The EU AI Act and the Two Classes

The EU names four official objectives for the EU AI Act: strengthening the internal market, promoting trustworthy AI, protecting fundamental rights and supporting innovation. Those are the stated aims. Before turning to how the AI Act distributes obligations and room for manoeuvre, a judgment under unfair competition law shows how tangible responsibility for AI answers has already become.

On 12 May 2026, the Higher Regional Court of Hamm ruled on Aesthetify’s chatbot (I-4 UKl 3/25). It had attributed incorrect qualifications to the company’s managing directors: two invented specialist titles and one recognised qualification in plastic and aesthetic surgery that they did not hold.

The Consumer Advice Centre of North Rhine-Westphalia brought the claim. The practice argued that the bot had acted independently and given false answers despite receiving correct information.

The court attributed the statements to the company. Questions about medical qualifications were foreseeable and the answers could have been controlled. The court granted leave to appeal to the Federal Court of Justice. The Verbraucherzentrale NRW lists the judgment as final on its website, dated 1 June 2026.

The case shows that existing law already matters when AI makes misleading claims. For me, it raises a broader question: who takes responsibility when AI misleads?

The AI Act adds AI-specific duties to existing law. This judgment concerns unfair competition law; it is not a ruling on a breach of the AI Act.

How do I read the underlying logic of the EU AI Act?

In briefMy reading starts with the legal definition of AI and a product-based approach associated with it. I ask which perspectives this framing opens and which questions about a possible counterpart it leaves aside.

The 2024 regulation contains 113 articles, 13 annexes and 180 recitals. It entered into force on 1 August 2024, with phased application. Under Article 113 as consolidated on 27 July 2026, many rules have applied since 2 August 2026. Key high-risk duties follow on 2 December 2027 for systems under Article 6(2) and Annex III, and on 2 August 2028 for systems under Article 6(1) and Annex I. The revised dates stem from Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026. These dates were checked on 11 October 2026.

Before reading the risk classes, it is worth looking at the definition. Article 3(1) describes AI as

a machine-based system that operates with varying autonomy, may adapt after deployment and infers from its inputs how to produce outputs that can affect physical or virtual environments (Article 3(1), paraphrased).

The word “may” matters: adaptiveness after deployment is possible, rather than a necessary feature of every system covered.

My interpretation is that the AI Act approaches AI mainly through technical systems, uses and the responsibilities of people and organisations. For me, that leaves open the question of a potentially sentient counterpart. The regulation neither proves nor disproves consciousness, nor does it categorically exclude initiative.

Which four risk levels does the essay compare?

In briefThe overview distinguishes unacceptable, high, limited and minimal risk. It associates them with prohibitions, stricter requirements, transparency duties and few additional conditions respectively; concrete legal application goes beyond this simplified overview.

On this definitional basis, the regulation sorts AI into risk classes.

Unacceptable risk (Article 5): prohibitions effective since February 2025 cover specified manipulative practices, social scoring, untargeted collection of facial images and certain biometric uses. Each has conditions and sometimes exceptions. Social scoring is not restricted to public authorities. The real-time remote identification provision concerns law enforcement in publicly accessible spaces. The Commission lists an additional prohibition concerning certain non-consensual sexual AI content from December 2026.

Class 2: High risk (Article 6, Annexes I and III). Strictly regulated, but permitted. Certain AI uses in medical devices, employment decisions, creditworthiness assessments, critical infrastructure, law enforcement, justice and education may fall into this category. Classification depends on the specific use and the conditions in Article 6, including its exceptions. Obligations differ by role and include requirements for risk management, documentation, human oversight and record-keeping. Conformity assessment and CE marking are addressed in particular in Articles 43 and 48.

Transparency obligations (Article 50): depending on role and use, people must be informed about AI interaction or certain biometric applications. Other duties concern identifying synthetic content and disclosing certain deepfakes. Their conditions and exceptions go beyond a general test of whether confusion is possible.

Minimal risk: typical spam filters or game AI do not attract the special high-risk requirements. Other applicable rules may still matter. These four levels are a simplified guide, not a complete legal assessment.

The regulation takes a product-based approach as its foundation. Anyone regulating products regulates market access. What is not allowed into the market does not enter it. What is allowed in comes with obligations. Anyone who fails to fulfil them pays. Up to 7 percent of worldwide annual turnover for prohibited practices.

Which questions of interpretation remain open in my reading?

In briefI see room for interpretation in several central terms that will be made more concrete through case law, standards and administrative practice. The section therefore asks about the distance between the regulation’s text and its application.

Several terms and conditions, including some defined in the law, require interpretation in context.

• Article 5(1)(a) links certain manipulative or deceptive techniques to material distortion of behaviour and significant harm. Applying these conditions requires contextual judgment.
• Article 5(1)(c) concerns specified detrimental treatment resulting from social scoring, including treatment that is unjustified or disproportionate.
• Article 6(3) sets conditions under which certain Annex III uses are not high-risk. Whether a system materially influences decisions forms part of that assessment.
• Reasonably foreseeable misuse is defined in Article 3(13) and matters for risk management under Article 9. Foreseeability still requires assessment in context.
• Substantial modification is defined in Article 3(23), including changes not foreseen in the initial assessment that affect compliance or change the intended purpose. It is a qualitative definition, not a fixed percentage threshold.

My criticism concerns the work needed to make these provisions concrete: those with the resources to interpret them can plan sooner.

I expect further clarification to come from the case law of the Court of Justice of the European Union. From national courts. From harmonized standards developed by CEN-CENELEC JTC 21, which have been under negotiation since 2021 and are still not all in place in 2026. From administrative practice. From associations writing position papers.

What question of power do I see in the GPAI Code of Practice?

In briefI criticize the greater resources large providers have to participate in making rules concrete. From this I ask how far they help shape the playing field on which they will later be assessed.

GPAI models have their own rules. Under Article 51, more than 10^25 FLOPs of cumulative training compute creates a presumption of high-impact capabilities, a criterion for classification as a GPAI model with systemic risk. Other criteria and a procedure also apply; model names alone do not establish that status.

Models with systemic risk attract additional duties. Baseline obligations for GPAI providers and possible exemptions are addressed separately.

The voluntary GPAI Code of Practice was published on 10 July 2025. Adhering to it helps providers demonstrate compliance. Signing alone does not establish compliance or remove regulatory oversight.

Transparency and Copyright address baseline GPAI obligations; Safety and Security concerns models with systemic risk. The Commission maintains an updated list of signatories.

Independent experts developed the code through a multi-stakeholder process. My concern is therefore about unequal capacity to participate: time, money and staff can limit smaller actors’ influence even when they are not formally excluded.

I see a risk of regulatory capture here. That is my interpretation of the balance of power, not a finding established by the act of signing.

Why do I treat compliance as a fixed-cost problem?

In briefDocumentation, risk management, monitoring and legal work require resources before they generate revenue. My criticism is that small businesses have far fewer resources with which to carry that burden.

AI governance can require expertise in compliance, product ownership, data science and law. The necessary organisation depends on the system and the actor’s responsibilities.

The obligations are not identical everywhere. My question is how manageable the fixed costs are for those who face them.

A large company can spread expertise across many projects; a small business has fewer resources. The AI Act does provide support and simplifications for SMEs and, since the 2026 amendment, partly also for small mid-cap enterprises. Article 11(1) provides for simplified technical documentation for both groups. Under Article 99(6), fines for SMEs are subject to the lower applicable ceiling; under Article 99(6a), the same applies to small mid-caps for infringements under paragraphs 4 and 5. My criticism concerns the remaining costs of documentation, risk management and ongoing monitoring.

Article 4 requires providers and deployers to take measures supporting AI literacy among their staff and others acting on their behalf. Knowledge, experience, education and training, the context of use and the people affected by the systems all matter. Since the 2026 amendment, they do not have to guarantee a specific level of AI literacy for any individual. There is no single curriculum for everyone. My practical question is how organisations can keep pace with changing systems.

An obligation in the text. A promise in enforcement.

What are the two classes described in the essay?

In briefI contrast actors who can fund compliance as a competitive advantage with those for whom the same task becomes a question of survival. I see this as a limit on AI’s democratizing potential.

AI is a democratizing technology. With LLMs and tools, individual citizens or tiny teams can reach a scale that once required corporations. My concern is that substantial upfront costs can limit this democratising potential. Some compliance costs arise before a small company wins its first customer. A business that can spread those costs across many products and a large revenue base has more room to manoeuvre.

The first class can pay for an AI governance team and turn compliance into a competitive advantage. The second class has to fund the initial work out of its own pocket. I am thinking above all of smaller providers of high-risk systems who must organise documentation, risk management and conformity assessment without an in-house legal department. For them, market access can become a question of survival.

The technology survives the EU AI Act. My concern is for these small providers: the work they must fund before entering the market can kill the idea.

At the same time, parts of the AI market are consolidating. Cohere and Aleph Alpha announced a planned combination in April 2026. Update of 11 October 2026: on 16 September 2026, the two companies signed a definitive agreement to combine. According to Cohere, completion remains subject to regulatory approvals and is expected later in 2026.

What could this cost structure mean for smaller businesses?

In briefI worry that high fixed entry costs protect existing market positions and slow new ideas. The section therefore extends the critique beyond the AI Act to the conditions under which innovation can emerge.

Anyone who understands the mechanism of the AI Act sees it beyond AI regulation too. Germany’s Federal Chancellor regularly asks why the German economy is not growing. Why people supposedly no longer want to work. Part of the answer lies in the same logic the EU AI Act makes visible. Anyone who regulates innovation before it emerges protects what already exists, not what is new. Anyone who places a block of fixed compliance costs in front of every market entry has already decided who can reach the market at all.

Where does that leave the Mittelstand, Germany’s small and mid-sized companies, when the obligations scale as if for corporations but the shoulders do not?

My concern extends beyond this one law: Europe needs conditions in which new digital businesses can grow. Market concentration cannot, however, be attributed to the AI Act alone. Access to capital, infrastructure and market scale also matter.

What imbalance do I criticize in the conclusion?

In briefI question the differing room for action of private and state actors and the long-term consequences of surveillance infrastructure. My concluding thesis is that regulation should also be judged by the power structures it reinforces.

The exceptions deserve close reading. Article 2(3) concerns systems insofar as they are used exclusively for military, defence or national security purposes. Law-enforcement exceptions in Article 50 have conditions, notably authorisation by law. Under Article 99(8), member states determine whether and to what extent public bodies may face administrative fines. I question these differences; they are not a blanket exemption for all state use of AI.

Those who write the rules soften their application to themselves.

One thing should be kept in mind, though: whoever builds surveillance infrastructure does not build it for their own government. They build it for every future one. The infrastructure outlives the government that built it.

That is the imbalance.

Good ideas can face an uphill struggle in Germany. In my view, policy choices can entrench existing market positions. Whether a particular rule protects or obstructs innovation must still be assessed through its actual effects.

Anyone who reads the EU AI Act and thinks only of compliance has understood one part. Anyone who reads it and thinks of playing fields has understood another.

Where have I set out this reading at greater length?

In briefThe essay refers to my paper “Der EU AI Act. Was er regelt. Was offen bleibt.” (The EU AI Act. What it regulates. What remains open.) It sets out my annotations on the regulation.

This reading became a paper: “Der EU AI Act. Was er regelt. Was offen bleibt.” Six chapters, 27 pages in German, with my annotations.

Sources, image credits and method

Case law

• Consumer Advice Centre NRW: OLG Hamm, 12 May 2026, I-4 UKl 3/25. Claimant’s report, with the judgment linked.
• North Rhine-Westphalia judiciary press release of 12 May 2026, including leave to appeal.

Regulation text and Code of Practice

• Regulation (EU) 2024/1689 (AI Act), original text: EUR-Lex 32024R1689. Accessible reading version by the Future of Life Institute: artificialintelligenceact.eu.
• Regulation (EU) 2026/1744, Digital Omnibus on AI. Consolidated AI Act as of 27 July 2026 on EUR-Lex. Article 4 and Article 113 are also available in the European Commission’s AI Act Service Desk. The simplifications for small mid-caps in Article 11(1) are set out in Article 1 of Regulation (EU) 2026/1744.
• European Commission: GPAI Code of Practice, process, chapters and signatories.
• AI Act Article 2 (scope, exemption for military, defence and national security): Article 2 in the AI Act Service Desk
• AI Act Article 50 (transparency obligations, exemption for law enforcement in paragraphs 1, 2 and 4): Article 50 in the AI Act Service Desk
• AI Act Article 99 (penalties, fines against public authorities under paragraph 8): Article 99 in the AI Act Service Desk
• Article 6: Classification of high-risk systems; Article 43: Conformity assessment; Article 48: CE marking.

European competition, reviewed on 11 October 2026

• Cohere and Aleph Alpha: definitive agreement, 16 September 2026. Completion subject to regulatory approval in the announcement.

Scholarly context

• Shoshana Zuboff (2019): The Age of Surveillance Capitalism. Profile Books.
• Bruce Schneier (2015): Data and Goliath. W.W. Norton.

Images (header, risk-class graphic)

• Header image: concept and composition: Elfie Schürfeld-Todor. Image generation with ChatGPT based on my own brief.
• Risk-class graphic: concept and design: Elfie Schürfeld-Todor in collaboration with Claude and ChatGPT, based on Regulation (EU) 2024/1689.

Method

• This article was created in collaboration with Claude. Specifically: my own reading of the regulation, my own positions, my own arguments. In exchange with the model, wording was refined, legal clarifications checked and sources verified.

Read next: Hallucination Is Not a Bug. It Is the Price of Thinking. · The Endless Tower. Babel Stands.

Facts and sources reviewed and clarified on 15 October 2026. The conclusions, analogies and judgments in this essay are my interpretation. The original publication date is retained.