The EU AI Act is the first AI law in the world with real substance. This page explains from a practitioner’s perspective what it requires of companies, how it interacts with GDPR, BaFin, DORA and MaRisk, and how to implement it without regulating your own AI project to death.

I see two reactions to the EU AI Act in client conversations. Some ignore it because the deadlines were postponed. Others try to pass the audit before they have developed anything, and therefore develop nothing. Both are wrong. The AI Act is a quality framework. Those who consider it from the start build systems that will still be allowed to run in five years.

What the EU AI Act regulates

• Risk-based approach: prohibited practices, high-risk systems with extensive obligations, systems with transparency obligations and systems with minimal risk. Classifying your own use case is the first step.
• Obligations for high-risk systems: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, registration.
• Typical high-risk cases: credit scoring, applicant selection, access to insurance services, critical infrastructure, parts of public administration.
• Timeline: the law has applied in stages since 2024. With the Digital Omnibus on AI, the high-risk obligations were postponed to 2 December 2027, for Annex I systems to August 2028. Use the time to prepare, not to wait.

EU AI Act, BaFin, DORA, MaRisk: how they interact in banks

For financial institutions the AI Act does not come alone. BaFin checks whether a bank operates properly, and therefore also whether an AI credit decision was explainable and a human could trace it. DORA ensures that IT systems remain resilient and secure. MaRisk sets the minimum requirements for risk management. Together they form a framework that many institutions still work through with spreadsheets today. Fulfilled, not fulfilled, show the table, pass the audit. That costs time and above all money that can be saved by transferring the requirements into a technical layer.

The example that explains everything

Two loan applications of 100,000 euros, identical data, one applicant is called Ahmed, the other Stefan. The AI rejects Ahmed. The AI Act requires this decision to be traceable. If the model learned from historical data that Ahmeds were rejected more often, there is bias and a human must intervene. Human in the loop is not a slogan but a point in the process where someone really looks. That is exactly what the system must be able to log.

How we implement the EU AI Act

• Use-case inventory and risk classification of all deployed and planned AI systems.
• Data governance: documented origin, quality and processing of training data, pseudonymisation instead of personal data.
• Governance layer: registration, logging, boundaries, escalation, audit-ready documentation.
• Human oversight at defined points with a real ability to intervene.
• Evidence for supervisors, auditors and customers, without anyone maintaining spreadsheets.

Brake or advantage?

Yes, Germany and Europe are slower in AI development than the competition. Other countries do not have this brake, but there it is completely uncontrolled. In the end Germany is the country everyone buys from, because here things are built with brains, with judgement and with regulation. Our international orders come for exactly that reason: clients want a German firm that knows how to build systems that pass an audit. The AI Act is not an obstacle to that, it is the ticket.

Further reading in English

• AI, Cognitive Transformation & Data Integrity: Key Takeaways from My Keynote at the Frankfurt Business Forum
• How Skilldex Helped Us Fix Hiring, Stop Wasting Time, and Finally Match the Right People
• From Data Lag to Real-Time — Why Event-Driven Architectures Are Critical for Scalable AI
• Why Most AI Projects Never Leave the Lab — And How to Change That
• Why AI is Reshaping Business Models Faster Than Expected

About Umair Zaffar

I started as a freelance software developer in 2017 with a first project at an insurer in Hanover. In 2019 my co-founder Ayman Kalaie and I founded sifamo GmbH, self-financed and without loans. Today around 30 consultants, architects and developers work from Berlin and Frankfurt am Main; above the GmbH sits SFM Holding with SIFAMO Events, the organiser of the SIFAMO AI Summit. Since 2023 our focus has been AI in regulated industries. On my YouTube channel and in this blog I share what we learn along the way: unfiltered, with numbers and without consultant jargon. Most posts are in German; the English articles from 2024 and 2025 are listed below.

Frequently asked questions

Does the EU AI Act already apply?

Yes, in stages since 2024. Prohibitions and transparency obligations already apply, the obligations for high-risk systems from December 2027 or August 2028. Anyone planning high-risk systems today should build the requirements in now.

Is our use case high-risk?

If it co-decides on people’s access to credit, jobs, insurance, education or public services, very probably yes. The precise classification is the first step of every engagement.

What happens in case of violations?

The AI Act provides for substantial fines; in banks BaFin supervision comes on top. More important than the penalty is the loss of trust among customers. How to avoid it is something we are happy to discuss, see AI governance or the contact page.

Want to classify your use case under the EU AI Act and get an implementation plan that does not end in a spreadsheet? Reach me via the contact page, by e-mail at contact@sifamo.com or directly on LinkedIn.