---
title: "AI Act Compliance Check"
description: "Assessment framework for EU AI Act compliance. Risk classification, documentation requirements, and conformity assessment paths."
image: "https://compound.law/assets/images/og-image-en.webp"
source: "https://compound.law/en-DE/skills/ai-act-compliance/"
language: "en"
---

AI Regulation EU

# AI Act Compliance Check

Assessment framework for EU AI Act compliance. Risk classification, documentation requirements, and conformity assessment paths.

— views — Downloads By Julian Jantze

📄 What's Included

SKILL.md

├─ Overview

├─ Systematic Review

├─ Special Scenarios

└─ Limitations of This Skill

On this page

## Overview

This skill provides a structured compliance assessment for AI systems under **Regulation (EU) 2024/1689** — the EU AI Act. The regulation establishes a risk-based framework that categorizes AI systems into four tiers: unacceptable risk (prohibited), high risk (heavily regulated), limited risk (transparency obligations), and minimal risk (largely unregulated). Key provisions include **Art. 5** (prohibited AI practices), **Art. 6** (classification of high-risk systems), **Art. 8-15** (requirements for high-risk systems), **Art. 26** (deployer obligations), and **Art. 50** (transparency obligations). Use this skill when advising on the deployment, procurement, or development of AI systems within the EU, or when an existing system requires a compliance gap analysis.

The AI Act applies to providers, deployers, importers, and distributors of AI systems placed on the EU market or whose output is used in the EU, regardless of where the provider is established (Art. 2 Abs. 1). German companies must also consider the interplay with GDPR, sector-specific regulation (e.g., MDR for medical AI, MiFID II for financial AI, the Product Liability Directive), and the anticipated national implementation provisions. The regulation’s extraterritorial reach means that non-EU providers serving EU customers are equally captured.

AI systems that process personal data require a compliant [Data Processing Agreement](https://compound.law/en-DE/skills/data-processing-agreement/) under Art. 28 GDPR in parallel with this AI Act assessment. Data subjects covered by AI-driven automated decisions also have access rights — the [GDPR Data Access Request](https://compound.law/en-DE/skills/gdpr-data-request/) skill covers the Art. 15 GDPR response process. AI-powered employee monitoring further triggers co-determination obligations under § 87 Abs. 1 Nr. 6 BetrVG, which intersects with the [Whistleblower System Setup](https://compound.law/en-DE/skills/compliance-whistleblower/) obligations for technical surveillance systems.

***

## Systematic Review

### Step 1: Actor Classification and Scope

Determine the entity’s role under the AI Act and confirm the system falls within its scope. The obligations differ significantly depending on the actor classification.

- **AI system definition (Art. 3 Nr. 1):** A machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that generates outputs such as predictions, content, recommendations, or decisions influencing physical or virtual environments. This definition is deliberately broad and captures machine learning models, rule-based systems, and hybrid approaches.
- **Provider (Art. 3 Nr. 3):** Develops or commissions an AI system and places it on the market or puts it into service under its own name or trademark. The provider bears the heaviest compliance burden, including conformity assessment, technical documentation, and post-market monitoring.
- **Deployer (Art. 3 Nr. 4):** Uses an AI system under its authority, except for personal non-professional activity. Companies using off-the-shelf AI tools qualify as deployers and bear independent obligations under Art. 26.
- **Importer and distributor:** Each carries distinct verification and record-keeping obligations (Art. 23-27).
- **Dual roles:** An entity may simultaneously be a provider and deployer — for example, a company that develops an AI system for internal use. Both sets of obligations apply cumulatively.
- **Exclusions (Art. 2):** Military and national security systems (Art. 2 Abs. 3), systems used exclusively for scientific research (Art. 2 Abs. 6), and open-source systems with exceptions for high-risk and prohibited categories (Art. 2 Abs. 12).

**Flag as risk:**

- Entity acts as both provider and deployer without recognizing dual obligations
- Open-source exception claimed without verifying that no Annex III use case applies
- AI system used in the EU but provider assumes the Act does not apply due to non-EU establishment
- Narrow interpretation of “AI system” to exclude rule-based decision systems that may fall within the definition
- Failure to identify all entities in the value chain (e.g., a reseller qualifying as distributor)

### Step 2: Prohibited Practices Screening (Art. 5)

Check whether the AI system engages in any of the eight prohibited practices. These prohibitions have been enforceable since **2 February 2025** and carry the highest penalties (up to EUR 35 million or 7% of global annual turnover).

- **Subliminal manipulation (Art. 5 Abs. 1 lit. a):** Techniques deploying subliminal components beyond a person’s consciousness that materially distort behaviour and cause significant harm. The prohibition covers techniques the person cannot reasonably perceive, regardless of whether the distortion is intended.
- **Exploitation of vulnerabilities (Art. 5 Abs. 1 lit. b):** Targeting specific groups based on age, disability, or social or economic situation to materially distort their behaviour in a manner that causes significant harm.
- **Social scoring (Art. 5 Abs. 1 lit. c):** Classification of persons based on social behaviour or personal characteristics, where the resulting social score leads to detrimental treatment that is unjustified or disproportionate. This prohibition applies to public authorities and entities acting on their behalf.
- **Criminal offence prediction (Art. 5 Abs. 1 lit. d):** Individual risk assessment for predicting criminal offences based solely on profiling or personality traits, except where used to augment human assessment based on objective, verifiable facts.
- **Real-time remote biometric identification (Art. 5 Abs. 1 lit. h):** In publicly accessible spaces for law enforcement purposes, with narrow exceptions requiring prior judicial authorization.
- **Emotion recognition (Art. 5 Abs. 1 lit. f):** In workplaces and educational institutions, except for medical or safety reasons.
- **Untargeted facial image scraping (Art. 5 Abs. 1 lit. e):** Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
- **Biometric categorization (Art. 5 Abs. 1 lit. g):** Using biometric data to infer sensitive attributes such as race, political opinions, trade union membership, religious beliefs, or sexual orientation, except for law enforcement with prior judicial authorization.

**Flag as risk:**

- Any match with a prohibited practice requires immediate cessation or fundamental redesign
- System uses biometric data without clear justification under a permitted exception
- Emotion recognition deployed in a workplace setting, even if labelled as “voluntary” or for “wellbeing”
- Persuasive AI in marketing that may cross the line into subliminal manipulation
- Social scoring elements embedded in creditworthiness or insurance assessments by public entities

### Step 3: Risk Classification (Art. 6 and Annexes I/III)

If the system is not prohibited, determine whether it qualifies as high-risk. This classification is the gateway to the most demanding compliance requirements.

- **Annex I pathway (safety component):** The system is a safety component of a product, or is itself a product, covered by EU harmonised legislation listed in Annex I. This includes machinery (Regulation 2023/1230), medical devices (MDR 2017/745), in vitro diagnostics (IVDR 2017/746), automotive (Regulation 2019/2144), aviation, rail, marine, toys, lifts, and pressure equipment. If the product requires a third-party conformity assessment, the AI system must also undergo third-party assessment.
- **Annex III pathway (standalone high-risk):** The system falls within one of the eight listed categories: (1) biometric identification and categorization, (2) management and operation of critical infrastructure, (3) education and vocational training, (4) employment, workers management, and self-employment access, (5) access to essential private and public services, (6) law enforcement, (7) migration, asylum, and border control, (8) administration of justice and democratic processes.
- **Art. 6 Abs. 3 exception:** A system listed in Annex III is not high-risk if it does not pose a significant risk of harm to health, safety, or fundamental rights, does not materially influence the outcome of decision-making (i.e., it is purely preparatory), and does not profile natural persons. The provider must document the assessment and notify the relevant national authority before placing the system on the market.
- **General-purpose AI models (Art. 51-56):** Models trained with large amounts of data using self-supervision that display significant generality. Providers of GPAI models face transparency obligations (Art. 53) and, if classified as posing systemic risk (based on cumulative compute above 10^25 FLOPS or designation by the AI Office), additional obligations including adversarial testing, incident reporting, and cybersecurity measures (Art. 55).

**Flag as risk:**

- Classification rationale not documented as required by Art. 6 Abs. 4
- Art. 6 Abs. 3 exception claimed without written justification or without notification to the national authority
- System clearly falls within Annex III but is treated as limited risk to avoid compliance costs
- GPAI model provider unaware of systemic risk classification threshold
- AI system embedded in a product regulated under Annex I harmonised legislation without coordination with the product conformity assessment

### Step 4: High-Risk System Requirements (Art. 8-15, Art. 26)

For systems classified as high-risk, confirm compliance with each mandatory requirement. These obligations apply to providers (Art. 8-15) and deployers (Art. 26) with different scopes.

- **Risk management system (Art. 9):** A continuous, iterative process for identifying, analysing, estimating, and evaluating risks. The system must be established, documented, implemented, and maintained throughout the AI system’s lifecycle. Risk management must include testing to identify the most appropriate risk mitigation measures.
- **Data governance (Art. 10):** Training, validation, and testing datasets must be relevant, sufficiently representative, and free of errors to the extent possible. Bias detection and mitigation measures are mandatory. Art. 10 Abs. 5 creates a limited exception for processing special category data (Art. 9 GDPR) specifically for bias monitoring, subject to strict safeguards.
- **Technical documentation (Art. 11, Annex IV):** Comprehensive documentation covering the system’s general description, detailed development methodology, monitoring and control mechanisms, risk management process, and record of changes. Documentation must be prepared before the system is placed on the market and kept up to date.
- **Record-keeping and logging (Art. 12):** Automatic recording of events (logs) for traceability throughout the system’s lifecycle. Logs must be retained for a period appropriate to the intended purpose, and no less than six months unless otherwise required by law.
- **Transparency and information to deployers (Art. 13):** Clear, concise instructions for use, including the system’s capabilities, limitations, intended purpose, foreseeable misuse scenarios, and performance metrics (accuracy, robustness, cybersecurity properties).
- **Human oversight (Art. 14):** Measures enabling effective human supervision during the system’s operation. The human overseer must be able to understand the system’s capabilities and limitations, correctly interpret outputs, decide not to use or override the output, and intervene or halt the system. Mere rubber-stamping does not satisfy the requirement.
- **Accuracy, robustness, cybersecurity (Art. 15):** Appropriate levels must be maintained throughout the lifecycle, including resilience against attempts to manipulate training data or outputs (data poisoning, adversarial attacks).

**Deployer-specific obligations (Art. 26):**

- Use the system in accordance with the provider’s instructions for use
- Assign competent, trained, and authorised persons for human oversight
- Monitor the system’s operation and report incidents to the provider or distributor
- Conduct a **fundamental rights impact assessment (FRIA)** under Art. 27 before deploying high-risk systems in certain categories (credit scoring, insurance pricing, recruitment, public services)
- Inform natural persons that they are subject to a high-risk AI system and provide meaningful information about the system’s logic

**Flag as risk:**

- No documented risk management process or process limited to a one-time assessment at deployment
- Training data provenance unknown or undocumented, making bias assessment impossible
- Human oversight measures purely nominal with no practical ability to intervene or override
- FRIA not conducted where Art. 27 requires it (particularly for credit, insurance, employment, and public service use cases)
- Logging disabled or retention period inadequate
- Technical documentation incomplete or not updated after material changes

### Step 5: Transparency Obligations for All AI Systems (Art. 50)

Even systems that are not high-risk must meet transparency requirements when they interact with natural persons or generate synthetic content.

- **Disclosure of AI interaction (Art. 50 Abs. 1):** Providers of AI systems intended for direct interaction with natural persons (chatbots, virtual assistants, customer service agents) must ensure the system discloses that the user is interacting with an AI. Exception: where this is obvious from the circumstances, or where the system is authorised by law for detection of criminal offences.
- **Synthetic content labelling (Art. 50 Abs. 2):** Providers of AI systems that generate synthetic audio, image, video, or text must ensure the output is marked as artificially generated or manipulated in a machine-readable format. Deployers of deepfake systems must disclose that the content has been artificially generated or manipulated.
- **Emotion recognition and biometric categorization (Art. 50 Abs. 3):** Where such systems are deployed (outside the prohibited contexts), the deployer must inform the affected natural persons and process personal data in compliance with GDPR.
- **General-purpose AI transparency (Art. 53):** GPAI model providers must maintain technical documentation, comply with EU copyright law, and publish a sufficiently detailed summary of training data content.

**Flag as risk:**

- No disclosure mechanism for AI-generated content, particularly in customer-facing applications
- Deepfake-capable system without machine-readable output labelling
- Chatbot or virtual assistant deployed without AI disclosure, creating deception risk
- AI-generated text used in legal, medical, or financial communications without disclosure
- GPAI model used to generate content at scale without copyright compliance

### Step 6: Compliance Timeline, Conformity Assessment, and Enforcement

The AI Act applies in phases. Determine which deadlines and procedures apply to the specific system and actor.

- **Prohibited practices:** Enforceable since **2 February 2025**
- **General-purpose AI models:** Obligations since **2 August 2025**
- **Annex III high-risk systems:** Requirements from **2 August 2026**
- **Annex I harmonised legislation products:** Requirements from **2 August 2027**
- **Conformity assessment (Art. 43):** For most high-risk systems, self-assessment (internal control procedure, Annex VI) is sufficient. Third-party assessment through a notified body is required for biometric identification systems (Annex III Nr. 1) and for high-risk systems that are safety components of products requiring third-party assessment under Annex I harmonised legislation.
- **EU declaration of conformity (Art. 47):** The provider must draw up a written declaration, keep it updated, and make it available to national authorities for 10 years.
- **CE marking (Art. 48):** Required for high-risk systems, affixed visibly and legibly to the system or its packaging.
- **EU database registration (Art. 49):** High-risk systems must be registered in the EU database before being placed on the market.

**Enforcement and penalties (Art. 99):**

| Violation                            | Maximum penalty                                 |
| ------------------------------------ | ----------------------------------------------- |
| Prohibited practices (Art. 5)        | EUR 35 million or 7% of global annual turnover  |
| High-risk system requirements        | EUR 15 million or 3% of global annual turnover  |
| Incorrect information to authorities | EUR 7.5 million or 1% of global annual turnover |

SMEs and startups benefit from proportionate caps (Art. 99 Abs. 6). National market surveillance authorities enforce the regulation, with coordination through the AI Office.

**Flag as risk:**

- Deadline for applicable obligations already passed without compliance measures in place
- No conformity assessment procedure identified or initiated
- CE marking required but not applied
- System not registered in the EU database
- No designated national supervisory authority identified

***

## Special Scenarios

### AI in HR and Recruitment

AI systems used for recruitment, candidate screening, promotion decisions, task allocation, or performance monitoring fall within **Annex III Nr. 4** (employment). This is one of the most common high-risk categories for corporate deployers.

- **Deployer FRIA required** under Art. 27 before deployment
- **Works council co-determination** under **§ 87 Abs. 1 Nr. 6 BetrVG** (monitoring of employee behaviour) applies in Germany, creating a parallel consent requirement
- **Anti-discrimination law:** Algorithmic bias can create liability under the **AGG** (General Equal Treatment Act) if protected characteristics are directly or indirectly used in decision-making
- **Employee notification:** Employees must be informed they are subject to a high-risk AI system (Art. 26 Abs. 7)

### AI in Financial Services

AI in credit scoring, insurance underwriting, and fraud detection may be high-risk under **Annex III Nr. 5** (essential services) and is also subject to sector-specific regulation.

- **MiFID II suitability requirements** for AI-driven investment advice
- **DORA (Digital Operational Resilience Act)** ICT risk management for AI in financial institutions
- **ECB/BaFin expectations** on model risk management and explainability
- **GDPR Art. 22:** Automated individual decision-making including profiling — data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects

### GDPR and AI Act Interplay

The two regulations apply cumulatively. Key areas of overlap:

- **Data minimization (Art. 5 Abs. 1 lit. c GDPR)** vs. data quality and representativeness requirements (Art. 10 AI Act) — these can create tension
- **DPIA (Art. 35 GDPR)** and **FRIA (Art. 27 AI Act)** are separate requirements that may need to be conducted in parallel
- **Lawful basis for training data:** GDPR Art. 6 applies to all personal data used in training, and legitimate interest (Art. 6 Abs. 1 lit. f) requires a balancing test
- **Art. 10 Abs. 5 AI Act** creates a narrow exception for processing special category data for bias detection, subject to anonymization after the bias assessment and with no re-use for other purposes

***

## Limitations of This Skill

This skill provides a structured preliminary assessment. In the following cases, engaging a lawyer is necessary:

- **Conformity assessment procedures** and preparation of technical documentation for notified body review
- **Sector-specific interplay** between the AI Act and financial regulation (MiFID II, DORA), medical device regulation (MDR), or employment law (BetrVG, AGG)
- **Cross-border deployment** involving multiple EU member states with differing national implementation measures
- **GPAI model providers** facing systemic risk classification and associated obligations
- **Regulatory proceedings** or market surveillance inquiries by national authorities or the AI Office
- **Contractual allocation** of AI Act obligations between providers, deployers, and distributors in complex supply chains

Compound is happy to assist with AI Act compliance assessments, risk classification, and the preparation of conformity documentation.

— Views

— Downloads

![Julian Jantze](https://compound.law/assets/images/team/julianjantze.webp) Julian Jantze

Category AI Regulation

Jurisdiction EU

Updated March 2026

Tags

ai-actcompliancerisk-assessmenteu-regulation

#### Need Help?

Check out our guide on how to install and use these skills in your preferred AI agent.

[Read the guide →](https://compound.law/en-DE/learn/what-is-a-skill/)

## More Skills

[Contract Law](https://compound.law/en-DE/skills/commercial-lease/)

[DE](https://compound.law/en-DE/skills/commercial-lease/)

### [Commercial Lease Review](https://compound.law/en-DE/skills/commercial-lease/)

[Review checklist for commercial lease agreements under German law. Covers rent adjustments, maintenance obligations, and termination rights.](https://compound.law/en-DE/skills/commercial-lease/)

[![Dr. Markus Dreißigacker](https://compound.law/assets/images/team/markusdreissigacker.webp)](https://compound.law/en-DE/skills/commercial-lease/)

[Dr. Markus Dreißigacker](https://compound.law/en-DE/skills/commercial-lease/)

[— —](https://compound.law/en-DE/skills/commercial-lease/)

[commercial-leasereal-estatecontract-law](https://compound.law/en-DE/skills/commercial-lease/)

[Compliance](https://compound.law/en-DE/skills/compliance-whistleblower/)

[DEEU](https://compound.law/en-DE/skills/compliance-whistleblower/)

### [Whistleblower System Setup](https://compound.law/en-DE/skills/compliance-whistleblower/)

[Implementation guide for whistleblower protection systems under HinSchG and EU Directive 2019/1937.](https://compound.law/en-DE/skills/compliance-whistleblower/)

[![Dr. Markus Dreißigacker](https://compound.law/assets/images/team/markusdreissigacker.webp)](https://compound.law/en-DE/skills/compliance-whistleblower/)

[Dr. Markus Dreißigacker](https://compound.law/en-DE/skills/compliance-whistleblower/)

[— —](https://compound.law/en-DE/skills/compliance-whistleblower/)

[whistleblowerhinschgcompliance](https://compound.law/en-DE/skills/compliance-whistleblower/)

[Data Protection](https://compound.law/en-DE/skills/data-processing-agreement/)

[DEEU](https://compound.law/en-DE/skills/data-processing-agreement/)

### [Data Processing Agreement](https://compound.law/en-DE/skills/data-processing-agreement/)

[Review framework for GDPR-compliant data processing agreements. Covers Art. 28 requirements, sub-processor management, and cross-border transfers.](https://compound.law/en-DE/skills/data-processing-agreement/)

[![Julian Jantze](https://compound.law/assets/images/team/julianjantze.webp)](https://compound.law/en-DE/skills/data-processing-agreement/)

[Julian Jantze](https://compound.law/en-DE/skills/data-processing-agreement/)

[— —](https://compound.law/en-DE/skills/data-processing-agreement/)

[dpagdprdata-processing](https://compound.law/en-DE/skills/data-processing-agreement/)

[Data Protection](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

[DEEU](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

### [Data Protection Impact Assessment (DPIA) under Art. 35 GDPR](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

[When a DPIA is mandatory under Art. 35 GDPR, how to conduct and document one — with a structured assessment framework for Germany.](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

[![Julian Jantze](https://compound.law/assets/images/team/julianjantze.webp)](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

[Julian Jantze](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

[— —](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

[dpiadsfaart-35](https://compound.law/en-DE/skills/data-protection-impact-assessment/)

## Contribute

### Have expertise to share?

We're building a hub where legal experts can build and distribute their workflows. Be among the first contributors.

[Submit Your Skill →](mailto:contact@compound.law)

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": [
      "Organization",
      "LegalService"
    ],
    "@id": "https://compound.law/#organization",
    "name": "Compound Law",
    "alternateName": "Compound Law — AI Law Firm",
    "url": "https://compound.law/",
    "logo": {
      "@type": "ImageObject",
      "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png",
      "width": 1024,
      "height": 1024
    },
    "image": "https://compound.law/assets/images/og-image.webp",
    "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.",
    "foundingDate": "2026",
    "founder": [
      {
        "@type": "Person",
        "name": "Marko Bradic",
        "jobTitle": "CEO",
        "url": "https://compound.law/en-DE/tech-team/marko-bradic/",
        "sameAs": [
          "https://www.linkedin.com/in/markobradic/"
        ],
        "knowsAbout": [
          "Product strategy and development",
          "Scaling technology companies",
          "FinTech and financial services",
          "AI-powered product innovation",
          "Business operations and growth",
          "Digital transformation"
        ]
      },
      {
        "@type": "Person",
        "name": "Mohit Tilwani",
        "jobTitle": "CTO",
        "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/",
        "sameAs": [
          "https://www.linkedin.com/in/mohit-tilwani/"
        ],
        "knowsAbout": [
          "Engineering leadership and architecture",
          "Scaling high-traffic systems",
          "AI and machine learning infrastructure",
          "FinTech platform development",
          "Cloud infrastructure and DevOps",
          "Product engineering"
        ]
      },
      {
        "@type": "Person",
        "name": "Julian Jantze",
        "jobTitle": "Rechtsanwalt",
        "url": "https://compound.law/en-DE/lawyers/julian-jantze/",
        "sameAs": [
          "https://www.linkedin.com/in/julian-jantze-957b95158/"
        ],
        "knowsAbout": [
          "Corporate law and corporate governance for technology companies",
          "Employment law and HR compliance",
          "EU AI Act compliance and AI governance",
          "Employee participation models (VSOP/ESOP)",
          "Regulatory compliance for tech companies",
          "Legal operations and Legal Tech implementation"
        ]
      }
    ],
    "employee": [
      {
        "@type": "Person",
        "name": "Marko Bradic",
        "jobTitle": "CEO",
        "url": "https://compound.law/en-DE/tech-team/marko-bradic/",
        "sameAs": [
          "https://www.linkedin.com/in/markobradic/"
        ],
        "knowsAbout": [
          "Product strategy and development",
          "Scaling technology companies",
          "FinTech and financial services",
          "AI-powered product innovation",
          "Business operations and growth",
          "Digital transformation"
        ]
      },
      {
        "@type": "Person",
        "name": "Mohit Tilwani",
        "jobTitle": "CTO",
        "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/",
        "sameAs": [
          "https://www.linkedin.com/in/mohit-tilwani/"
        ],
        "knowsAbout": [
          "Engineering leadership and architecture",
          "Scaling high-traffic systems",
          "AI and machine learning infrastructure",
          "FinTech platform development",
          "Cloud infrastructure and DevOps",
          "Product engineering"
        ]
      },
      {
        "@type": "Person",
        "name": "Julian Jantze",
        "jobTitle": "Rechtsanwalt",
        "url": "https://compound.law/en-DE/lawyers/julian-jantze/",
        "sameAs": [
          "https://www.linkedin.com/in/julian-jantze-957b95158/"
        ],
        "knowsAbout": [
          "Corporate law and corporate governance for technology companies",
          "Employment law and HR compliance",
          "EU AI Act compliance and AI governance",
          "Employee participation models (VSOP/ESOP)",
          "Regulatory compliance for tech companies",
          "Legal operations and Legal Tech implementation"
        ]
      },
      {
        "@type": "Person",
        "name": "Marc Schuba",
        "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)",
        "url": "https://compound.law/en-DE/lawyers/marc-schuba/",
        "sameAs": [
          "https://www.linkedin.com/in/marcschuba/"
        ],
        "knowsAbout": [
          "IP and IT law",
          "SaaS and IT contracts, IT outsourcing",
          "Software and open-source licensing",
          "Data protection law (GDPR)",
          "AI law and the EU AI Act"
        ]
      },
      {
        "@type": "Person",
        "name": "Dr. Markus Dreißigacker",
        "jobTitle": "Rechtsanwalt",
        "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/",
        "sameAs": [
          "https://www.linkedin.com/in/markusdreissigacker"
        ],
        "knowsAbout": [
          "M&A (Due diligence, post-merger integration, IPO readiness)",
          "Corporate Law (Governance, board work, restructuring)",
          "Commercial Law (Customer contracts, supplier agreements, NDAs)",
          "IP (Trademark management, IP transfer agreements)",
          "Compliance & ESG (Global compliance programs, human rights, sustainability)",
          "Data Protection (GDPR strategy, DPO experience, privacy programs)"
        ]
      },
      {
        "@type": "Person",
        "name": "Philipp Brandt",
        "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law",
        "url": "https://compound.law/en-DE/lawyers/philipp-brandt/",
        "sameAs": [
          "https://www.linkedin.com/in/philipp-brandt-81b446a/"
        ],
        "knowsAbout": [
          "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)",
          "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)",
          "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)",
          "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)"
        ]
      }
    ],
    "address": {
      "@type": "PostalAddress",
      "addressLocality": "Berlin",
      "addressCountry": "DE"
    },
    "areaServed": [
      "Germany",
      "Austria",
      "Switzerland",
      "European Union",
      "United Kingdom",
      "United States",
      "Singapore"
    ],
    "availableLanguage": [
      "de",
      "en"
    ],
    "serviceType": [
      "AI law firm",
      "AI-native legal services",
      "legal counsel for start-ups and growth companies",
      "legal counsel for mid-sized companies and corporates",
      "Commercial Law",
      "Corporate Law",
      "Employment Law",
      "Regulatory & Compliance",
      "Intellectual Property",
      "Insolvency & Restructuring"
    ],
    "hasOfferCatalog": {
      "@type": "OfferCatalog",
      "name": "Compound Law services",
      "itemListElement": [
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Commercial Contracts",
            "description": "Battle-tested contracts for your sales process",
            "serviceType": [
              "enterprise contracts",
              "MSA",
              "DPA",
              "sales contracts"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "International Employment",
            "description": "Compliant hiring across borders",
            "serviceType": [
              "international employment",
              "hiring abroad",
              "employment contracts"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "VSOP/ESOP Setup",
            "description": "Employee participation that actually works",
            "serviceType": [
              "VSOP",
              "ESOP",
              "employee stock options",
              "equity incentives"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Funding Round Support",
            "description": "Clean legal for your next raise",
            "serviceType": [
              "funding round",
              "term sheet",
              "SHA",
              "due diligence",
              "cap table"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Corporate Housekeeping",
            "description": "Get your legal house in order",
            "serviceType": [
              "corporate governance",
              "board resolutions",
              "shareholder register"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Data Protection & Privacy",
            "description": "GDPR compliance that doesn't slow you down",
            "serviceType": [
              "GDPR",
              "data protection",
              "privacy",
              "DPA",
              "cookies",
              "data breach response",
              "GDPR fines",
              "Art. 82 GDPR"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "AI Act Compliance",
            "description": "Navigate EU AI regulation",
            "serviceType": [
              "AI Act",
              "AI compliance",
              "AI governance",
              "EU AI regulation"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "IP & Competition",
            "description": "Protect and enforce what you've built",
            "serviceType": [
              "IP protection",
              "intellectual property",
              "trademarks",
              "trademark enforcement",
              "warning letters",
              "preliminary injunctions",
              "unfair competition",
              "software licensing",
              "open source compliance"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Fractional General Counsel",
            "description": "In-house legal without the full-time cost",
            "serviceType": [
              "fractional GC",
              "fractional general counsel",
              "outsourced legal",
              "legal retainer"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "FinTech Compliance",
            "description": "Navigate financial regulation",
            "serviceType": [
              "fintech compliance",
              "BaFin",
              "banking regulation",
              "AML",
              "KYC"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Legal Retainer",
            "description": "Predictable legal support when you need it",
            "serviceType": [
              "legal retainer",
              "legal subscription",
              "ongoing legal support"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "M&A Preparation",
            "description": "Get ready for acquisition interest",
            "serviceType": [
              "M&A preparation",
              "acquisition",
              "due diligence",
              "exit"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Restructuring & Insolvency",
            "description": "From the first liquidity check to the restructuring itself",
            "serviceType": [
              "restructuring",
              "insolvency",
              "StaRUG",
              "self-administration",
              "insolvency plan",
              "director liability"
            ],
            "areaServed": [
              "Germany",
              "European Union",
              "United Kingdom",
              "United States",
              "Singapore"
            ]
          }
        }
      ]
    },
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "sales",
      "email": "contact@compound.law",
      "availableLanguage": [
        "English",
        "German"
      ],
      "areaServed": [
        "DE",
        "AT",
        "CH",
        "EU",
        "GB",
        "US",
        "SG"
      ]
    },
    "email": "contact@compound.law",
    "sameAs": [
      "https://www.linkedin.com/company/compoundlawfirm",
      "https://x.com/CompoundLawFirm"
    ],
    "knowsAbout": [
      "Commercial Contracts",
      "enterprise contracts",
      "MSA",
      "DPA",
      "sales contracts",
      "International Employment",
      "international employment",
      "hiring abroad",
      "employment contracts",
      "VSOP/ESOP Setup",
      "VSOP",
      "ESOP",
      "employee stock options",
      "equity incentives",
      "Funding Round Support",
      "funding round",
      "term sheet",
      "SHA",
      "due diligence",
      "cap table",
      "Corporate Housekeeping",
      "corporate governance",
      "board resolutions",
      "shareholder register",
      "Data Protection & Privacy",
      "GDPR",
      "data protection",
      "privacy",
      "cookies",
      "data breach response",
      "GDPR fines",
      "Art. 82 GDPR",
      "AI Act Compliance",
      "AI Act",
      "AI compliance",
      "AI governance",
      "EU AI regulation",
      "IP & Competition",
      "IP protection",
      "intellectual property",
      "trademarks",
      "trademark enforcement",
      "warning letters",
      "preliminary injunctions",
      "unfair competition",
      "software licensing",
      "open source compliance",
      "Fractional General Counsel",
      "fractional GC",
      "fractional general counsel",
      "outsourced legal",
      "legal retainer",
      "FinTech Compliance",
      "fintech compliance",
      "BaFin",
      "banking regulation",
      "AML",
      "KYC",
      "Legal Retainer",
      "legal subscription",
      "ongoing legal support",
      "M&A Preparation",
      "M&A preparation",
      "acquisition",
      "exit",
      "Restructuring & Insolvency",
      "restructuring",
      "insolvency",
      "StaRUG",
      "self-administration",
      "insolvency plan",
      "director liability"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Article",
    "headline": "AI Act Compliance Check",
    "description": "Assessment framework for EU AI Act compliance. Risk classification, documentation requirements, and conformity assessment paths.",
    "image": "https://compound.law/assets/images/og-image-en.webp",
    "datePublished": "2026-03-29T00:00:00.000Z",
    "dateModified": "2026-03-29T00:00:00.000Z",
    "author": {
      "@type": "Person",
      "name": "Julian Jantze",
      "image": "https://compound.law/assets/images/team/julianjantze.webp"
    },
    "publisher": {
      "@type": "Organization",
      "@id": "https://compound.law/#organization",
      "name": "Compound Law"
    },
    "mainEntityOfPage": {
      "@type": "WebPage",
      "@id": "https://compound.law/en-DE/skills/ai-act-compliance/"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://compound.law/en-DE/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Skills",
        "item": "https://compound.law/en-DE/skills/"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "AI Act Compliance Check",
        "item": "https://compound.law/en-DE/skills/ai-act-compliance/"
      }
    ]
  }
]
```