PIPELINEGuide
AI consulting and the EU AI Act: Disclosure requirements
The transparency obligations of the EU AI Act have been in effect since August 2026. What this means for AI consulting, who is affected, and what implementation actually involves.
The transparency obligations under Article 50 of the EU AI Act have been in effect since August 2026: anyone communicating directly with an AI system must be able to recognize it. We build in the disclosure as standard. For AI consulting, this means: disclosure is mandatory, not optional, and applies regardless of company size — a sole proprietorship is affected just as much as a corporation. What matters is the purpose and risk, not the number of employees.
01 — Legal situation
EU AI Act: what applies
Since August 2026, the transparency requirements from Article 50 of the EU AI Act apply: Anyone communicating directly with an AI system must be able to recognize it. We build in the labeling as standard.
The AI Act doesn't distinguish by company size: A sole proprietorship with an AI system in customer contact is affected just as much as a corporation. What matters is purpose and risk, not headcount.
There's also the obligation to ensure adequate AI competence for the people working with it. That's not an examination requirement, but it should be documented — a training session with a participant list is the simplest proof.
02 — Data protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for AI consulting: a data processing agreement with every service provider involved, verification of where processing takes place, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Isn't this just a disguised sales event?
The recommendation regularly includes items you can implement yourselves or with your existing service provider, as well as cases we advise against. The document is yours and works without us too.
Do we also get recommendations for providers other than you?
Yes, where it makes sense. Some use cases are better suited to standard software or a specialized provider — that's stated in the document, not hidden.
How does this differ from consulting by the Chamber of Commerce?
The Chamber offerings provide a good overview of funding options and basics. We go a step further and look at your specific processes and systems — with effort estimates that we ourselves would have to meet.
What does it cost us if nothing comes of it in the end?
Only the agreed price for the workshop and document — there's no success fee and no hidden follow-up obligation. The preliminary conversation is free and is meant to catch exactly these kinds of mismatched inquiries beforehand.
What funding is available in Austria?
Options include KMU.DIGITAL and aws digitalization funding — current terms at kmudigital.at and aws.at. Both require the application to be approved before awarding the contract — that's why we bring it up early and not at the end.
Isn't a conversation with management enough?
No, that's the most common reason for a list that doesn't work later. The people who do the processes daily know the exceptions that an outside perspective never sees.
Who should be at the workshop?
At least one person from management and two to three who do the affected processes daily. Without the second group, you get a list that doesn't work in practice.
05 — Next
Related pages
- AI consulting — Overview
- AI consulting — How it works
- AI consulting — introduction
- AI consulting — Costs
- AI consulting — Practical examples
- AI consulting — Pros and cons
- AI consulting — checklist
- AI consulting — Funding
- AI automation
- Process automation
- AI training
- All guides
AI consulting by region
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.