EU AI Act compliance

Demonstrable compliance under the EU AI Act for companies in Germany, Austria, and Switzerland

Risk classification, process documentation, audit-ready evidence, and the overlap with the GDPR. What Articles 6, 9, 10, and 13 require, anchored in day-to-day operations instead of attested after the fact.

EU AI Act: what an institution actually has to produce

  • Risk classification of your AI systems: prohibited practices (Article 5), high-risk AI systems (Article 6 with Annexes I and III), transparency obligations (Article 50), and minimal risk.
  • Data governance under Article 10: the origin of the underlying data, bias review, and representativeness.
  • Technical documentation under Article 11 and Annex IV: description of the system, method, and evaluation criteria.
  • Transparency: information for deployers under Article 13, transparency toward affected persons under Article 50, and the right to an explanation under Article 86.
  • Where this overlaps with the GDPR: lawful bases under Article 6, automated decisions under Article 22, and data protection impact assessments under Article 35.

Four risk tiers, four control levels

The regulation classifies AI systems by risk. The tier determines what an institution has to produce. As of October 2026 · not legal advice.

Diagram as text

  1. ProhibitedArticle 5

    Typical systemsSocial scoring, real-time remote biometric identification in publicly accessible spaces

    What is requiredProhibited. Use is ruled out; the regulation allows only narrow exceptions, for example for law enforcement.

  2. High-riskArticle 6 with Annexes I and III

    Typical systemsCreditworthiness assessment, recruitment, access to education

    What is requiredConformity assessment, technical documentation, data governance, logging, and transparency.

    This is where SIMO works

  3. LimitedArticle 50

    Typical systemsChatbots, generated content, deepfakes

    What is requiredTransparency obligation. People must be able to recognize that they are interacting with an AI system or AI-generated content.

  4. MinimalArticle 95

    Typical systemsSpam filters, recommendation logic, video game characters

    What is requiredNo specific obligations under the regulation. Voluntary codes of conduct under Article 95 are possible.

We set up your operations so that this evidence is generated in the course of everyday business: evidence from the outset, not a compliance stamp applied after the fact.

Related topics

Next step

Does SIMO fit your situation?

A 45-minute initial call: a candid assessment of whether SIMO is the right partner for your question.

Book an initial call

45 minutes, by video, free of charge.

Start the check

How ready is your decision? Check it in 3 minutes.

Call +49 6021 625 63 40