EU Oversight of AI in Corporate Environments

Why AI in Companies is Under EU Supervision and What It Means

The European AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework for artificial intelligence, aiming to simultaneously support innovation and protect health, safety, fundamental rights, and democratic values. Unlike softer codes of ethics, it is a directly binding regulation that automatically applies in all member states, creating harmonized rules for the development, placing on the market, and use of AI systems.

From the perspective of entrepreneurs, this means that AI is no longer an "unregulated space" but an area with a level of regulation similar to personal data protection (GDPR) or cybersecurity (NIS2). On the other hand, the AI Act declaredly prevents the fragmentation of national regulations and is intended to ensure the free movement of AI products and services within the single market.

The key principle of the AI Act is a risk-based approach. The higher the potential impact of an AI system on health, safety, or fundamental rights, the stricter the requirements for its design, testing, documentation, supervision, and transparency.

At one end of the spectrum are systems with minimal or zero risk, for which the AI Act does not impose specific obligations; typically, these are common spam filters or AI in computer games. At the opposite end are prohibited practices with "unacceptable risk," which are simply banned in the EU without the possibility of a standard exception, and in the middle are systems with limited and high risk.

From the perspective of companies, it is crucial that the AI Act applies not only to technology companies developing their own AI models but also to a wide range of ordinary businesses that "only" implement AI in their processes. Therefore, when introducing internal AI tools, it often makes sense to address the legal setup of the entire artificial intelligence (AI) implementation, including roles and responsibilities under the AI Act. The regulation explicitly affects providers, importers, distributors, and so-called deployers (implementing entities), i.e., companies that use AI systems in their professional activities, including public authorities.

The extraterritorial reach means that obligations also arise for entities outside the EU if their AI systems or outputs are used in the Union. In practice, this means that, for example, a US or Asian provider of an AI solution deployed in the Czech Republic must respect European rules and often appoint an authorized representative in the EU.

It is also important that the AI Act does not exist in a vacuum. For companies, it intertwines with other regulations, especially GDPR, liability regulations, sector-specific regulations (banking, healthcare, energy), and newly also with rules for cybersecurity and the data economy. A practical framework on how to set up processes and responsibilities in a company so that these rules connect without unnecessary gaps is also summarized in our latest article AI governance in companies: How to do it right to avoid legal problems and fines. The legal reality is therefore more complex than mere "AI Act compliance" – when designing and deploying AI, it is typically necessary to simultaneously address personal data protection, contractual relationships with customers and suppliers, security standards, and tax implications.

In practice, the Czech legal team at ARROWS often sees that companies focus on only one of these regulations (such as GDPR) but underestimate the specific obligations of the AI Act or the connection to contractual liability, which can later lead to fines, disputes, and the blocking of key projects.

Timeline: What is already in force and what new EU guidelines have been added

The AI Act does not apply "all at once," but its effectiveness is spread over several phases, supplemented by secondary legislation, Commission guidelines, and voluntary codes of practice. From the perspective of corporate planning, it is essential to understand what is already enforceable today and what new obligations await businesses in the coming years. It is advisable to include contractual and security impacts in planning, which usually fall under the area of IT and software law, cybersecurity.

What applies from February 2025: Prohibited practices

From February 2, 2025, rules for "unacceptable" AI practices apply. First, a ban on eight types of AI practices considered incompatible with Union values and fundamental rights applies across the EU.

These include, among others, subliminal and manipulative techniques that fundamentally distort a person's ability to make free decisions. They also include systems that exploit the vulnerabilities of individuals due to age, disability, or socio-economic situation. Social scoring systems and certain forms of predictive policing are also considered prohibited. 

This also includes the untargeted scraping of biometric data from the internet for facial recognition purposes. Emotion recognition in the workplace and in educational institutions is also prohibited. The related security and compliance requirements (especially for public institutions) are discussed in more detail in the article Cybersecurity and the AI Act: Compliance for hospitals and public institutions. Biometric categorization based on sensitive characteristics also falls into this category. In principle, this also includes the use of AI for real-time biometric identification of persons in public spaces, except for narrowly defined exceptions. 

The Digital Omnibus (Regulation (EU) 2026/1744), applicable from December 2, 2026, added two more to these prohibitions. AI systems that create or manipulate realistic intimate or sexually explicit images, video, or audio of an identifiable person without their free, informed, and explicit consent, and systems creating child sexual abuse material will be prohibited. The provider is liable for the prohibited practice if such use is the intended purpose of the system, or is reasonably foreseeable and the system lacks appropriate technical safeguards; the deployer is liable if they use the system for such a purpose themselves.

Violations of these absolute prohibitions carry the highest penalties – up to EUR 35 million, or for undertakings, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. For small and medium-sized enterprises, the lower of the two values is used, but these are still potentially liquidating fines.

In practice, the Prague-based legal team at ARROWS finds that companies sometimes have no idea that certain HR tools, marketing technologies, or security systems can fall under prohibited practices – typically experimental emotion recognition of employees or students, aggressive behavioral marketing combining AI and psychometrics, or the use of untargeted photo scraping for facial recognition.

What applies from August 2, 2025: Rules for General-Purpose AI (GPAI) models

The second wave of obligations is represented by the rules for so-called General-Purpose AI (GPAI) models, which apply from August 2, 2025. These are models that have been trained with high computing power and are capable of generating text, images, audio, or video for a wide range of uses – typically large language models, image generators, or multimodal models that companies use today via APIs or cloud services.

Providers of these models must now ensure technical documentation describing the model's architecture, training methods, computing resources used, capabilities and limitations of the model, and typical risks of use. Furthermore, they must publish a summary of the training data used to train the model, according to a template prepared by the Commission, and set internal rules ensuring respect for copyright law, including responding to the so-called TDM opt-out, i.e., the explicit exclusion of datasets from text-and-data mining.

For models with systemic risk (for example, the most powerful ones above a certain threshold of FLOPs), additional obligations are added, such as regular robustness testing, assessment and mitigation of systemic risks, incident reporting, and mandatory registration with the European Commission.

To help the industry meet these requirements, a voluntary version of the Code of Practice for GPAI was prepared, which the Commission designated as an appropriate tool for demonstrating compliance with Article 53 of the AI Act. Providers who sign and adhere to the code can benefit from a lower administrative burden and greater legal certainty, as compliance with the code is presumed to satisfy certain legal obligations.

From the perspective of corporate users, this means it is advisable to ask the large model provider whether they are a signatory to this code and how specifically they fulfill their obligations. The Czech legal team at ARROWS helps clients vet providers and modify contractual documentation so that liability for AI is clearly allocated.

What is Coming: August 2026, December 2026, December 2027, and August 2028

From August 2, 2026, the AI Act applies in most of its provisions. In practice, the requirements for transparency of interactive AI systems and for labeling AI-generated content under Article 50 of the AI Act "bite" the most. However, the timeline was significantly altered by the Digital Omnibus – Regulation (EU) 2026/1744 of July 8, 2026, which entered into force on July 27, 2026. The current milestones are as follows:

• February 2, 2025 – general provisions (including AI literacy) and prohibitions under Article 5,
• August 2, 2025 – rules for general-purpose AI (GPAI) models, governance, and penalties,
• July 27, 2026 – more lenient wording of the AI literacy obligation and other simplifications from the omnibus,
• August 2, 2026 – general date of applicability, including transparency under Article 50 (chatbots, labeling of AI content, deepfakes),
• December 2, 2026 – two new prohibitions under Article 5 and the end of the transitional period for machine-readable marking of outputs for generative systems placed on the market before August 2, 2026,
• December 2, 2027 – rules for high-risk systems under Annex III,
• August 2, 2028 – rules for high-risk systems under Annex I (safety components of regulated products).

Providers of AI systems intended to interact directly with humans must ensure that users are clearly informed that they are interacting with AI, unless this is obvious from the context. Providers of generative systems must ensure that synthetic content (text, image, audio, video) is marked as artificial, at least in the form of a machine-readable identifier; for systems placed on the market before August 2, 2026, they have until December 2, 2026, to comply with this obligation. Deployers of deepfake content must then ensure a visible marking for end users that the content is generated or manipulated.

The rules for high-risk systems from Annex III of the AI Act (for example, AI for allocating social benefits, creditworthiness assessment, certain HR tools, or biometric systems) will apply from December 2, 2027, according to the omnibus. This concerns classification, requirements for the systems themselves, and obligations of providers and deployers. This regime is followed by registration in the EU database before placing the system on the market or into service; the omnibus also narrowed the data registered for systems that the provider evaluated as not high-risk under Article 6(3). Systems placed on the market or into service before the date of applicability of these rules will only fall under them if there is a significant change in their design since then; systems intended for public authorities must comply by August 2, 2030, at the latest. The postponement does not mean cancellation – it is wise to start preparing supplier selection, contracts, and internal processes now.

Another milestone will occur on August 2, 2028, when rules for high-risk AI systems integrated as safety components of products regulated by EU harmonization legislation under Annex I (such as elevators, toys, or medical devices) will begin to apply. From the perspective of Czech businesses, this will be particularly sensitive in sectors where AI is already gaining a significant foothold – such as banking, insurance, healthcare, or transport infrastructure.

New Commission guidelines from recent months

In addition to the text of the AI Act itself, so-called tertiary law – implementing and delegated acts, guidelines, and codes of practice – plays an increasingly important role in practice, aiming to unify the interpretation of key concepts and help companies meet the requirements of the AI Act. In the last twelve months, several documents have been added that fundamentally affect the practice of both providers and users.

In May 2026, the Commission issued draft guidelines on the classification of high-risk AI systems under Article 6 of the AI Act. These guidelines attempt to explain when a system is considered high-risk, either because it is a safety component of a regulated product or because it falls under one of the areas listed in Annex III. The document contains a number of practical examples of when a specific AI solution should be perceived as high-risk and when not, which is crucial especially for companies in the fields of HR, lending, healthcare, or public services.

Another important document is the draft guidelines and template for reporting serious incidents under Article 73 of the AI Act. Providers of high-risk systems will have to notify national authorities of serious incidents that led or could have led to health damage, significant property damage, or a serious breach of fundamental rights. Since the rules for classification and obligations of high-risk systems will apply from December 2, 2027, or August 2, 2028, according to the omnibus, incident reporting will be practically relevant mainly from those dates. The Commission conducted a public consultation on the draft guidelines and template from September 26 to November 7, 2025. The draft guidelines explain what is considered an incident, what information should be reported, and how this obligation connects with other regimes (such as GDPR or sector-specific rules).

Prior to that, the Commission issued guidelines for providers of general-purpose AI models, specifying the scope of their obligations and interpreting key concepts such as "significant change to the model," "systemic risk," or "GPAI model." These guidelines complement the aforementioned GPAI Code and together give providers and users a relatively clear picture of when and how the rules apply to them.

In the area of transparency of AI-generated content, the Commission published the final Code of Practice on the labeling of AI-generated content on June 10, 2026. The code is voluntary and provides providers and deployers of generative AI with practical guidance on how to meet the transparency obligations applicable from August 2, 2026 – from technical labeling of outputs to visible labeling of deepfakes and AI texts on matters of public interest. The Commission also published EU icons for labeling AI content alongside it.

From the perspective of corporate managers, this means that monitoring the AI Act no longer means just keeping an eye on "one law," but that it is necessary to systematically monitor the subsequent guidelines, templates, and codes that gradually specify what the supervisory authority will actually require. 

Therefore, the Czech legal team at ARROWS recommends that clients set up an internal process where someone is responsible for "regulatory watch" in the field of AI, similar to GDPR or NIS2, and regularly update both internal policies and contracts with suppliers and customers.

Obligations of AI Providers: From Role Definition to Conformity Assessment

The AI Act places great emphasis on distinguishing roles in the AI value chain – providers, deployers, importers, distributors, and other entities. A provider is anyone who develops an AI system or has a system modified to be provided under their name or trademark, regardless of whether they are established in the EU or outside it. In practice, this definition covers both large developers of their own models and integrators who fundamentally modify a system and place it on the market as their own solution.

It is critical for companies to clarify this role correctly, as the AI Act imposes the most extensive set of obligations on the provider, especially for high-risk systems and GPAI models. If a company mistakenly believes it is "only a user" but in fact significantly modifies the system, trains it on its own data, and offers it to customers as its own product, it may bear the liability of a provider, including the obligation to perform a conformity assessment and register in the EU database.

Therefore, the Czech legal team at ARROWS recommends that clients clarify who is in which role at an early stage of the project – and reflect this allocation of roles and obligations in contracts and terms of service.

High-Risk Systems: Risk Management System, Data, and Documentation

For high-risk AI systems, the AI Act sets out detailed requirements that the provider must meet before placing the system on the market or putting it into service. This includes, in particular, the obligation to establish a continuous risk management system, ensuring the identification, analysis, evaluation, and mitigation of risks associated with AI throughout its lifecycle. 

Closely related to this are data and data governance requirements – training, validation, and testing datasets must be relevant, representative, and of sufficiently high quality, taking into account the specific geographical, contextual, and functional environment in which the system is intended to operate.

The AI Act also requires providers to apply robust data governance practices to these datasets – documenting data origin, collection processes, annotation, cleaning, aggregation, examining the presence of potential biases, and taking measures for their detection, prevention, and correction. 

Exceptionally, it also allows the processing of special categories of personal data for the purposes of bias detection and correction, but only under strict conditions, including technical and organizational measures to minimize risks and strictly limit access. In practice, the provider of a high-risk system is placed in a position where they must prove that their AI is not only "technically functional" but also non-discriminatory, safe, and respectful of fundamental rights.

An integral part of the obligations is also maintaining technical documentation, which must describe the system, its purpose, architecture, data used, training methods, testing, and evaluation results in detail. The documentation is intended to enable supervisory authorities to assess the system's compliance with the requirements of the AI Act, and therefore must be continuously updated, not just created once at the beginning of the project. Likewise, the system must automatically record events (logs) to enable retroactive tracing of how a certain decision or incident occurred, and these logs must be kept for the period specified by the regulation.

Conformity Assessment and the Role of Notified Bodies

High-risk AI systems must undergo a conformity assessment before being placed on the market. The AI Act distinguishes between a system that is a safety component of a product regulated by another harmonization regulation (such as a medical device) and a system falling under a separate category in Annex III.

In the first case, the conformity assessment is typically carried out as part of the existing regime (for example, under the Medical Devices Regulation), with the notified body also assessing compliance with the requirements of the AI Act. In the second case, the provider can in most situations use the internal control procedure (without the involvement of a notified body), provided that they have applied harmonized standards or common specifications, if they exist.

If the provider does not apply harmonized standards or common specifications, or if there are limitations on their use, they are obliged to use a conformity assessment procedure involving a notified body under the relevant module. According to the draft implementation of the AI Act approved by the Czech government on May 28, 2025, the notifying authority for designating notified bodies in the field of AI in the Czech Republic is to be the Office for Technical Standardization, Metrology and State Testing (ÚNMZ), which will supervise conformity assessment bodies, and the market surveillance authority will be the Czech Telecommunication Office. The Czech law establishing these roles has not yet been published in the Collection of Laws.

For providers, this practically means the need to account for the time and cost of conformity assessment, especially for more complex systems or where harmonized standards are not available. The conformity assessment process also includes drafting an EU declaration of conformity and marking the system with the CE mark, signaling compliance with relevant requirements. Without a valid conformity assessment and registration in the EU database, a high-risk system must not be placed on the market or put into service, which in practice can mean suspending the entire project or being denied access to the EU market.

The Czech legal team at ARROWS helps businesses here both with setting up internal compliance processes and with coordinating with notified bodies and supervisory authorities to prevent major delays or costly system redesigns.

Penalties and Provider Liability

As already mentioned, the AI Act introduces a tiered system of penalties, which is in some respects comparable to GDPR. The highest fines (up to EUR 35 million or 7% of worldwide turnover) relate to violations of the prohibition of prohibited practices under Article 5.

For violations of other obligations, such as the obligations of a provider for high-risk systems or GPAI, fines of up to EUR 15 million or 3% of worldwide turnover may be imposed. For providing false, incomplete, or misleading information to supervisory authorities, fines of up to EUR 7.5 million or 1% of turnover may be imposed. For small and medium-sized enterprises, the lower of the two values always applies. The Digital Omnibus extended the same to small mid-caps for fines related to other obligations and false information – but not for prohibited practices.

The AI Act also emphasizes the principle of proportionality, so the amount of fines should take into account the nature, gravity, and duration of the infringement, the number of affected persons, the financial benefit of the infringement, the level of cooperation with supervisory authorities, and also whether the entity is an SME or a startup.

The Commission ultimately withdrew the separate AI Liability Directive (notice in the Official Journal of October 6, 2025). However, for damage compensation disputes, the new Product Liability Directive (EU) 2024/2853 is important, under which software is also considered a product and the provider of an AI system is also considered a manufacturer. Member States are to transpose it by December 9, 2026, and it applies to products placed on the market or put into service after that date. Proper documentation and demonstrable fulfillment of obligations under the AI Act therefore remain key for defense in damage compensation disputes.

For providers, this practically means that non-compliance with the AI Act can lead not only to high fines and a ban on placing the system on the market, but also to lawsuits and reputational damage. Many companies therefore now view setting up a robust AI compliance program as an investment in the product's credibility, rather than just a regulatory cost. In such situations, the Czech legal team at ARROWS helps clients with both the preventive setup of the risk management system and defense against penalties, as well as representation before supervisory authorities and courts.

Obligations of Users (Deployers): AI Literacy, Transparency, and Supervision

According to the AI Act, a deployer (implementing entity) is anyone who uses an AI system in the course of their professional activity, regardless of whether they developed the system or purchased it from a third party. For most ordinary companies in the Czech Republic, the role of deployer will be typical – they use AI in HR, marketing, data analysis, inventory management, customer service, or other processes, but do not develop their own models.

A common mistake is the assumption that the supplier is primarily responsible for compliance with the AI Act. However, the regulation imposes its own obligations on the deployer, especially for high-risk systems and systems that interact directly with end users.

Deployers must, for example, ensure that they use AI systems in accordance with the intended purpose defined by the provider, and must not use them in another context without further assessment, especially if this would lead to increased risks. Furthermore, they must – like providers – take measures to promote the AI literacy of persons operating and using the systems on their behalf. This obligation applies from February 2, 2025. The Digital Omnibus eased it from July 27, 2026: the regulation no longer requires ensuring a "sufficient level" of literacy, but taking measures to promote its improvement, and explicitly states that it does not require guaranteeing a specific level for individual persons. In the case of high-risk systems, they must implement human oversight, monitor system performance, keep logs, and comply with other technical and organizational requirements, including data protection impact assessments (DPIA) under GDPR.

Deploying High-Risk AI in a Company

If a company deploys high-risk AI, such as an automated candidate screening tool, a customer creditworthiness assessment system, AI for deciding on public benefits, or AI supporting clinical decisions in healthcare, its obligations are much broader. For Annex III systems, they will apply from December 2, 2027, and for Annex I systems from August 2, 2028.

In addition to the obligation to ensure that the system has a valid conformity assessment and is registered in the EU database, which is the primary responsibility of the provider, the deployer must implement human oversight. Furthermore, they must ensure log management. They are also obliged to regularly evaluate the system's performance in a real-world environment. At the same time, they must establish procedures for handling incidents and complaints. 

For example, a bank deploying AI for creditworthiness assessment must not only vet the supplier and obtain technical documentation from them, but also ensure that its employees understand how the system works, can interpret its outputs, and have a process to correct outputs if necessary. 

At the same time, they must perform a Data Protection Impact Assessment (DPIA) under GDPR and address potential discriminatory impacts on different client groups. Similarly, an employer using AI in recruitment must involve the DPO, analyze discrimination risks, and clearly communicate to candidates that part of the process is supported by AI.

The Czech legal team at ARROWS often sees that companies tend to rely on the supplier's marketing claims ("our AI is compliant") without deeper verification. In the context of the AI Act, however, it is essential to perform one's own due diligence, request specific documents (system description, purpose, limitations, test results), and anchor the supplier's liability and cooperation directly in the contract. Otherwise, the deployer risks bearing the primary responsibility towards regulators and affected persons in the event of an incident.

Transparency towards Users and Clients

Article 50 of the AI Act introduces general transparency obligations for providers and deployers of limited-risk systems that interact with humans or generate content. A deployer deploying a chatbot must ensure that the user is clearly informed from the first interaction that they are communicating with AI, unless this is obvious. 

Likewise, if a company publishes text, audio, or video generated by AI with the aim of informing the public on matters of public interest, it is obliged to disclose that the content was generated or significantly modified by AI, unless it has undergone full editorial control and carries human editorial responsibility.

A special regime applies to deepfake content – deployers (typically companies, institutions, or professionals) who use deepfakes in their business or professional activities are obliged from August 2, 2026, to visibly mark the content so that an ordinary user can recognize that it is artificial or manipulated. 

Exceptions apply to obviously artistic, satirical, or fictional works, where a suitable notice at the beginning or in the credits is sufficient, and for use in the detection and investigation of criminal activity. In practice, for example, a marketing agency that creates a deepfake video for a client campaign must account for the visible marking obligation from August 2, 2026, otherwise risking penalties for violating Article 50.

Record-keeping, Monitoring, and Incident Management

Deployers of high-risk systems will be obliged to keep records of system deployment, maintain logs of important operational parameters, and implement an incident monitoring process, including cooperation with the provider in reporting them to supervisory authorities. 

In practice, this is analogous to certain regimes in the field of medical devices or cybersecurity – the company must have a clear internal procedure to identify an incident, evaluate its severity, document it, and, if necessary, escalate it to the provider and regulatory authorities.

Many companies today do not have any centralized incident management for AI – potential problems are solved ad hoc in individual departments. In the context of the AI Act, however, it will be necessary to unify these processes, define responsible roles (such as an AI officer or an AI governance working group), and set up clear links to existing mechanisms for cybersecurity incidents or personal data breaches. 

The Czech legal team at ARROWS often helps clients create a unified framework for AI incidents, covering legal, technical, and reputational levels, including prepared communication scenarios for regulators, partners, and the public.

Transparency, Labeling of AI Content, and Deepfakes

Article 50 of the AI Act is one of the most visible provisions for many companies, as it directly affects communication with customers and users. It imposes an obligation to inform individuals that they are interacting with an AI system and to label AI-generated or manipulated content when necessary to maintain trust and protect users. 

The obligation to inform about interaction with AI applies to systems whose purpose is to communicate directly with humans – typically chatbots, virtual assistants, or voicebots in customer service. Exceptions are situations where it is obvious from the context that a machine is involved, or when AI is used for the detection and investigation of criminal offenses with specific safeguards.

For generative AI systems, providers must ensure that outputs are marked at least in the form of a machine-readable tag, enabling the detection of AI content by social networks, search engines, and fact-checking tools, for example. Systems placed on the market before August 2, 2026, must meet this obligation by December 2, 2026. Implementation will generally be technical – watermarks, metadata, or cryptographic tags embedded in the file so that they cannot be easily removed. 

Furthermore, from August 2, 2026, the obligation of certain deployers, especially in the fields of media, marketing, and public communication, to visibly mark AI-generated content applies if it serves to inform the public on matters of public interest or if it is a deepfake.

Deepfake Content: Stricter Regime and Exceptions

A deepfake is a specific category of AI-generated or manipulated content that mimics existing people, places, or events in such a way that it could be mistaken for authentic. The legal framework approaches it more strictly, as deepfakes can be misused for disinformation, fraud, blackmail, or other forms of interference with personal rights and trust in public discourse.

The AI Act therefore obliges deployers of deepfake content who use it in business or professional activities to visibly mark that the content has been generated or manipulated by AI. In practice, this means that if, for example, a marketing agency creates a video in which a fictional likeness of a well-known personality promotes a product, or if a political campaign uses a manipulated recording, the content must be clearly marked as artificial.

The Commission published a voluntary Code of Practice on the labeling of AI-generated content on June 10, 2026, along with EU icons for labeling AI content; specific forms of labeling are recommended by this code. Exceptions apply to obviously artistic, satirical, or fictional works, where the obligation of prominent labeling could disproportionately disrupt the user experience; here, a reasonable notice that the work uses AI is sufficient. In practice, for example, a marketing agency that creates a deepfake video for a client campaign must account for the visible marking obligation from August 2, 2026, otherwise risking penalties for violating Article 50.

Technical Standards and the Transparency Code

Technical details of AI content labeling will be gradually standardized through harmonized standards and codes of practice. Drafts envision multi-layered labeling – a combination of watermarks, metadata, and potentially publicly available tools for verifying AI content. Providers of AI systems will have to implement these technical solutions into their products, while deployers will be obliged to actively use them and not escape liability by turning off labeling in practice.

From a practical standpoint, this opens up space for contractual agreements between the provider and the deployer – for example, what labeling standards are implemented, what guarantees the provider gives, and how potential breaches of obligations are resolved.

 In these situations, ARROWS law firm helps clients set up contracts so that the division of duties and liability corresponds to who has technical and organizational control over how the AI content is created and published.

Risk Classification: The Line Between "Ordinary Software" and AI and Why It Matters

The AI Act distinguishes four basic levels of risk: unacceptable (prohibited), high, limited, and minimal or zero. Prohibited practices have already been described; for high-risk systems, detailed requirements apply to design, data, testing, documentation, and supervision; for limited-risk systems, the focus is primarily on transparency towards users; and systems with minimal or no risk are not targeted by the AI Act with specific obligations.

The vast majority of common corporate applications fall into the categories of limited or minimal risk, but general legal regulations still apply – especially GDPR, copyright law, and consumer protection law.

It is key for managers to understand that system classification has a direct impact on the scope of obligations and potential penalties. For example, a website chatbot with limited risk will require relatively simple steps (informing users it is AI, checking content, and handling complaints), while an automated loan allocation system will require a comprehensive compliance regime as a high-risk system.

Incorrect classification – for example, when a company considers a high-risk system to be "ordinary software" – can lead to non-compliance with obligations without realizing it, exposing the company to the risk of penalties and disputes.

How to Distinguish AI from Ordinary Software

The AI Act attempts to distinguish "real AI" from traditional software, particularly by the level of autonomy and adaptivity – whether the system uses machine learning techniques, optimizes its behavior based on data, and generates outputs that can influence physical or virtual environments. Simply put, if it is a static program with hardcoded "if-then-else" logic, it is not an AI system within the meaning of the regulation.

On the contrary, models and algorithms that learn from data, adapt to new situations, and independently generate recommendations or decisions do fall under the definition of AI. In practice, the boundary can be unclear, for example, in sophisticated expert systems or analytical tools with elements of statistical modeling. Here, it is advisable to consult not only technical documentation but also legal interpretation, including Commission guidelines and future harmonized standards.

If there is reasonable doubt, a conservative approach is worthwhile – i.e., assuming the application of the AI Act – rather than risking that the supervisory authority subsequently designates the system as AI and reproaches the company for non-compliance. The Czech legal team at ARROWS helps clients with the technical-legal assessment of specific solutions and their classification into the correct risk category.

How ARROWS Law Firm Can Help

The regulation of artificial intelligence and new European guidelines present a combination of legal, technical, and organizational challenges for companies. It is particularly demanding that the AI Act intertwines with a number of other regulations – GDPR, NIS2, sector-specific regulation, copyright law, consumer protection law, personal rights protection, or competition rules. A layperson or an overloaded manager often sees only part of the picture and may underestimate less obvious risks, such as liability for damage caused by AI, the evidentiary situation in a dispute, or the potential blocking of a transaction or project by regulators.

The Czech legal team at ARROWS has long been dedicated to digital law, personal data protection, and the regulation of technology and AI. In practice, they help clients with, among other things, a comprehensive AI gap analysis, in which they identify the AI systems used, determine roles and risk categories, evaluate existing processes and documentation, and propose specific steps to achieve compliance.

Furthermore, they prepare and review contracts with AI solution providers and clients to correctly allocate liability, take into account the requirements of the AI Act, GDPR, and other regulations, and protect the client's business interests. The services also include setting up internal governance – from preparing policies for AI use, through defining roles and responsibilities, to designing a process for approving new AI projects and handling incidents.

ARROWS law firm also provides professional training for management, IT, HR, and other teams to ensure that AI literacy in the company is not just a "checked" obligation, but a real tool for responsible AI use. In the event of audits by supervisory authorities or in situations where penalties are threatened, the firm's lawyers represent clients, conduct professional dialogue with the authorities, and prepare a defense strategy.

An important element is also liability insurance – ARROWS law firm is insured for professional liability up to CZK 400,000,000, which provides clients with an additional level of security when entrusting complex and risky projects. In international cases where AI systems operate across borders, the firm can coordinate legal support in different jurisdictions through the ARROWS International network and ensure that the approach to AI regulation is consistent across markets.

If you are considering deploying AI in your company, or if you already use AI and want to be sure that you meet the growing requirements of the AI Act and related European guidelines, it is the right time to start systematic preparation. The Czech legal team at ARROWS can help you both with the initial mapping of the situation and with the long-term setup of a compliance program so that your AI projects are technically innovative, legally secure, and commercially sustainable. If you are interested, you can contact us at any time at consultation@arws.cz.

Conclusion

European regulation of artificial intelligence is already fundamentally changing the way companies develop and use AI. AI in companies under EU supervision is not just a slogan, but a legal reality that is gradually reflecting in the daily practice of both AI providers and users. From the ban on unacceptable practices (extended by two more bans from December 2, 2026) and rules for providers of general-purpose AI models, through transparency and AI content labeling obligations applicable from August 2, 2026, to the high-risk AI regime, which the Digital Omnibus postponed to December 2, 2027, and August 2, 2028, respectively – all these elements create the framework in which AI in European business will operate in the coming years.

For entrepreneurs, management, and investors, this means not only new costs and administration but also an opportunity to differentiate themselves as a trustworthy partner that uses AI responsibly and predictably. The risks of underestimating the AI Act are not just in the form of fines – there is also a risk of being denied market access, project suspensions, lawsuits for damages, loss of bargaining power with partners, or reputational damage in the eyes of clients and the public. On the other hand, companies that prepare for regulation in time can use AI with less legal uncertainty and more easily convince customers, investors, and regulators of the safety of their solutions.

The reality of AI regulation is also more complicated than it might seem at first glance. In addition to the AI Act itself, it is necessary to take into account the subsequent guidelines and codes of the Commission, national adaptation laws, harmonized standards, and parallel regimes such as GDPR, NIS2, or sector-specific regulations. Many steps that look simple – such as deploying a chatbot, using generative AI in marketing, or introducing AI in HR – hide a number of legal and practical details that a layperson usually does not see.

Therefore, it pays not to improvise, but to work with experts who combine a legal and business perspective. If you do not want to risk errors, damages, delays, or fines, and at the same time want to use AI in your company fully and safely, you can safely entrust this area to the Czech legal team at ARROWS. They will help you set up processes, contracts, and internal rules so that they correspond to the current legal status while supporting your business goals. For a non-binding consultation, you can contact us at consultation@arws.cz.