The EU AI Act is transforming how companies approach due diligence during acquisitions, as buyers now inherit not only contracts and balance sheets but also potentially non-compliant KI-Systeme.
Many organizations still fail to examine AI tools operating in the background, even though the regulation applies to any entity deploying such systems, including mid-sized manufacturers and family businesses using AI for production control or applicant screening.
High-Risk AI Systems in Everyday Operations
The EU AI Act (Verordnung (EU) 2024/1689) classifies numerous widely used tools as high-risk. These include KI-Tools that automatically pre-select job applications, evaluate candidates, or monitor employee performance in Personalwesen. Biometric time-tracking and access-control systems using facial recognition also fall under the high-risk category regardless of their marketing description.
This creates a structural misunderstanding: the law targets users and deployers of AI, not only technology developers, meaning ordinary companies can suddenly face substantial regulatory exposure.
Staggered Implementation Timeline
Obligations for general-purpose AI models became fully applicable on 2 August 2026, with fines enforceable under Article 113. Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to achieve compliance.
High-risk systems referenced in Article 6(2) and Annex III, such as those in HR and workplace biometrics, must meet all requirements from 2 December 2027. Systems integrated as safety components in regulated products follow the later deadline of 2 August 2028.
Contractual and Regulatory Implications
Purchase agreements must now explicitly address which AI systems are in use, when they were introduced or modified, their risk classification, and documentation status. Questions also arise about liability when the buyer implements changes after closing that trigger new compliance duties.
National enforcement remains fragmented: Germany has yet to finalize division of market surveillance responsibilities between federal and state authorities, while Italy has assigned clearer powers to the ACN (Agenzia per la Cybersicurezza Nazionale). Maximum fines reach 35 million euros or 7 percent of worldwide annual turnover for prohibited practices and 15 million euros or 3 percent for transparency violations.
These amounts are increasingly factored into purchase-price negotiations, indemnification clauses, and MAC provisions in cross-border transactions.
