Updated in October 2026: fines and timeline reflect the adopted regulation and the Digital Omnibus of July 2026.
What companies need to know now
The EU AI Act is the world’s first comprehensive law regulating artificial intelligence. Its aim is to build trust and limit risks without slowing down innovation. For companies, that means clear rules and clear responsibility.
PLANET AI welcomes this step. As a European software company focused on document processes, we stand for transparency, data protection and fairness in how AI is used.
Why the EU AI Act matters
The AI Act applies to every company that develops, offers or uses AI systems in the EU, wherever it is based. High-risk systems are the main focus, but many other AI applications are subject to transparency obligations too. Violations can be costly: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for breaches of other obligations.
The timeline
- Since 2 February 2025: prohibitions on AI with unacceptable risk
- Since 2 August 2025: obligations for providers of general-purpose AI models (GPAI)
- Since 2 August 2026: transparency obligations, for example labelling AI-generated content
- From 2 December 2027: obligations for stand-alone high-risk systems, for example in HR, education or credit scoring
- From 2 August 2028: obligations for high-risk systems in regulated products such as medical devices or machinery
The EU moved the last two dates back with the Digital Omnibus in July 2026. That gives companies more time, but it still pays to prepare early.
“We must not repeat the mistakes of the General Data Protection Regulation with the AI Act.”
Dr. Ralf Wintergerst, President of Bitkom
The full text of the regulation (Regulation (EU) 2024/1689) is available on EUR-Lex.
How AI systems are classified
The AI Act classifies AI systems by their risk. The classification determines the obligations:
- Unacceptable risk: prohibited. For example social scoring or manipulative AI.
- High risk: strict requirements such as risk and quality management, documentation and human oversight. For example AI in medicine, HR or the justice system.
- Limited risk: transparency obligations. For example, chatbots and deepfakes must be recognisable as AI.
- Minimal risk: no additional obligations. For example spam filters or AI in games.
Important: the classification applies to individual applications, not to companies as a whole.
PLANET AI and the EU AI Act: our approach
PLANET AI develops AI for document analysis, with a clear focus on data protection, security and legal compliance. Our systems support people in processing information. The decision always rests with a human.
As a provider of AI systems, we ensure:
- Regular risk assessments
- Technical documentation of our AI systems
- Training for our staff on data protection, security and fairness
- Transparency about the use of external AI models, for example foundation models
As a deployer, where we use AI ourselves:
- We meet the transparency obligations
- We process data only within our customers’ processes and in line with the GDPR
Example: IDA Recognition SDK
The IDA Recognition SDK is based on our own patented recognition technology. It reads documents and makes no decisions about people. In our assessment it is therefore not a high-risk system. Data is processed in our customers’ environment. PLANET AI only accesses data temporarily as part of support, without storing it permanently.
What you can expect from PLANET AI:
- High standards in data protection and IT security, with an information security management system certified to ISO 27001
- Regular compliance training for all employees
- AI as support, not as a replacement for human decisions
- Compliant integration of general-purpose AI models (GPAI), for example foundation models
Conclusion
With the AI Act, the EU creates a binding framework for responsible AI. We see its requirements not as a hurdle but as an opportunity for more trust and quality. And because every step with us is traceable and a human makes the decision, our customers find it easier to meet the requirements.
How we put traceability and sovereignty into practice is described under Trust & sovereignty.