![\"A](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/11\/Copilot_Title_EUAIACT.png\" "\\"Copilot_Title_EUAIACT\\"")
<\/span><\/div><\/div><\/div><\/p>\n
The EU AI Act puts an end to the previously unregulated use of AI \u2013 including tools like Microsoft Copilot or proprietary AI agents. Since August 2024, it is clear: those who use AI in <\/span>companies, will need defined roles, documented <\/span>processes, and traceable logging by 2026 at the latest.<\/span><\/p>\n<\/div>\n <\/p>\n<\/div><\/div><\/div><\/div><\/div> The EU AI Act is the world’s first comprehensive AI regulation and has been in force since August 2024.<\/p>\n The core of the AI Act is a risk-based approach: AI systems are classified into different risk categories based on their area of application and potential impact \u2013 from “minimal” to “unacceptable”. The higher the risk, the stricter the requirements: from simple labeling to documentation and control obligations, and even prohibitions, for example, in social scoring or manipulative systems. <\/p>\n It thus becomes clear: AI equally affects not only IT, but also HR, business departments, data <\/p>\n<\/div> Companies are already using Copilot, ChatGPT, or proprietary AI agents today \u2013 mostly without inventory, risk classification, or documented responsibilities. This is not yet a problem, but the transition period is ending: as of August 2026, most obligations will apply to higher-risk AI systems. Those who have not established governance structures by then risk fines and usage prohibitions. <\/p>\n Brief overview of the most important milestones:<\/p>\n<\/div><\/div><\/div><\/div><\/div> <\/p>\n<\/div>\n The period until 08\/2026 is not an observation phase, <\/span>but a<\/span> implementation phase. Now, inventory lists must be established, high-risk applications identified, responsibilities defined, and initial <\/span>policies<\/span> tested. Those who wait lose valuable months <\/span> and will face hectic compliance projects in 2026.<\/span><\/p>\n<\/blockquote>\n<\/div><\/div><\/div><\/div><\/div> For Copilot, GPT-based assistants, or proprietary AI agents to be operated in compliance with the law from 2026, it is not enough to approve individual use cases. Companies need a documented policy set and clear processes \u2013 lean, but binding. The goal is a uniform framework: Who decides on new AI applications, which data may be used, and how is their use documented traceably?<\/i> <\/p>\n What should the policy set include at a minimum? <\/b><\/p>\n<\/div><\/div><\/div><\/div><\/div> AI Governance Policy:<\/strong> Principles on where and under what conditions AI may be used in the company.<\/p>\n<\/div><\/li> Use Case Approval Process:<\/strong> Every new AI application requires a profile (purpose, data sources, risk) that is reviewed and approved.<\/p>\n<\/div><\/li> For AI systems like Copilot or proprietary agents to be operated responsibly, more than just technology is needed \u2013 clear responsibilities are essential. The AI Act does not require job titles, but traceable responsibility. A RACI matrix is perfectly suited for this: Who is Responsible, who is Accountable, who is Consulted, and who is Informed? <\/p>\n Typical roles in the AI governance model: <\/b><\/p>\n<\/div><\/div><\/div> For AI applications like Copilot or proprietary agents to be operated compliantly from 2026, a binding approval process is required. The goal is not bureaucracy, but transparency: Which AI is used where, with what data, by whom is it managed, and with what risk? <\/p>\n<\/div><\/div><\/div><\/div><\/div> Step 1: Submit Use Case Profile<\/b> Step 2: Risk check according to AI Act<\/b> Depending on the classification, appropriate requirements are triggered<\/span>, e.g., <\/span>documentation obligation<\/span>, human oversight, data quality evidence, or entry into the EU database.<\/span><\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div> Step 3: Approval & Action Plan<\/b>IT, data protection, legal, and potentially Risk\/Compliance review the use case. It may only be used productively after approval. If risks exist but are acceptable, the decision is documented (Risk Acceptance). Missing controls are recorded as measures with a deadline. <\/p>\n<\/div><\/div><\/div><\/div><\/div>What is the AI Act?<\/h2><\/h2><\/div>
protection, and legal. Inventory lists, responsible roles, risk assessments, and traceable decisions
are no longer optional, but mandatory. <\/p>\nWhen Do the Regulations Apply?<\/h2><\/h2><\/div>
\n\n
\n \nTimeline<\/th>\n What applies?<\/th>\n<\/tr>\n<\/thead>\n \n As of February 2025<\/span><\/span> <\/span><\/td>\n Prohibition of inadmissible AI systems (e.g., <\/span>social<\/span> scoring, manipulative systems) and obligation to have basic AI competence (AI <\/span>literacy<\/span>).<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n By August 2025<\/span><\/span> <\/span><\/td>\n Requirements for general-purpose AI models (e.g., GPT, Gemini) \u2013 transparency, documentation, model cards.<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n By August 2026<\/span><\/span> <\/span><\/strong><\/td>\n Main deadline<\/strong>: Companies must have implemented AI inventory, risk classification, <\/span>policies<\/span>, roles (RACI), approval processes, <\/span>logging<\/span>, and monitoring \u2013 especially for high-risk applications.<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n As of August 2027<\/span><\/span> <\/span><\/td>\n Additional verification obligations, including for standardized high-risk systems such as medical devices, machines, elevators, etc.<\/span><\/span> <\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \n
Policies & Processes \u2013 What Must be Documented by 2026<\/h3><\/h3><\/div>
![\"An](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/10\/Policyprocess_NoBackground-scaled-e1761640235179.png\" "\\"Policyprocess_NoBackground\\"")
<\/span><\/div><\/div><\/div>
These policies only function with clear processes behind them: <\/b><\/p>\n<\/div>Roles According to RACI \u2013 who Bears which Responsibility?<\/span><\/span><\/h2><\/h2><\/div>
\n\n
\n \nRole<\/th>\n Tasks in AI Use<\/th>\n<\/tr>\n<\/thead>\n \n Owner<\/span> \/ Fachbereich<\/span><\/span> <\/span><\/td>\n Meldet Use Cases, dokumentiert Zweck & Nutzen, verantwortet Ergebnisse.<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n IT \/ platform operation<\/span><\/span> <\/span><\/td>\n Technical setup (e.g., Copilot, Azure OpenAI), access controls, integration & operation.<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n Risk \/ Compliance<\/span><\/span> <\/span><\/td>\n Assesses risk, defines control measures, documents risk acceptance.<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n Legal \/ Data protection<\/span><\/span> <\/span><\/td>\n Reviews legal frameworks, licenses, data protection impact assessment.<\/span><\/span> <\/span><\/td>\n<\/tr>\n \n Information security<\/span><\/span> <\/span><\/td>\n Evaluates data access, model security, protection against misuse.<\/span><\/span> <\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div><\/div><\/div><\/div> Approval Process \u2013 from Idea to Release<\/span><\/span><\/h2><\/h2><\/div>
Every new AI deployment is registered with a short, standardized form. Typical contents: <\/span><\/p>\n\n
<\/span><\/li>\n
After the profile, the use case is classified into the AI Act risk categories:<\/p>\n\n