How we help
What the AI Act requires of your company today, what has a date, and what you need not worry about
The AI Business Center Foundation (AIBC) is a think tank and advisory partner that helps the boards of construction, industrial and technical-services companies adopt artificial intelligence so that it delivers measurable results and builds competitive advantage. We begin preparing for the AI Act by establishing which provisions apply to the company at all.
Compliance is no longer a cost of the legal department. It has become a condition of sale
Institutional customers, investors and large contracting authorities increasingly ask how a company uses artificial intelligence, who is responsible for it and whether it operates within the law. A company with an orderly answer shortens the purchasing conversation. A company without one starts it on the defensive.
The problem we solve
Much of the material circulating about the AI Act mixes up what applies today, what has a date and what the law does not require at all. In July 2026 many companies concluded that the subject had been postponed. That is only partly true: Regulation (EU) 2026/1744, known as the AI Omnibus, deferred the obligations for high-risk systems, but it did not defer the transparency obligations of Art. 50, which apply from 2 August 2026. The one transition period, until 2 December 2026, concerns machine-readable marking of content by providers of tools placed on the market before 2 August 2026.
We bring clarity rather than alarm. We start from facts about the company: which AI systems are in use, what they are for, who their provider is and who the deployer is.
What we do
- AI use register. We list the AI systems and uses in the company, each with an owner and a purpose. This is a management practice rather than a statutory obligation for everyone, but without it no further question can be answered.
- Role map. For each use we establish whether the company is the provider of the AI system or a deployer. The scope of obligations depends on this.
- Map of obligations and dates. We assign the relevant provisions of the AI Act to each use, together with the dates from which they apply. Borderline cases are flagged for assessment by the company’s legal adviser.
- Staff competence. We help document the measures through which the company supports the development of AI literacy of its staff (Art. 4). The provision does not prescribe a specific form, including the purchase of training.
- Transparency towards customers. We review customer touchpoints such as chats, assistants and visual materials, and establish what requires information or labelling under Art. 50 and what does not.
- ESG. We establish whether and from when reporting obligations apply to the company directly, or indirectly through customer requirements in the supply chain, and which data from AI-supported processes can feed the reporting.
Five areas of legal certainty
We build compliance into the process from day one rather than adding it at the end. Adopting AI in a company usually touches five legal areas at once:
- AI Act. The company’s role in relation to each system, its obligations and the dates from which they apply.
- Customer data and GDPR. Which personal data enter AI tools, on what legal basis and where they are processed.
- Rules for using AI in the company. Internal rules for working with the tools, aligned with employment law and introduced so that employees know them.
- Accountability for outcomes. Who in the company is responsible for a decision taken with the help of AI, and how the company documents it.
- Contracts with AI providers. Ownership of outputs, confidentiality, use of company data to train models and the terms for exiting the service.
The last area is linked to the choice of route to AI, described on the page Data sovereignty and private AI instance. We agree the scope and interpretation of each area with the company’s legal adviser.
The next dates
| date | what starts to apply |
|---|---|
| 2 December 2026 | end of the transition period for machine-readable marking by providers of tools placed on the market before 2 August 2026; ban on AI-generated intimate content without consent |
| 2 August 2027 | providers of GPAI models placed on the market before 2 August 2025 |
| 2 December 2027 | high-risk systems under Annex III |
The full calendar and a discussion of Art. 50 are on the page AI Act in communication and sales.
What stays with the company
- an AI use register with owners and purposes,
- a map of roles and obligations with the dates from which they apply,
- a list of cases for assessment by the legal adviser,
- an action plan for the coming quarters, including competence and transparency,
- compliance measures that feed into the AI value report for the board.
Companies that want to go through this process methodically and conclude it with an AIBC attestation choose the AIBC Certification Path. An AIBC attestation is not a conformity assessment carried out by a notified body, nor a decision of a supervisory authority. We combine compliance work with semantic transformation, that is, organising a company’s names, processes and data so that people, language models and board reports understand them the same way: the AI use register draws on the same vocabulary.
The first step
An inventory: a list of the AI tools and uses the company already has, including those employees use without a formal decision. This usually takes a few weeks and shows straight away where the real obligations lie.
Frequently asked questions
Does the AI Act apply to a company that only uses off-the-shelf AI tools?
Yes, although to a different extent than to providers. Under the AI Act, a company using an AI system in its professional activity is a deployer. Its obligations include supporting the development of AI literacy of its staff under Art. 4 and, where applicable, the transparency obligations of Art. 50. The scope depends on what the tool is used for.
Are AI systems in production and on construction sites high-risk systems?
That depends on the system's intended purpose and on whether it is part of a regulated product. Examples of high risk are recruitment, creditworthiness, critical infrastructure and biometrics, as well as systems built into regulated products under Annex I. We do not decide borderline cases on this page; the company's legal adviser assesses them on the basis of a specific system description.
When do the requirements for high-risk systems apply?
Following the amendment introduced by the AI Omnibus, obligations for high-risk systems under Annex III apply from 2 December 2027, and for systems built into regulated products under Annex I from 2 August 2028.
Does the Foundation replace a law firm?
No. We prepare a map of AI uses, roles and obligations and an action plan, and we agree the scope and interpretation with the company's legal adviser. The Foundation's content on legislation is reviewed by the Member of the Management Board responsible for law and compliance.
Let’s start with an assessment
Let’s talk about which provisions apply to your company today and how to document them.