Following the adoption of Regulation (EU) 2026/1744 – the Digital Omnibus on AI – operators deploying high-risk AI systems under Annex III of the EU AI Act now have until 2 December 2027 to achieve full compliance, a targeted extension from the original 2 August 2026 deadline. For businesses established in or operating through Germany, this revised timetable creates both an opportunity to build robust compliance programmes and a risk of underestimating what remains in force today. Organisations that act early are better positioned to manage regulatory scrutiny, protect commercial relationships and avoid the significant penalties that apply once the deadline passes.
The Revised Timetable: What Changed and What Did Not
The Digital Omnibus on AI (Regulation (EU) 2026/1744) reached political agreement on 7 May 2026, passed European Parliament plenary vote on 16 June 2026, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Its central effect on the compliance calendar is precise and significant.
The obligations attached to Annex III high-risk systems – covering areas such as employment screening tools, credit scoring, biometric identification and certain public-service AI applications – were moved to 2 December 2027. Obligations tied to Annex I product-embedded AI (systems embedded in regulated products such as machinery, medical devices and vehicles) were shifted further, to 2 August 2028.
Critically, not everything was deferred. Article 50 transparency obligations, the AI Office's enforcement powers and the penalty regime all applied as originally scheduled on 2 August 2026. This means that businesses interacting with natural persons through AI-generated content, chatbots or synthetic media are already subject to disclosure requirements and may already be subject to enforcement action. The extension does not create a general grace period – it creates a specific one, with clear outer boundaries.
Germany's Regulatory Landscape: Key Actors and Institutional Context
Germany presents a distinctive compliance environment. Federal supervisory architecture means that AI-related oversight intersects with sector-specific regulators whose mandates were well-established before the AI Act. Understanding which bodies are likely to act, and on what basis, is central to any realistic risk assessment.
- The AI Office (established within the European Commission) holds primary enforcement competence over general-purpose AI models and coordinates with national authorities. Its powers, including the ability to conduct audits and impose penalties, have been operative since 2 August 2026.
- BaFin (Bundesanstalt für Finanzdienstleistungsaufsicht) is the relevant sectoral supervisor for AI systems deployed in financial services, including credit-scoring tools and automated advisory systems. BaFin has signalled ongoing interest in algorithmic transparency and model explainability, consistent with its existing supervisory expectations.
- National market surveillance authorities – under German law, these will play a role in Annex I product-embedded AI once that deadline arrives in August 2028.
- The Bundesgerichtshof (BGH) will ultimately shape the interpretation of civil liability questions arising from AI-related harm, including how existing product liability and tort principles interact with AI Act obligations. No binding BGH precedent directly addressing the AI Act had been issued as of the date of this analysis; the judicial landscape is therefore still forming.
German corporate entities – whether structured as a GmbH or otherwise – must ensure that compliance responsibilities are clearly allocated at board level. Given that the Handelsregister (commercial register) records the registered directors and their mandate, any enforcement action will trace accountability to named individuals with management responsibility.
High-Risk AI Under Annex III: What Compliance Requires by December 2027
The core obligations for Annex III high-risk systems are demanding and require sustained organisational effort well before the deadline. Waiting until late 2027 to begin substantially increases the risk of incomplete or deficient compliance at the point of enforcement.
The principal requirements include:
- Risk management system: A documented, iterative process identifying and mitigating risks throughout the system's lifecycle, not a one-time assessment at deployment.
- Data governance: Training, validation and testing data must meet defined quality criteria; practices for data collection, processing and management must be documented.
- Technical documentation: Comprehensive records enabling post-market evaluation and regulatory audit, maintained and updated as the system evolves.
- Transparency and instructions for use: High-risk systems must be designed to allow deployers to understand their operation; instructions must be provided to human overseers in a form that is actually usable.
- Human oversight measures: Built-in technical capabilities enabling humans to monitor, override and intervene, with accountability allocated to identifiable persons.
- Accuracy, robustness and cybersecurity: Systems must meet performance standards appropriate to their intended purpose and be resilient to adversarial manipulation.
- Conformity assessment: Depending on the category of high-risk system, a conformity assessment – either self-assessment or involving a notified body – must be completed before deployment.
- Registration: High-risk systems must be registered in the EU database before being placed on the market or put into service.
For operators using high-risk AI in employment contexts – for instance in recruitment, performance evaluation or workforce management – Germany's existing co-determination framework adds a further layer. Works councils have statutory rights under the Betriebsverfassungsgesetz that are directly relevant to the introduction of AI tools affecting employees. Integrating AI Act compliance with works council consultation is not optional and requires advance planning. Ferraz & Whitmore's practice covers both the AI Act obligations and the employment law dimensions of AI deployment; further analysis is available at our employment law practice for Germany.
If your organisation deploys or plans to deploy an Annex III high-risk AI system in Germany and you are assessing your current exposure, we welcome the opportunity to discuss your situation. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
General-Purpose AI: A Separate and Already-Active Obligation
The Digital Omnibus extension does not affect obligations that apply to general-purpose AI (GPAI) models. Providers of GPAI models – including those with systemic risk designations – are subject to the AI Office's oversight regime and to transparency and documentation requirements that are already in force. Businesses in Germany that develop, fine-tune or distribute GPAI models must not conflate the Annex III extension with a deferral of GPAI obligations; these are legally distinct tracks.
The interaction between GPAI obligations and high-risk system classification is one of the genuinely open interpretive questions the AI Act presents. A GPAI model integrated into a downstream application that qualifies as Annex III high-risk will engage both sets of rules, with questions of responsibility allocation between model provider and system deployer requiring careful contractual treatment.
Algorithmic Transparency: Already Required Under Article 50
Article 50 transparency obligations – requiring disclosure when persons interact with AI systems, including chatbots and synthetic content generators – have applied since 2 August 2026. German businesses operating consumer-facing AI interfaces should have already implemented compliant disclosure practices. Where this has not been done, the exposure is current, not future.
Algorithmic transparency under Article 50 requires disclosures to be made in a manner that is clear and intelligible to the person concerned. German consumer protection law and the general standards applied by German courts to disclosure obligations will inform how regulators and ultimately the BGH assess whether disclosures are adequate. Vague or heavily technical disclosures are likely to attract scrutiny.
Cross-Border Implications for Foreign Operators
The AI Act applies wherever AI systems are placed on the EU market or where their outputs are used within the EU, regardless of where the system's provider is established. For non-EU businesses – whether operating through a German GmbH, a branch or directly from outside the EU – this means that the territorial reach of the regulation is broad.
Non-EU providers of high-risk AI systems must, under the AI Act framework, designate an authorised representative established in the EU. Where Germany is the primary market of deployment, that representative may face scrutiny from German authorities, and the allocation of compliance responsibilities between the non-EU provider and its EU representative needs to be governed precisely in any agency or service agreement.
For businesses structured through a German GmbH, the Handelsregister registration of the entity creates a traceable legal anchor for regulatory correspondence. This is relevant to both AI Act compliance procedures and to any civil recovery process – including, where applicable, the Mahnverfahren (payment order procedure) – that may arise from AI-related disputes.
Strategic Recommendations for the Period to December 2027
The approximately fourteen months remaining before the Annex III deadline are sufficient for a well-organised compliance programme, but not for a poorly planned one. Based on the legal requirements as currently understood, the following sequencing reflects sound practice:
- Immediate (Q4 2026 – Q1 2027): Complete an inventory of all AI systems currently deployed or in development. Classify each system against Annex III categories and the GPAI framework. Identify which systems are already subject to live obligations (Article 50, GPAI) and audit current compliance status.
- Medium term (Q1 – Q3 2027): For Annex III systems, build or commission the required documentation structure: risk management system, data governance framework, technical documentation. Conduct gap analyses against conformity assessment requirements. Engage works councils where AI tools affect the workforce.
- Pre-deadline (Q3 – Q4 2027): Complete conformity assessments, register qualifying systems in the EU database, finalise human oversight protocols and test them operationally. Ensure contractual frameworks with suppliers, customers and authorised representatives allocate AI Act responsibilities clearly.
- Ongoing: Post-market monitoring is a continuous obligation, not a one-time sign-off. Build monitoring processes into operational practice rather than treating compliance as a project with a fixed end date.
An illustrative scenario involving an AI-driven HR screening tool deployed by a German employer – and the compliance issues it raises under both the AI Act and German employment law – is discussed in our case analysis on AI Act issues in HR tool deployment in Germany.
Open Questions and the Evolving Interpretive Landscape
Several questions of practical importance remain unsettled. The boundary between Annex III high-risk classification and systems that fall below the threshold is not always clear from the text alone. Guidance from the AI Office, and ultimately authoritative interpretation by EU and national courts, will be required. German businesses should not assume that a system falls outside Annex III without a documented legal analysis of the classification question.
The liability interface between the AI Act and Germany's existing civil law framework – particularly as the BGH develops its approach to AI-related harm – is another area where the law is actively forming. The AI Act does not create an autonomous civil liability regime; it interacts with national tort, product liability and contract law in ways that are not yet fully mapped. Organisations exposed to AI-related liability risks should take legal advice on how these frameworks interact in their specific operational context.
Penalty exposure under the AI Act is significant. The regulation's penalty regime has been in force since 2 August 2026. Organisations that are non-compliant with live obligations today face current enforcement risk, not merely prospective risk after December 2027.
Ferraz & Whitmore advises international clients on AI Act compliance across EU jurisdictions, including Germany. Our AI Act compliance practice for Germany covers classification analysis, documentation frameworks, conformity assessment strategy and cross-border implementation. To discuss your organisation's position, please write to info@ferrazwhitmore.com.
Outlook
The Digital Omnibus extension reflects the legislature's recognition that full Annex III compliance requires meaningful preparation time. It does not signal a weakening of the regulatory framework or a reduced appetite for enforcement. On the contrary, the AI Office's operational status since August 2026 and the parallel development of supervisory capacity at national level in Germany indicate that the enforcement environment will be substantive well before the December 2027 deadline arrives.
For operators seeking to enter or consolidate their position in the German market through AI-enabled products or services, the compliance trajectory is now well enough defined to plan against. The risk is not primarily in the law's ambiguity – it is in underestimating the organisational lead time required to implement what the law clearly requires.
For a structured review of your AI compliance position in Germany, contact the Ferraz & Whitmore team at info@ferrazwhitmore.com or use our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.