--- title: "EU AI Act Procurement Requirements for German Enterprises (2026)" description: "EU AI Act procurement in Germany now turns on the 2026, 2027, and 2028 timeline split. Here is what deployers should demand from vendors." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/eu-ai-act-procurement-requirements-german-enterprises/" language: "en" --- ![EU AI Act procurement requirements guide for German enterprise deployers](https://compound.law/assets/images/compliance/compliance_3.webp) compliance # EU AI Act Procurement Requirements for German Enterprises (2026) 20 May 2026 Short answer Under the EU AI Act, German enterprises deploying AI systems are usually deployers, and those obligations flow directly into vendor contracts. Procurement teams should no longer frame 2 August 2026 as the universal high-risk deadline: transparency and framework duties still matter then, while stand-alone Annex III high-risk systems now point to 2 December 2027 and product-embedded high-risk systems to 2 August 2028. - German enterprises are typically AI deployers under the EU AI Act — not providers. - High-risk AI systems require conformity assessments and CE marking before deployment. - Vendor contracts must include AI Act clauses covering human oversight and incident reporting. - Stand-alone Annex III high-risk AI now points to 2 December 2027. Under the EU AI Act, German enterprises that deploy AI systems — as **deployers** rather than developers — need vendor contracts that already cover **documentation access, instructions for use, human oversight, logging, incident escalation, and change control before later high-risk dates arrive**. The timing split still matters: **2 August 2026** remains the framework and transparency date, **2 December 2027** is the key proposed date for many **stand-alone Annex III high-risk AI systems**, and **2 August 2028** applies to **high-risk AI embedded in regulated products**. Compound Law advises enterprise clients to treat AI procurement as a compliance exercise, not just a commercial negotiation. The contracts you sign today will determine whether your company can evidence compliance once a regulator or business partner starts asking for documentation. For the exact-answer date pages, start with Which EU AI Act systems move to 2 December 2027?, Which AI systems move to 2 August 2028?, and Does EU AI Act procurement matter before 2027? For the wider date hub, see our [EU AI Act procurement timeline for Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-timeline-germany/) and [EU AI Act timeline for German businesses](https://compound.law/en-DE/compliance/eu-ai-act-august-2026-deadline-checklist/). For the privacy layer, see [GDPR AI procurement](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) and [AI vendor due diligence in Germany](https://compound.law/en-DE/compliance/ai-vendor-due-diligence-germany/). ## Procurement Contract Answers That Stay on This Pillar This page remains the canonical owner for two procurement-overlap questions: - **Do GDPR data processing agreements cover AI Act obligations too?** - **Do I need to re-negotiate existing AI vendor contracts under the EU AI Act?** The short answer to both is **yes, procurement needs work now** and **no, a GDPR DPA does not cover the whole AI Act contract package**. ## Quick Procurement Answers for German Deployers ### Does the EU AI Act still matter in AI procurement before 2027? Yes. Procurement work starts now because German deployers need **documentation access**, **instructions for use**, **human oversight guidance**, **logging support**, and **incident escalation clauses** before later high-risk dates arrive. ### Which AI systems should procurement teams treat as the 2 December 2027 category? Procurement teams should map **stand-alone Annex III high-risk AI systems** to **2 December 2027**. Typical business examples are recruitment screening, worker evaluation, biometric verification, credit scoring, and other AI systems used in high-risk sectors without being embedded in a regulated product. ### Which AI systems should procurement teams map to 2 August 2028? The **2 August 2028** date is for **high-risk AI embedded in regulated products**. If the AI sits inside a product subject to product-safety and CE-marking rules, the procurement workstream should document that product-linked timeline separately from stand-alone SaaS tools. ## Deployer vs. Provider: Who Is Responsible for What The EU AI Act draws a clear line between two categories of actors: **Providers** develop AI systems and place them on the market. They are responsible for conducting conformity assessments, maintaining technical documentation, applying CE marking (where required), and registering in the EU database for high-risk AI systems. **Deployers** put AI systems into service for their own purposes — typically businesses purchasing AI tools, platforms, or APIs from third-party vendors. Deployers do not build the AI system, but they operate it within their business processes. Most German enterprises are deployers. If your company uses an AI-powered HR screening tool, an AI credit risk model, or a GPAI-based customer service system built by a third party, you are a deployer under the AI Act — and Articles 25–26 apply to you directly. **Why deployer obligations flow upstream to vendor contracts:** As a deployer, you cannot fulfill your legal obligations alone. You need information, documentation, and contractual commitments from your AI vendor. Without those, you cannot: - Verify the system’s conformity assessment - Implement the vendor’s human oversight instructions - Escalate AI risks quickly to the provider and the relevant authority where required - Conduct internal monitoring and log reviews This is why AI Act procurement is fundamentally a contract law challenge. For the privacy layer that sits alongside the AI Act, see our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) and [AI vendor due diligence guide for German companies](https://compound.law/en-DE/compliance/ai-vendor-due-diligence-germany/). In practice, enterprise AI procurement usually needs both tracks at the same time. ## What the EU AI Act Requires Deployers to Do by August 2026 - A **provider** develops the AI system and places it on the market. - A **deployer** uses that AI system for its own business purposes. - A **stand-alone Annex III high-risk AI system** is high-risk AI used in an Annex III area without being integrated into a separately regulated product. - A **product-embedded high-risk AI system** is AI built into a regulated product and therefore aligned with the later 2028 track. For the privacy layer that sits alongside the AI Act, see our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) and [AI vendor due diligence guide for German companies](https://compound.law/en-DE/compliance/ai-vendor-due-diligence-germany/). In practice, enterprise AI procurement usually needs both tracks at the same time. ## What the EU AI Act Requires Deployers to Do Across the 2026, 2027 and 2028 Timeline The [EU AI Act timeline for German businesses](https://compound.law/en-DE/compliance/eu-ai-act-august-2026-deadline-checklist/) should no longer be read as a single August 2026 high-risk deadline. For procurement, the practical split is: **2 August 2026** for transparency and broad framework readiness, **2 December 2027** for stand-alone Annex III high-risk systems, and **2 August 2028** for product-embedded high-risk systems. Here is what deployers of high-risk AI systems should have in place: ### High-Risk AI System Obligations (Annex III) High-risk AI systems are those listed in **Annex III** of the EU AI Act. Categories particularly relevant to German enterprises include: - **Recruitment and HR tools** — CV screening, candidate ranking, promotion decisions - **Credit scoring and creditworthiness assessment** — automated lending decisions - **Biometric identification** — real-time or post-hoc identification systems - **Critical infrastructure management** — energy, water, transport, digital infrastructure - **Law enforcement applications** — risk assessment tools used in policing or corrections - **Educational access** — systems determining access to educational institutions For [high-risk AI in financial services](https://compound.law/en-DE/ai-act/financial-services), the obligations are particularly demanding. The same applies to [legal services using AI](https://compound.law/en-DE/ai-act/legal-services), where professional liability intersects with AI Act compliance. ### General-Purpose AI (GPAI) Transparency Requirements From August 2, 2025, general-purpose AI model providers must publish technical documentation and comply with copyright transparency requirements. As a deployer of GPAI-based systems (such as large language model APIs), your obligations include: - Maintaining records of the GPAI models you use in customer-facing applications - Ensuring transparency disclosures to end users where required under Article 50 - Conducting due diligence on the GPAI providers’ compliance posture ### Human Oversight Obligations Article 26(1) requires deployers of high-risk AI systems to implement appropriate human oversight measures as instructed by the provider. Concretely, this means: - Assigning qualified staff to monitor AI outputs - Retaining the ability to override, suspend, or discontinue AI system decisions - Ensuring that no high-stakes decision affecting individuals is fully automated without a meaningful human review step ### Risk Escalation and Serious Incident Cooperation Under Article 26, a deployer that has reason to believe a high-risk AI system creates a risk must inform the provider or distributor and the relevant market-surveillance authority without undue delay, and suspend use of the system. Separately, Article 73 puts the primary serious-incident reporting duty on the provider, but deployers still need the contract to force rapid information-sharing and cooperation. In practice, that means your procurement package should ensure that the vendor notifies you immediately about serious incidents, near misses, corrective actions, and any challenge to the system’s conformity status. Without those clauses, your legal team may not have enough information to suspend use, escalate appropriately, or document its response. ## What to Demand from Your AI Vendor in the Contract Compound Law advises enterprise clients to treat the following as minimum required terms in any contract involving a high-risk AI system. These are not negotiable positions — they are legal obligations that your vendor must support: ### Conformity Assessment Documentation (Annex IV Technical File) Your contract should give you the **right to request and inspect** the Annex IV technical file — the documentation package that proves the provider completed a conformity assessment. This file includes the system’s intended purpose, development process, training data description, accuracy metrics, and testing results. The contract clause should specify: delivery timeline for the technical file on request, update obligations when the system changes materially, and a right to receive updated documentation following any substantial modification. ### CE Marking and Declaration of Conformity For high-risk AI systems, the provider is required to affix CE marking before placing the system on the market. Your contract should confirm: - That the system carries valid CE marking at the time of delivery - That the declaration of conformity is available for inspection - That the provider maintains this marking on an ongoing basis - Notification obligations if the CE marking is withdrawn or under challenge ### Instructions for Use — Including Human Oversight Procedures Article 13 requires that high-risk AI systems be accompanied by clear instructions for use, including guidance on human oversight implementation. Your contract should: - Require delivery of complete, up-to-date instructions for use in a language your staff can read - Obligate the provider to update instructions when the system changes - Specify that instructions must cover how to implement the human oversight measures required by Article 26(1) ### Incident and Serious Incident Reporting Obligations Your contract must include provisions requiring the vendor to: - Notify you immediately (within 24 hours where practicable) of any serious incident or near-miss involving the AI system - Share all information necessary for you to assess whether use must be suspended or escalated to the relevant authority - Cooperate with any market-surveillance inquiry or corrective action process - Maintain incident logs and make them available to you on request Without these clauses, you cannot meet your own incident reporting obligations as a deployer. ### Right to Audit and Inspect Technical Documentation Your contract should include an **audit right** that allows you (or your appointed legal counsel or technical advisor) to inspect: - The technical documentation at any point during the contract term - Compliance records and test reports - Data governance documentation relevant to the system This audit right is not only prudent — in many cases it is necessary to demonstrate your own compliance posture to the relevant authority, customer, or internal control function. ### Data Governance Obligations from the Vendor Side For high-risk AI systems, the EU AI Act imposes strict data governance requirements on providers. Your contract should pass through these obligations, requiring the vendor to confirm: - Training datasets met the quality criteria in Article 10 - Bias testing was conducted and documented - Data is not sourced from prohibited categories under the GDPR or AI Act This aligns with your [GDPR vendor assessment checklist](https://compound.law/en-DE/compliance/gdpr-ai-vendor-assessment-checklist), which addresses similar requirements under the GDPR lens, and with a broader [GDPR AI procurement workflow](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) for intake, DPA review, and go-live controls. ### Training Data Provenance For high-risk systems, Article 10 requires that training, validation, and test datasets satisfy specific quality criteria. Your contract should include a representation from the vendor that training data: - Is subject to appropriate data governance practices - Was examined for possible biases before and during training - Does not include personal data collected in violation of applicable law ## Procurement Checklist for High-Risk AI Systems Use this checklist when evaluating any AI vendor contract involving a potentially high-risk AI system: - [ ] **Classification confirmed:** Is the AI system classified as high-risk under Annex III? (If uncertain, seek legal advice before signing) - [ ] **Conformity assessment completed:** Has the provider confirmed completion of a conformity assessment and provided the Annex IV technical file? - [ ] **CE marking valid:** Does the system carry valid CE marking and is the declaration of conformity available? - [ ] **Instructions for use received:** Are complete, German-language-accessible instructions for use — including human oversight procedures — included in the contract deliverables? - [ ] **Incident escalation clause included:** Does the contract require the vendor to notify you promptly of serious incidents and cooperate with any relevant authority? - [ ] **Audit right confirmed:** Does the contract give you the right to inspect technical documentation? - [ ] **DPA aligned:** Is the GDPR Data Processing Agreement aligned with the technical documentation on data processing scope? - [ ] **Data governance confirmed:** Has the vendor represented that training data meets Article 10 requirements? - [ ] **Human oversight procedures documented:** Are oversight measures specified in the contract and in the instructions for use? ## Model Contract Clauses: What German Law Requires The European Commission has published **EU model contractual clauses for AI procurement**, developed in consultation with the European Innovation Partnership on AI. These provide a starting-point framework, particularly for public sector procurement, and are referenced by the eipa.eu guidance at the intersection of EU AI Act and public procurement rules. For private-sector German enterprises, those model clauses must be adapted to comply with: **BGB and AGB requirements:** Standard terms (Allgemeine Geschäftsbedingungen / AGBs) in German contracts are subject to the BGB content control rules. AI Act compliance clauses that are imposed as one-sided standard terms may face challenge if they create a significant imbalance. Compound Law advises negotiating AI Act clauses as individually negotiated terms (Individualvereinbarungen) where possible. **Liability caps:** German law permits contractual limitation of liability, but caps that would prevent a deployer from meeting its regulatory obligations are unlikely to be enforceable. Your contract should specify that liability caps do not apply to the vendor’s obligations to provide accurate technical documentation or to notify you of serious incidents and material compliance defects. **Interaction with GDPR DPA obligations:** The [EU AI Act and GDPR obligations](https://compound.law/en-DE/compliance/ai-act-gdpr-legal-advisory) overlap significantly for high-risk AI systems that process personal data. A compliant procurement package for such systems requires both a GDPR DPA (covering data processing, sub-processors, data subject rights, and transfers) and a separate AI Act addendum (covering conformity, oversight, and incidents). The two instruments are not substitutes — both are legally required. ## August 2026 Timeline: What German Enterprises Must Have in Place **August 2, 2026** should no longer be framed as the one-size-fits-all high-risk deadline. For German enterprises, it is the key date for transparency and broad framework readiness, while stand-alone Annex III high-risk systems point to **December 2, 2027** and product-embedded high-risk systems point to **August 2, 2028**. Here is what should already be in place on the procurement side: **Before August 2, 2026 — for live or planned Annex III systems:** 1. Conduct an AI system inventory: identify all AI systems in operation and classify each against Annex III 2. For each high-risk system, request the Annex IV technical file from the vendor 3. Audit existing contracts for AI Act gaps and initiate renegotiation 4. Implement human oversight procedures for each high-risk system 5. Establish an internal incident monitoring and reporting process **For systems procured after August 2, 2026:** All new AI vendor contracts should include compliant AI Act clauses from the outset. Systems lacking the required conformity documentation and provider support should not be deployed. **What happens if you procured a high-risk system before the deadline?** Article 111 matters here. For many high-risk AI systems already placed on the market or put into service before August 2, 2026, the new regime applies only once the system is subject to a significant change in design after that date. That does not mean private deployers can ignore legacy contracts: renewals, expanded functionality, new integrations, changed intended purpose, or vendor-side model changes can all reopen the compliance analysis. **Transition arrangements for existing contracts:** Where renegotiation is not immediately possible, deployers should document their classification analysis, record why Article 111 may apply, and implement interim oversight and escalation controls. That documentation will not replace compliance, but it can materially improve the company’s defensibility. ## Frequently Asked Questions ### Does the EU AI Act apply to all AI tools I use at my company? No. The EU AI Act applies differently depending on how AI is classified. **Prohibited AI** (banned entirely), **high-risk AI** (Annex III — full obligations), **GPAI** (transparency and documentation requirements), and **limited-risk AI** (disclosure obligations only) each carry different rules. Many standard software tools that include basic AI features — such as autocomplete or spam filtering — fall outside the high-risk classification entirely and require only limited disclosure compliance. ### Do I need to re-negotiate existing AI vendor contracts? Often yes, but not automatically in every case. Where a high-risk system is already in service before August 2, 2026, Article 111 can preserve part of the legacy position unless the system is significantly changed. Even so, most enterprises should start renegotiation now because extensions, scope creep, and vendor updates can remove that comfort quickly. For systems that are not high-risk, contract review is still prudent to confirm GPAI and transparency obligations are addressed. ### What is a conformity assessment and can I ask my vendor for one? A conformity assessment is the documented process by which an AI provider verifies their system meets EU AI Act standards. You have the right to request the Annex IV technical file that results from this assessment. If a vendor refuses to provide this documentation for a high-risk system, that refusal is a significant red flag — and potentially your own compliance risk as a deployer. ### What penalties apply if my company fails to comply as a deployer? The AI Act provides for fines of up to **€15 million or 3% of global annual turnover**, whichever is higher, for many non-compliance cases. For prohibited AI violations, fines rise to €35 million or 7%. Beyond administrative fines, deployer liability under German civil law (BGB) may arise if an AI system causes harm and the deployer cannot demonstrate adequate oversight. **Enforcement in Germany:** The national enforcement setup continues to develop. The Bundesnetzagentur is publicly preparing for a central role in Germany’s AI Act implementation, but enterprises should monitor the final allocation of market-surveillance responsibilities and sector-specific competences. *** *This guide is general information only and does not constitute legal advice for your specific situation. EU AI Act compliance depends on the classification of your specific AI systems and the contractual arrangements in place. Compound Law advises German enterprises on AI Act procurement strategy, contract review, and compliance readiness — [contact us](https://compound.law/en-DE/compliance/ai-act-gdpr-legal-advisory) to discuss your situation.* ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![EU AI Act training obligation and Article 4 AI literacy in Germany](https://compound.law/assets/images/compliance/compliance_2.webp)](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [compliance](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) ### [EU AI Act Training Obligation: What Article 4 Requires](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [EU AI Act training obligation under Article 4: who it covers in Germany, what AI literacy measures to implement, and how to document compliance.](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [![Facial recognition in Germany under AI Act and GDPR](https://compound.law/assets/images/compliance/compliance_2.webp)](https://compound.law/en-DE/compliance/facial-recognition-germany/) [compliance](https://compound.law/en-DE/compliance/facial-recognition-germany/) ### [Is Facial Recognition Legal in Germany? AI Act & GDPR Rules](https://compound.law/en-DE/compliance/facial-recognition-germany/) [Facial recognition in Germany is legal only in narrow cases. See what the AI Act prohibits, when Article 9 GDPR applies, and what to do before 2 August 2026.](https://compound.law/en-DE/compliance/facial-recognition-germany/) ## Frequently asked questions Not all AI tools trigger the same obligations. Only AI systems classified as 'high-risk' under Annex III require conformity assessments, technical documentation, and full deployer compliance. General-purpose AI models (GPAI) trigger lighter transparency and due diligence obligations. Many standard business software tools with minor AI features fall outside the high-risk classification entirely. Often yes, but not every legacy contract is treated the same way. Under Article 111, many high-risk AI systems already placed on the market or put into service before August 2, 2026 are pulled fully into the new regime only once they undergo a significant change. Even so, German enterprises should review and usually update existing contracts now, because renewals, expanded use cases, new modules, or substantial modifications can trigger active compliance risk. A conformity assessment is the process by which an AI provider verifies that their high-risk AI system meets the EU AI Act's requirements before placing it on the market. This includes testing and documenting the system against requirements for accuracy, robustness, cybersecurity, data governance, human oversight, and transparency. The assessment results in a technical file (Annex IV) and a declaration of conformity. As a deployer, you can contractually demand to inspect this documentation. The AI Act sets fines of up to €15 million or 3% of total worldwide annual turnover for many non-compliance cases, and up to €35 million or 7% for prohibited AI practices. In Germany, the national enforcement structure is still being operationalised; the Bundesnetzagentur is publicly preparing for a central market-surveillance role, but companies should track the final national allocation of responsibilities as implementation develops. Under the EU AI Act, a 'provider' is any company that develops an AI system and places it on the market. A 'deployer' is any company that puts an AI system into service for its own purposes — typically a business using AI tools or platforms built by a third party. Most German enterprises purchasing AI software are deployers. The distinction matters because providers and deployers have different but complementary obligations under Articles 25 and 26. No. A GDPR Data Processing Agreement (DPA) covers personal data processing under the GDPR but does not satisfy AI Act obligations. AI Act vendor contracts should separately address conformity documentation, technical documentation access, human oversight procedures, logging, risk escalation, and cooperation with the relevant market-surveillance authority. Where an AI system processes personal data, both a GDPR DPA and an AI Act contract addendum are often needed in parallel. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "EU AI Act Procurement Requirements for German Enterprises (2026)", "description": "EU AI Act procurement in Germany now turns on the 2026, 2027, and 2028 timeline split. Here is what deployers should demand from vendors.", "image": "https://compound.law/assets/images/compliance/compliance_3.webp", "datePublished": "2026-05-20T00:00:00.000Z", "dateModified": "2026-05-20T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/eu-ai-act-procurement-requirements-german-enterprises/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "EU AI Act Procurement Requirements for German Enterprises", "item": "https://compound.law/en-DE/compliance/eu-ai-act-procurement-requirements-german-enterprises/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does the EU AI Act apply to all AI tools my company uses?", "acceptedAnswer": { "@type": "Answer", "text": "Not all AI tools trigger the same obligations. Only AI systems classified as 'high-risk' under Annex III require conformity assessments, technical documentation, and full deployer compliance. General-purpose AI models (GPAI) trigger lighter transparency and due diligence obligations. Many standard business software tools with minor AI features fall outside the high-risk classification entirely." } }, { "@type": "Question", "name": "Do we need to re-negotiate existing AI vendor contracts?", "acceptedAnswer": { "@type": "Answer", "text": "Often yes, but not every legacy contract is treated the same way. Under Article 111, many high-risk AI systems already placed on the market or put into service before August 2, 2026 are pulled fully into the new regime only once they undergo a significant change. Even so, German enterprises should review and usually update existing contracts now, because renewals, expanded use cases, new modules, or substantial modifications can trigger active compliance risk." } }, { "@type": "Question", "name": "What is a conformity assessment under the EU AI Act?", "acceptedAnswer": { "@type": "Answer", "text": "A conformity assessment is the process by which an AI provider verifies that their high-risk AI system meets the EU AI Act's requirements before placing it on the market. This includes testing and documenting the system against requirements for accuracy, robustness, cybersecurity, data governance, human oversight, and transparency. The assessment results in a technical file (Annex IV) and a declaration of conformity. As a deployer, you can contractually demand to inspect this documentation." } }, { "@type": "Question", "name": "What penalties apply if my company fails to comply as a deployer?", "acceptedAnswer": { "@type": "Answer", "text": "The AI Act sets fines of up to €15 million or 3% of total worldwide annual turnover for many non-compliance cases, and up to €35 million or 7% for prohibited AI practices. In Germany, the national enforcement structure is still being operationalised; the Bundesnetzagentur is publicly preparing for a central market-surveillance role, but companies should track the final national allocation of responsibilities as implementation develops." } }, { "@type": "Question", "name": "What is the difference between a provider and a deployer?", "acceptedAnswer": { "@type": "Answer", "text": "Under the EU AI Act, a 'provider' is any company that develops an AI system and places it on the market. A 'deployer' is any company that puts an AI system into service for its own purposes — typically a business using AI tools or platforms built by a third party. Most German enterprises purchasing AI software are deployers. The distinction matters because providers and deployers have different but complementary obligations under Articles 25 and 26." } }, { "@type": "Question", "name": "Do GDPR data processing agreements cover AI Act obligations too?", "acceptedAnswer": { "@type": "Answer", "text": "No. A GDPR Data Processing Agreement (DPA) covers personal data processing under the GDPR but does not satisfy AI Act obligations. AI Act vendor contracts should separately address conformity documentation, technical documentation access, human oversight procedures, logging, risk escalation, and cooperation with the relevant market-surveillance authority. Where an AI system processes personal data, both a GDPR DPA and an AI Act contract addendum are often needed in parallel." } } ] } ] ```