From 2 August 2026, Article 50 transparency obligations and the AI Office's enforcement and penalty powers under the EU AI Act apply in Germany without further delay, while the Digital Omnibus Regulation (EU) 2026/1744 – published in the Official Journal on 24 July 2026 and in force from 27 July 2026 – has shifted the deadline for most Annex III high-risk obligations to 2 December 2027 and for product-embedded Annex I systems to 2 August 2028. For businesses contracting for general-purpose AI in Germany, this recalibrated timeline creates a defined but narrow window to renegotiate liability provisions, insert compliance milestones and prepare governance structures before the fuller obligation set comes into force.
The Regulatory Landscape as It Stands
The EU AI Act has not been repealed or significantly diluted by the Digital Omnibus process; rather, the Omnibus Regulation (EU) 2026/1744 adjusted its sequencing. The political agreement was reached on 7 May 2026, with European Parliament plenary approval following on 16 June 2026. Publication on 24 July 2026 and entry into force three days later means that, as of the date of this analysis, the recalibrated regime is already operative.
The practical effect is a two-track system. One track is already live: Article 50 transparency obligations – covering disclosure that users are interacting with an AI system, labelling of AI-generated content, and AI watermarking requirements – applied on 2 August 2026 as originally scheduled. The AI Office's enforcement powers and the associated penalty regime are also in force from that date. For a detailed treatment of the watermarking deadline and its technical implications, see our alert on the AI watermarking deadline in the EU.
The second track – covering the full set of obligations for high-risk AI systems listed in Annex III (including conformity assessments, technical documentation, human oversight measures, and registration in EU databases) – is deferred to 2 December 2027. Annex I product-embedded systems, governed partly by existing product safety directives, face a further deferral to 2 August 2028. German businesses and their counterparties must map precisely which category their AI deployments fall into; the deferral is not universal.
General-Purpose AI Models: Where the Exposure Sits Now
General-purpose AI (GPAI) models occupy a distinct chapter of the AI Act. Providers of GPAI models – large language models and other foundation models made available for downstream integration – face their own obligations regardless of the Annex III or Annex I classification of the applications built on top of them. These include obligations around technical documentation, copyright compliance policies, and, for models with systemic risk, additional adversarial testing and incident reporting to the AI Office.
The critical contracting question for German businesses is this: when a GPAI model is embedded in a product or service that a German company deploys, who bears the regulatory exposure if something goes wrong? The AI Act's structure places primary obligations on the provider of the model and, separately, on the deployer of the system. Where those are different entities – as is almost always the case in B2B licensing or API-based integration – the contract becomes the principal instrument for allocating residual risk between them.
Under German law, this analysis does not happen in a vacuum. The Bundesgerichtshof (BGH) has developed a substantial body of doctrine on allocation of liability in technology supply chains, including cases addressing software defects, duty to warn, and contractual limitation clauses. German courts will apply the rules on AGB-Kontrolle (standard terms review under §§ 305–310 BGB) rigorously to any attempt to shift liability wholesale onto the deployer through pre-drafted provider terms. Limitation clauses that exclude liability for gross negligence (grobe Fahrlässigkeit) or personal injury remain ineffective under German law regardless of the governing law clause if the deployer is a consumer; even in B2B settings, disproportionate exclusions face judicial scrutiny.
Key Contractual Pressure Points
Businesses reviewing or drafting AI supply agreements for use in Germany should focus on the following areas:
- Compliance representation and warranty cascade. Providers should represent that their GPAI model meets the obligations applicable to it as at the date of deployment and undertake to maintain compliance through the Annex III deadline of 2 December 2027. Deployers should seek a warranty that any material regulatory change will be notified promptly, with a contractual adjustment mechanism.
- Transparency obligation pass-through. Article 50 obligations are live now. Contracts must clearly allocate who is responsible for user-facing disclosures, watermarking implementation, and AI-generated content labelling. Ambiguity here creates immediate enforcement exposure, not a future risk.
- Incident reporting and cooperation. The AI Office's enforcement powers include the ability to request information and impose penalties. The contract should specify which party leads on AI Office communications, how costs are shared, and what notification timeline applies between the parties when an incident occurs or an authority makes contact.
- Audit and technical documentation rights. Deployers building high-risk applications need access to the provider's technical documentation to complete their own conformity assessments before 2 December 2027. Contracts concluded now without audit rights or documentation-sharing obligations will be difficult to remedy closer to that deadline.
- Indemnification structure. Given BGH doctrine on liability allocation, a blanket provider indemnity is unlikely to be enforceable in its broadest form. Parties should instead define the scope of each party's regulatory sphere precisely and provide for proportionate indemnification tied to breach of specific, identified obligations.
- Governing law and jurisdiction. Where the provider is based outside the EU, German courts will apply EU rules directly to the deployer and may apply them extraterritorially to providers. Choosing German law or agreeing on jurisdiction in Germany has implications for how BGB mandatory provisions interact with the AI Act compliance framework.
If your organisation is currently reviewing AI supply arrangements or is in the process of negotiating terms with a GPAI provider, our team is available to assist with a structured contract review. Please write to info@ferrazwhitmore.com or visit our contacts page to discuss your situation.
AI Act Compliance Infrastructure for German Deployers
AI Act compliance is not solely a contracting exercise; it requires organisational and technical infrastructure. German deployers of GPAI-based systems that fall into Annex III categories – covering sectors such as employment, credit, critical infrastructure access, and education – have until 2 December 2027 to implement the full suite of requirements, but the foundational work is best begun now rather than in the final months before the deadline.
In practice, this means assembling the technical documentation that German regulators and the AI Office may request; establishing a human oversight function with defined escalation paths; registering applicable high-risk systems in the EU database when that registration obligation activates; and documenting the risk management process on an ongoing basis. For employment-related AI applications – recruitment screening tools, performance monitoring systems, automated scheduling – there is an additional overlay of German employment law, co-determination rights, and works council consultation obligations. Our employment law practice in Germany can advise on how those frameworks interact with the AI Act timeline.
The BaFin dimension adds a further layer for financial sector deployers. Germany's financial supervisory authority has been developing its supervisory expectations around AI use in regulated firms, and those expectations run in parallel with – and in some respects ahead of – the AI Act's Annex III obligations. Financial institutions should not assume that the 2 December 2027 deferral gives them a complete reprieve from supervisory scrutiny of their AI systems.
Cross-Border Implications for Non-German Groups
Many of the businesses most exposed to this framework are not German companies but rather international groups that distribute products or services in Germany through a GmbH or branch structure, or that procure GPAI-based tools from US, UK or Asian providers for use in German operations. Several cross-border issues deserve attention.
First, the AI Act applies to providers and deployers whose systems are used in the EU, regardless of where those entities are established. A provider incorporated outside the EU that supplies a GPAI model used in Germany must either appoint an EU-authorised representative or, where that obligation applies under the Act's structure, ensure its German deployer customer has the contractual basis to satisfy the applicable obligations on its behalf. The contract, once again, is the operative instrument.
Second, the algorithmic transparency obligations under Article 50 – now in force – apply at the point of interaction with end users. For international groups operating customer-facing AI tools in Germany, this means that German-language disclosure obligations and watermarking standards apply from 2 August 2026, regardless of where the AI system is hosted or where the provider is domiciled.
Third, from a corporate structuring perspective, international groups should review whether their German entity's relationship with the group's central AI governance function is appropriately documented. Regulators and courts examining an incident will trace responsibility through the corporate structure; a GmbH whose management board has no visibility into the AI systems it deploys, or no documented oversight process, faces a more difficult position. Handelsregister filings and internal governance records should reflect the AI governance allocation clearly.
The Mahnverfahren Risk and Commercial Dispute Exposure
One underappreciated risk in AI contracting is the speed with which payment disputes and performance disputes can escalate into summary proceedings in Germany. The Mahnverfahren (court order for payment) procedure allows counterparties to obtain a payment order through the automated court system without a full hearing; once issued, the debtor has only a short window to object before it becomes enforceable. In the context of AI contracts, where fees may be volume-based, where penalties for non-compliance may be triggered, or where indemnification demands arise following a regulatory inquiry, the contractual mechanism for disputing amounts and the defined procedure for raising technical defences become critical. Contracts that are silent on dispute escalation – or that incorporate forum selection clauses pointing away from German courts – may leave German-based parties in a weaker position when a dispute arises quickly.
Strategic Recommendations for the August 2026 to December 2027 Window
The window between 2 August 2026 and 2 December 2027 is not a pause in regulatory development; it is an active compliance preparation period with live enforcement exposure already in place. Businesses operating in Germany should treat it as such.
- Audit existing AI contracts now. Identify which agreements cover GPAI-based tools, map the systems against Annex III categories, and assess whether the current contractual risk allocation reflects the updated timeline.
- Prioritise Article 50 compliance immediately. Transparency obligations are not deferred. Any GPAI-based user-facing system deployed in Germany should have compliant disclosure mechanisms in place.
- Build the compliance documentation baseline. Even for Annex III obligations not due until December 2027, the documentation required – risk management systems, testing records, technical files – takes time to produce. Beginning now avoids a bottleneck.
- Engage with providers on renegotiation. The Omnibus adjustment gives both parties a legitimate reason to revisit terms. Providers may be willing to offer improved compliance representations now that the extended timeline reduces their near-term burden.
- Review employment and sectoral overlays. For HR, financial services, or critical infrastructure applications, the AI Act obligation is one layer of a multi-layered compliance requirement. Sector-specific analysis is essential.
For a full analysis of the AI Act compliance obligations applicable to your specific deployment model in Germany, our AI Act compliance practice in Germany provides structured support from regulatory mapping through to contract review and organisational implementation.
Outlook
The Digital Omnibus recalibration reflects a deliberate political decision to give industry more time to absorb the high-risk obligations without reducing the accountability framework's bite at the transparency and enforcement level. For Germany specifically, the combination of a strong regulatory culture, an active AI Office, a sophisticated judiciary experienced in technology liability, and sector regulators such as BaFin that are developing their own AI supervisory frameworks means that the practical compliance pressure will be felt well before the formal deadlines arrive.
The August 2026 to December 2027 period is best understood not as a grace period but as a defined preparation window with real consequences for businesses that do not use it purposefully. Contracts entered into during this window will be the documents that govern liability when the full Annex III regime comes into force – and when the first significant enforcement actions and private claims emerge.
To discuss how these developments affect your organisation's contracts, risk allocation or compliance planning in Germany, please contact us at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.