or role

• Basic training for all users

That's not a huge administrative effort. It's a manageable organizational measure that would make sense even without the EU AI Act.

A real-world example

An association with 20 employees uses ChatGPT for drafts and research. So far, there are no rules, no documentation and no training. Some employees enter customer data into the tool, others refuse to use it entirely.

After a brief inventory, the following is agreed: ChatGPT may be used for drafts without personal data. For internal documents, an enterprise license with a data processing agreement is being evaluated. All users receive a two-hour introduction to functioning, limits and usage rules. One person takes on the role of AI officer.

The result: usage becomes more orderly, risks are contained, documentation exists, AI literacy in the team grows. No legal opinion needed – just clear decisions.

What this means in practice

The EU AI Act is not a threat. It's an occasion to organize AI use in a way that is traceable, responsible and sustainable. Organizations that tackle this now have a clear advantage over those that wait.

Mini checklist

• Is it known which AI systems are used in the organization?

• Is there a rough risk assessment for each application?

• Are usage rules formulated for the team?

• Is a person designated as responsible for AI?

• Have all users received basic AI training?

Read more:Detailed information on the practical implementation of the EU AI Act on the pageImplementing the EU AI Act.

If you'd like to clarify what the EU AI Act concretely means for your organization – let's go through your current AI use, risk classification and next steps in an initial conversation.

Frequently asked questions

When does the EU AI Act apply to small businesses?Most obligations apply from 2 August 2026. For high-risk AI systems, earlier deadlines apply. Small businesses are not exempt – but the requirements are usually manageable and can be implemented without legal opinions.

What does an organization need to document under the EU AI Act?At minimum: an overview of the AI systems in use, a rough risk assessment and clear usage rules. Not extensive documentation, but a traceable basis.

What does the AI literacy obligation in the EU AI Act mean?Article 4 of the EU AI Act requires organizations to ensure that people using AI have a basic understanding of how it works, its limits and risks. This isn't a certification – but training that should be documented.

Does the EU AI Act also apply to NGOs and associations?Yes. The EU AI Act applies to every organization that uses or provides AI systems – regardless of size or legal form. For small organizations, the requirements are manageable in practice.

• European Union, Regulation (EU) 2024/1689 (AI Act),

• AI Act Explorer, EU AI Act Full Text,

• European Commission, AI Act – Shaping Europe's digital future,

• OECD, AI Principles,

• ENISA – European Union Agency for Cybersecurity, AI Act guidance,