Der EU AI Act und die Grand Challenge

Three years ago, when the EU AI Act was still just a draft, my company sat in a room in St. Gallen and got grilled by four different groups of expert lawyers and technologists.

They wanted to know exactly how this law would hit us.

The event, called The Grand Challenge, was initiated and organized by Thomas Burri at the University of St. Gallen.

Lawyers, tech people, and experts from across the EU came together to assess how the Act would actually affect companies.

They went through everything with us:

• Do you train your own models?
• Do you use foundation models?
• Do you work in education?
• Do you work in medical?

We walked out with four separate formal assessments of our exposure.

The conclusion fits in one sentence:

As long as you don't train your own foundation model, where knowledge from the world is baked into probabilities, then you're more or less fine.

The burden sits with the ones who train and retrain the models: Google, Anthropic, Meta, and OpenAI, not the companies that simply use them.

For manufacturers, my read back then was that they only get pulled in if they train their own models, say for a medical device.

Most of them aren't doing that.

They want to optimize programming code for their machines. They're not suggesting people's therapies or building the next education program.

I'll be honest: that was my conclusion in 2023, and I haven't tracked every change since.

So take it as a starting point, not a ruling.

Which brings me to the news everyone is reacting to.

The deadline for high-risk obligations for standalone AI systems moved from August 2026 to December 2027.

For AI embedded in machinery and regulated products, the deadline moved to August 2028.

This is a runway to use, and every one of your competitors has the exact same extension.

So the real question is:

Who uses that time to build AI into their products and processes properly, and who just takes a deep breath and wastes it?