AI Providers as ICT Third-Party Providers under DORA
DORA treats AI providers as ICT third-party providers under Art. 28. It covers the duties involved and where AI Act deadlines start to matter.
Read more →KomplAI blog
EU AI Act compliance, explained practically
Short, evidence-backed articles on the EU AI Act, DORA and GDPR — every citation checked against the official EUR-Lex texts.
ICT Risk Management for AI Services under DORA
DORA requires documented ICT risk management for AI services in the financial sector under Art. 5 and 6 of DORA – plus AI Act duties from 2026.
Read more →Employee Data and AI: Section 26 BDSG in Practice
How Section 26 BDSG limits the use of AI in recruitment and workforce analytics, and why necessity and co-determination remain decisive factors.
Read more →Art. 32 GDPR: Documenting TOMs Properly
Art. 32 GDPR requires appropriate TOMs based on risk. What this means in practice, typical gaps, and how to document compliance.
Read more →AI Providers as Processors: Art. 28 GDPR Explained
When AI providers process personal data, you need an Art. 28 contract. What must be included and where the typical gaps lie.
Read more →Legal Basis for AI Training: Art. 6 GDPR
Training AI models with personal data requires a lawful basis under Art. 6 GDPR. We examine legitimate interest, purpose change and typical common gaps.
Read more →Art. 22 GDPR: Limits on Automated Decisions
Art. 22 GDPR: when automated decisions and AI profiling are lawful – covering obligations, exceptions and typical compliance gaps in practice.
Read more →DPIA for AI Systems: When Art. 35 GDPR Applies
AI systems almost always trigger a data protection impact assessment under the GDPR. What Art. 35 GDPR requires and where the typical gaps lie in practice.
Read more →Art. 99 AI Act: Fines Framework Overview
Art. 99 AI Act sets fines of up to EUR 35 million or 7% of global turnover – three tiers, SME rules and assessment criteria for your compliance team.
Read more →Art. 4 AI Act: Building AI Literacy in Your Team
Art. 4 AI Act has applied since 02.02.2025: staff and contractors must have adequate AI literacy. What this means and where the typical gaps are.
Read more →High-Risk AI under Art. 6: How to Assess It Correctly
Art. 6 AI Act determines whether your AI system is high-risk. An overview of Annex III, carve-outs and the postponed 2 December 2027 deadline.
Read more →Prohibited AI Practices under Art. 5 AI Act
The AI Act's Art. 5 prohibitions have applied since 02.02.2025. Here's what's banned, which exemptions apply, and where companies still have gaps.
Read more →Labelling Chatbots & AI Content: Art. 50
From 2 August 2026, Art. 50 AI Act sets labelling duties for chatbots and AI-generated content. Here's what providers and deployers must implement now.
Read more →Deployer Obligations under Art. 26 EU AI Act
Art. 26 EU AI Act sets out deployer obligations: human oversight, logging, and incident reporting. What businesses must actually implement in practice.
Read more →Art. 10 EU AI Act: data governance for high-risk AI
Art. 10 AI Act requires documented data governance for high-risk AI: the requirements, bias checks and the gaps teams typically run into.
Read more →Fundamental Rights Impact Assessment: Art. 27 AI Act
Art. 27 AI Act requires public bodies to carry out a fundamental rights impact assessment. An overview of mandatory content, timing and gaps.
Read more →Art. 15 AI Act: Robustness & Cybersecurity
Art. 15 AI Act requires accuracy, robustness and cybersecurity for high-risk AI systems. What this means in practice for development and operations.
Read more →What documents does your AI provider really owe?
Your AI provider owes you just one document by law: the Art. 13 instructions for use. Technical documentation and the declaration go to the authorities.
Read more →Conformity Assessment under Art. 43 AI Act
Which procedure applies to high-risk AI systems: Annex VI or VII? Obligations under Art. 43 AI Act explained – including common gaps.
Read more →Implementing Human Oversight under Art. 14 AI Act
Art. 14 AI Act requires effective human oversight of high-risk AI systems. Learn how to design roles, training and stop mechanisms correctly.
Read more →Logging Duty: What Art. 12 AI Act Requires
Art. 12 EU AI Act demands comprehensive logging and traceability for high-risk AI. What this means in practice for providers and deployers.
Read more →Art. 17 AI Act: QMS for High-Risk AI Providers
Art. 17 AI Act requires a documented quality management system for high-risk AI providers. What it covers and where typical gaps arise.
Read more →EU Database Registration under Art. 49 AI Act
Before high-risk AI systems under Annex III go live, providers must register them in the EU database under Art. 49 AI Act. Find out what applies and when.
Read more →Technical Documentation Under Annex IV: A Guide
What Article 11 and Annex IV of the EU AI Act require for the technical documentation of high-risk AI systems – and where gaps typically occur.
Read more →Art. 13 AI Act: Instructions for High-Risk AI
What Art. 13 AI Act requires for instructions for use of high-risk AI systems – mandatory content, gaps and tips for providers and deployers.
Read more →Art. 9 EU AI Act: risk management by August 2026
The risk management system under Art. 9 EU AI Act is the obligation most high-risk projects stumble on — plus the five most common gaps.
Read more →