EU AI Act checklist for companies in Austria

AI Act in Austria: which deadlines currently apply?

The AI Act applies in stages, and the Digital Omnibus has legally postponed the high-risk deadlines.

• Since 2 February 2025: The prohibitions under Art. 5 and the AI literacy measures under Art. 4 apply. Article 4 was amended in July 2026.
• Since 2 August 2025: GPAI obligations apply to providers of general-purpose AI models. For models placed on the market before that date, the transition period runs until 2 August 2027.
• Since 2 August 2026: The transparency obligations under Art. 50 generally apply, for example notices when people interact directly with AI and the disclosure of deepfakes.
• From 2 December 2026: Providers of generative AI systems placed on the market before 2 August 2026 must comply with Art. 50(2) on machine-readable marking. The new ban on certain sexualized deepfakes also becomes applicable.
• From 2 December 2027: The postponed high-risk rules for systems under Art. 6(2) and Annex III apply, for example to certain applications in education or in creditworthiness assessments.
• From 2 August 2028: The postponed high-risk rules under Art. 6(1) and Annex I apply to product-related systems classified accordingly.

The Digital Omnibus on EUR-Lex has been in force since 27 July 2026. The postponement is not a license to put off existing obligations. Also check the transitional rules for systems that are already in use.

Sources: RTR timeline, European Commission on the Omnibus entering into force and GPAI obligations including the transition period. The GPAI provider obligations do not apply to you simply because your team uses a third-party language model.

Practical checklist: which AI Act obligations affect companies

You determine your obligations for each AI system based on its intended purpose, your company's role and the risk classification.

Copy the list into your project board. For each item, add a responsible person, a due date and where the evidence is stored. Distinguish between general operational recommendations and specific high-risk obligations: not every item is legally required for every system.

• [ ] 1. Create an AI inventory. Record chatbots, assistants, agents and AI features in existing software. Note the provider, version, purpose, user groups, data types and interfaces. Include tools that business teams have procured themselves.
• [ ] 2. Determine your role. Clarify whether you act as a provider or a deployer. If you use third-party systems, you are typically a deployer. Your own development, offering a system under your own brand or making substantial modifications can trigger provider obligations. Document your reasoning.
• [ ] 3. Classify the risk. Check Art. 6 and Annexes I and III against the specific use. An automated creditworthiness assessment can be high-risk. A language model is not automatically a high-risk AI system. Also justify any exemptions you rely on.
• [ ] 4. Rule out prohibited practices. Check Art. 5 before approving a system for use. This generally covers emotion recognition in the workplace, with exceptions for medical or safety purposes. Also check social scoring and manipulative applications against the legal criteria.
• [ ] 5. Implement AI literacy measures. Plan measures under Art. 4 that match tasks, prior knowledge and the systems in use. Include relevant external contributors. Document content, attendance and practical exercises using the template below.
• [ ] 6. Check transparency obligations. Under Art. 50, clarify who owes which notices or technical markings. Inform people when they interact directly with AI, where required. Check deepfakes and AI-generated texts on matters of public interest, including the exceptions.
• [ ] 7. Clarify data protection. Check the legal basis, data minimization, information obligations, data processing agreements and third-country transfers under the GDPR. Clarify whether a data protection impact assessment is needed and whether Art. 22 on automated decision-making applies. Involve the people responsible for data protection.
• [ ] 8. Review supplier contracts. Agree on permitted data use, subcontractors, security requirements, information about changes and support with incidents. Request the system information required for your role. Contract clauses do not replace your own legal obligations.
• [ ] 9. Define human oversight. Decide who reviews outputs, approves decisions and is allowed to stop the system. Make sure these people have the competence and a real ability to intervene. For high-risk AI systems in particular, check the requirements for human oversight.
• [ ] 10. Organize logging. Clarify which operations must be traceable, who may view logs and when they are deleted. For high-risk AI systems, check the specific retention obligations. Avoid unnecessary personal data in logs.
• [ ] 11. Set up an incident process. Define the reporting channel, shutdown and preservation of evidence. Distinguish between incorrect outputs, serious incidents and personal data breaches. Depending on your role, clarify who informs providers or the competent authorities within the applicable deadlines.
• [ ] 12. Appoint a responsible person. Assign an internal owner and a deputy to each system. Management, IT, business teams and data protection need clear tasks. Art. 4 does not require a dedicated AI officer position.
• [ ] 13. Schedule a re-review. Review the classification and measures whenever models, features, data sources or intended purposes change. Keep open tasks and approvals up to date. Start preparing for your high-risk deadline with enough lead time.

For the legal context: consolidated AI Act on EUR-Lex, RTR on risk levels and prohibited practices, RTR on deployer obligations and RTR on provider obligations.

For item 6, see the RTR guidance on transparency obligations. Item 7 complements the AI Act review: the Austrian Data Protection Authority (Datenschutzbehörde) on AI and the GDPR explains the data protection requirements that apply in parallel.

Art. 4: template for your documentation

This template helps you record your measures for developing AI literacy in a traceable way.

Since the Omnibus amendment, Art. 4 still requires providers and deployers to take measures, but it does not require them to guarantee a specific level of AI literacy. Take into account prior knowledge, tasks, the context of use and the groups of people affected. No specific certificate or fixed number of training hours is required. The European Commission explains this in its Article 4 Q&A.

Copy template: AI literacy measures

• Company and document version: name, date, responsible person
• Target group: names or team, tasks, relevant external contributors
• Starting point: prior knowledge, experience, previous training
• Systems in use: tool, version, purpose, groups of people affected
• Learning objectives: what participants should understand and apply in their specific work process
• Content: system limitations, errors, bias, data protection, usage rules, escalation
• Delivery: date, duration, format, internal trainers or external provider
• Attendance and materials: attendance list, materials, version of the AI policy
• Practical exercise and feedback: task, difficulties observed, open questions
• Next measures: in-depth training, new employees, changes to the system, next review date

This documentation is a practical recommendation, not a legally required form and not a guarantee of full compliance. The RTR also recommends documenting AI literacy. Store personal training records with appropriate access rights and deletion periods.

Which body can help you in Austria?

The RTR AI Service Desk (KI-Servicestelle) provides orientation on the AI Act and supports companies in building knowledge.

The RTR AI Service Desk (KI-Servicestelle) is an information point. This function alone does not make it your competent market surveillance authority. According to the RTR FAQ on authority responsibilities currently available, Austria has not yet implemented the national allocation of AI Act responsibilities.

So check which authority is currently responsible for your sector before you submit any report to an authority. For GDPR questions, the Data Protection Authority remains relevant. The direct applicability of the EU regulation does not depend on the national designation of authorities.

How do you get started with implementation?

Start with your AI inventory, then work through the open questions on roles, risks and AI literacy measures.

Our AI consulting supports you with the organizational and technical implementation. With AI training for companies, you turn usage rules into everyday practice. For legal classifications, involve your legal advisors. You'll find further applications and our experience from live operation in the Ahoi Kapptn! AI hub.