Table of Contents
EU AI Act compliance has been on the agenda since 1 August 2024, when the regulation on artificial intelligence entered into force. Since 2 August 2026, most of its rules apply. After the AI Omnibus, however, the strict obligations for high-risk AI only take effect in December 2027 and August 2028. For manufacturers and retailers, the real question is therefore where the regulation applies inside the company, and whether the data foundation is good enough to prove later that AI works on governed data.
This article explains the state of play after the AI Omnibus, shows what the regulation means for manufacturing, healthcare and retail, and sets out why data governance and clean master data are becoming an important foundation for demonstrable EU AI Act compliance.
Note: This article provides a professional overview and does not constitute legal advice.
What is the EU AI Act?
The EU AI Act, officially Regulation (EU) 2024/1689, is the world’s first comprehensive law on AI. It regulates how AI is used and leaves the technology itself open. The greater the risk an AI system poses to health, safety or fundamental rights, the stricter the obligations.
The role a company plays is decisive. Providers develop an AI system, or have it developed, and place it on the market or put it into service under their own name. Deployers use it under their own authority. A machine builder that licenses a copilot for product copy is a deployer. If the same manufacturer develops its own AI system and places it on the market under its own name, it becomes a provider and carries far more obligations.
Who does the EU AI Act apply to?
The EU AI Act applies to companies and public authorities that place AI systems on the EU market or use them under their own authority. Providers are covered even if they are based outside the EU, deployers outside the EU if the output of their AI is used in the EU. Exemptions include purely personal use, research before market launch and military, defence and national security purposes. Small and medium-sized enterprises benefit from simplified obligations, for example simplified technical documentation. The AI Omnibus extends some of these simplifications to small mid-caps.
Current status: deadlines after the AI Omnibus
The AI Omnibus entered into force on 27 July 2026. Its main effect is to postpone the high-risk rules. In its questions and answers on the AI Act, the European Commission explains that the harmonised standards companies are meant to rely on were not finished in time. The European Commission’s timeline now looks like this:
| Date | What applies |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | Prohibited practices, definitions, AI literacy |
| 2 August 2025 | Obligations for providers of general-purpose AI (GPAI) models, governance, penalty rules |
| 2 August 2026 | Most of the rules, transparency obligations under Article 50, start of enforcement for prohibitions, transparency rules and AI literacy, among others |
| 2 December 2026 | New prohibitions for AI that generates non-consensual sexual deepfakes or child sexual abuse material. End of the Article 50(2) transition for certain generative systems placed on the market before 2 August 2026 |
| 2 December 2027 | High-risk AI under Annex III, such as recruitment or creditworthiness checks |
| 2 August 2028 | High-risk AI in regulated products under Annex I, such as medical devices, lifts or toys |
Two further changes tend to get lost in the discussion. The AI literacy obligation in Article 4 remains, but it now only requires measures that support AI literacy and no guaranteed level for individual employees. The Commission and the Member States take a stronger role in promoting it. The Omnibus also permits, under certain conditions, the processing of special categories of personal data to detect and correct bias in AI systems.
Four risk classes at a glance
The regulation classifies AI systems by their intended purpose. The same language model can therefore be harmless when it suggests product copy and high-risk AI when it pre-sorts job applications.
| Risk class | Examples | What applies |
|---|---|---|
| Unacceptable risk | Social scoring, emotion recognition at work, manipulative techniques | Banned since February 2025, further bans from December 2026 |
| High risk | AI in recruitment and credit checks, AI in medical devices or as a safety component of lifts | Risk management, data quality, documentation, logging, human oversight, conformity assessment |
| Transparency obligations (Art. 50) | Chatbots, generated images, audio and video, deepfakes | Disclosure and labelling duties since August 2026 |
| Minimal risk | Spam filters, translation, product copy suggestions | No additional obligations for deployers, AI literacy still applies |
The regulation also covers general-purpose AI models, such as large language models. Those obligations fall on the model providers. A company that merely uses such a model remains a deployer. A company that integrates it into its own AI system and offers that system under its own name becomes the provider of that system.
What already applies without high-risk AI
Most companies use AI that does not count as high-risk. Two obligations matter most for them. The first is AI literacy under Article 4, which has applied since February 2025 and has been enforced since August 2026: anyone deploying AI systems must take measures that support the AI literacy of the people involved, meaning their understanding of the opportunities, risks and limits of the systems in use. A documented training concept works well as internal evidence.
The second is the set of transparency obligations under Article 50. Providers of generative systems must mark outputs in a machine-readable way as AI-generated, except for purely assistive standard editing or where the input data is not substantially altered. Deployers label deepfakes and AI-generated text published to inform the public on matters of public interest, unless the text has undergone human review or editorial control and someone holds editorial responsibility for it. Product descriptions in an online shop usually fall outside this. Anyone preparing them with AI should still document who approves them.
What the EU AI Act means for manufacturing, healthcare and retail
Manufacturing and machine building
In machine and plant engineering, the high-risk question usually sits in the product itself, and this is exactly where the AI Omnibus shifted something: the EU Machinery Regulation now sits in Section B of Annex I. For legislation in that section, only certain provisions of the AI Act apply directly. Manufacturers should therefore clarify early, as part of their conformity assessment, how AI-based safety functions in machinery are to be handled. AI in PIM that drafts product copy, extracts attributes from data sheets or classifies items is usually not part of that. The typical pitfalls lie elsewhere: in the HR department’s recruiting tool, which falls under Annex III from December 2027 if it filters or evaluates applications, or in a service chatbot without an AI notice.
Healthcare and medical technology
If an AI system is itself a medical device or a safety component of one, and the product requires conformity assessment by a notified body, it counts as high-risk AI under Annex I. Manufacturers then have to satisfy medical device law and the AI regulation together, from August 2028 at the latest. What matters is that product, regulatory and variant data are consistent, because technical documentation and the AI data basis refer to the same product versions. Patient-facing chatbots are also subject to the transparency obligation.
Retail and e-commerce
In retail, most obligations concern customer contact. An AI assistant in an online shop must be designed so that customers recognise they are interacting with AI. That is primarily the provider’s duty, but retailers should still check it when selecting and configuring the tool. Generated images, videos or voices that qualify as deepfakes must be labelled by the retailer as deployer. High risk, by contrast, applies to creditworthiness checks of consumers, for instance for instalment purchases, and to AI in recruitment. AI-assisted product descriptions usually trigger no additional obligations. Editorial approval still makes sense, if only because of product liability and competition law. This is easiest when AI-generated copy in the PIM system runs through the same approval workflow as all other product data.
Why data quality and master data governance form the foundation
A central part of the high-risk regime is about data. Under Article 10, providers of high-risk AI must ensure that training, validation and testing data are relevant, sufficiently representative and, to the best extent possible, free of errors and complete. For systems without a trained model, this applies to testing data only. It calls for data governance practices covering data origin, preparation, enrichment and updating, plus an assessment of data gaps. Deployers, for their part, must ensure under Article 26(4) that input data is relevant and sufficiently representative, to the extent they control that data.
A well-run Master Data Management practice can support much of this under a different name. Data lineage answers the question of origin. Validation rules and mandatory attributes per product class secure completeness. Approval workflows and audit trails record who changed which value and when.
| Requirement in the EU AI Act | How master data management supports it |
|---|---|
| Document data origin (Art. 10(2)(b)) | Data lineage and source system per attribute |
| Make data preparation traceable (Art. 10(2)(c)) | Versioned enrichment, classification and translation with approval |
| Free of errors and complete (Art. 10(3)) | Validation rules, mandatory attributes per class, duplicate checks |
| Identify data gaps (Art. 10(2)(h)) | Completeness metrics per channel and product class |
| Suitable input data from the deployer (Art. 26(4)) | Approved golden records as the single source for AI systems |
This also matters for companies that run no high-risk AI. AI functions are only ever as reliable as the product data they draw on. Patchy attributes and duplicate variants produce flawed suggestions, regulated or not. Whether data quality can be measured and managed therefore determines both the value of AI and whether it can be audited, because only good master data makes AI effective.
Five steps towards EU AI Act compliance
- Build an AI inventory: record every AI system in the company with its purpose, user group and data sources. AI functions bought in as part of ERP, CRM, PIM or shop software count too.
- Determine role and risk class per system: provider or deployer, Annex I, Annex III, transparency duty or minimal risk. The European Commission’s compliance checker helps with a first assessment.
- Review the data foundation: clarify origin, completeness and ownership of the data flowing into AI systems. This is where it is decided whether evidence can be produced later.
- Define oversight and logging: anchor human approval, role-based rights and logs wherever AI prepares decisions.
- Build AI literacy: train everyone who operates AI systems or is responsible for their results, matched to task and prior knowledge.
How Viamedici supports demonstrable AI adoption
No software makes a company compliant with the AI Act. It can, however, create conditions that can later be demonstrated. With VIA/MDM, our Master Data Management Software, Viamedici brings product, customer and supplier data together and keeps the data foundation that AI functions draw on in one place, with validation rules, approval workflows, role-based rights and a traceable change history.
Operations raise the question of where the data resides. The EPIM platform can be operated cloud-based, hybrid or on-premises, so companies decide for themselves where their data lives. Our article on data sovereignty describes which criteria matter.
For product data, manufacturers and retailers use VIA/PIM360°, our PIM system: attributes, product copy and translations are maintained centrally and released to channels through approval workflows. For AI functions in PIM, a simple principle works well: suggestions remain suggestions until a person approves them, and every accepted change stays traceable. Our article on AI in PIM shows which use cases suit this approach and where the limits are.
Conclusion
For most manufacturers and retailers, the EU AI Act is less a list of prohibitions than a documentation mandate. Companies that know their AI systems, have named owners and keep their data foundation under control have done much of the groundwork before the high-risk deadlines of 2027 and 2028 arrive. There is enough time until then to build a clean data foundation. There is not enough for a last-minute sprint.
Want to know how robust your product and master data are as a foundation for AI? Talk to our experts about an assessment of your data foundation.
Frequently asked questions about the EU AI Act
The EU AI Act entered into force on 1 August 2024 and applies in stages. Prohibitions and AI literacy have applied since 2 February 2025, obligations for GPAI models since 2 August 2025, and most of the rules including transparency obligations since 2 August 2026. High-risk AI under Annex III follows on 2 December 2027, high-risk AI in products under Annex I on 2 August 2028.
The AI Omnibus has been in force since 27 July 2026. It postpones the high-risk rules to December 2027 and August 2028, extends some simplifications for SMEs to small mid-caps, simplifies the AI literacy obligation and allows, under certain conditions, the processing of sensitive data to detect bias. From 2 December 2026, it also bans AI applications that generate non-consensual sexually explicit or intimate content or child sexual abuse material.
Providers develop an AI system, or have it developed, and place it on the market under their own name. They carry most obligations, such as conformity assessment and technical documentation. Deployers use an AI system under their own authority. Deployers of high-risk AI must use it as intended, ensure human oversight and provide suitable input data to the extent they control it. For all other deployers, AI literacy and, where relevant, transparency obligations matter most.
Usually not. Typical PIM functions such as copy suggestions, translation, attribute extraction or classification do not fall into the high-risk category. Purpose and context of use decide. If product data is used as training, validation or testing data for a high-risk system, such as a medical device, the quality requirements of Article 10 apply to it. As input data during operation, Article 26(4) applies.
Engaging in prohibited AI practices can lead to fines of up to EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher. Breaches of certain other obligations, for example those of providers and deployers or the transparency obligations, cost up to EUR 15 million or 3 percent, incorrect or misleading information to authorities up to EUR 7.5 million or 1 percent. For SMEs, the lower of the two amounts applies in each case.
For high-risk AI, Article 10 requires providers to use training, validation and testing data that is relevant, sufficiently representative and, to the best extent possible, free of errors and complete. This includes data governance practices for data origin, preparation and updating, plus an assessment of gaps and bias.
Under Article 4, providers and deployers must take measures to support the AI literacy of their staff and of other persons working with AI systems on their behalf. The benchmark is prior knowledge, task and context of use. Since the AI Omnibus, companies no longer have to guarantee a specific level of literacy for each individual.
