Artificial intelligence surrounds us everywhere and not surprisingly, regulation is not trailing far behind. The EU has tackled the overarching topic of our time via the so-called AI Act.
AI Act coming into effect over time
The AI Act was published on August 1, 2024. Most parts of it only apply after 24 months, presumably from August 2026 on. Yet, AI systems with unacceptable risk are already prohibited since February 2025. Sections regarding AI models with a general purpose apply since August 2025. The remaining AI Act needs to be implemented into national law until August 2026.
Differentiation according to risk class and obligated party
As the steps in effect show, the AI Act differentiates according to the risk class. AI systems with unacceptable risk are already prohibited; this includes mainly severe infringements of personality rights of natural people, e.g. via profiling; less severe infringements qualify as "high" risk. Any other AI that interacts with people has limited risk. Any remaining AI has a low risk profile. Most AI systems will either have limited or low risk.
What does this mean for companies that employ artificial intelligence? The AI Act again differentiates between obligations for providers and users.
Providers
Provider in the context of Art. 3 no. 3 AI Act means "a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge." In contrast to providers, users under Art. 3 no. 4 AI Act only employ an AI system for their own purposes.
User obligations
Most companies do not develop their own AI, but only use and train AI of third party providers. If you use a Chatbot for customer service by a third party provider, you only have to comply with user obligations. As long as the usage is permitted, the main obligations are for transparency and disclosure under Art. 50 para. 4 (2) AI Act. Additionally, users need to ensure that the obligations under the AI Act (e.g. risk assessment) are and remain met throughout the usage.
Example of AI mining of company data
This can be demonstrated in a sample case: A company "crawls" or "mines" publicly available data of other companies using a self-trained, specialized AI offered by a third party. The data are edited and prepared for customers.
AI Act
Since the AI does not have a general purpose, but a specialized one, and since the risk is acceptable, the AI Act only applies from August 2026 on. The "profiling" is of companies, not of natural persons. The AI does not communicate with people either. Hence, the risk should be qualified as low.
The company is only a user in the meaning of the AI Act because it did not develop the AI system, but only trained it with data, which does not constitute development. Furthermore, the company does not place the AI on the market, but only the created results. This means that the company must only disclose the AI usage and monitor the compliance with the AI Act requirements of AI throughout the usage.
Further laws: GDPR, Law Against Unfair Competition and Act on Copyright and Related Rights
Checking the business model should not stop at the AI Act though: GDPR only applies when processing personal data. For company data this could be personal email addresses or names of officials such as managing directors. The data subjects should be informed of the processing according to Art. 14 GDPR, whereas simply having a privacy policy under Art. 13 GDPR does not suffice.
The data usage could be unlawful under the Unfair Competition Act (UWG). One needs to make sure that the usage is not deceptive, disparaging or imitating according to ยง 4 no. 2, 3 and 5 UWG.
The copyright situation is more complex. If the data source surpasses the threshold of originality, it is protected as copyright. If the rightholder has withheld the usage rights in the data source, the data mining is unlawful.
Conclusion
As you see, the AI Act does not require much work from most tech companies, but only a couple of steps of implementation. However, AI usage may also touch other areas of law, each of which may legally prevent such usage. Therefore, it will be worth it hiring a lawyer with a broad scope in all areas of business law with checking your business model and drafting your terms and conditions.
Published on 15.09.2025