{"id":122244,"date":"2026-09-30T12:03:53","date_gmt":"2026-09-30T10:03:53","guid":{"rendered":"https:\/\/www.fup-ag.com\/blog\/why-the-eu-ai-act-could-become-a-competitive-advantage-for-german-companies\/"},"modified":"2026-09-30T12:10:57","modified_gmt":"2026-09-30T10:10:57","slug":"why-the-eu-ai-act-could-become-a-competitive-advantage-for-german-companies","status":"publish","type":"blog","link":"https:\/\/www.fup-ag.com\/en\/blog\/why-the-eu-ai-act-could-become-a-competitive-advantage-for-german-companies\/","title":{"rendered":"Why the EU AI Act Could Become a Competitive Advantage for German Companies"},"content":{"rendered":"
\"\"
Telecommunication network above Europe viewed from space with connected system for European 5g LTE mobile web, global WiFi connection, Internet of Things (IoT) technology or blockchain fintech<\/div><\/picture><\/div>

The bill isn’t coming from Brussels:<\/span>Bizarre but true\u2014Why the EU AI Act Could Become a Competitive Advantage for German Companies<\/span><\/h1>

The strongest warnings about unchecked AI are now coming from Silicon Valley, not Brussels.<\/p><\/div>\n <\/div>\n\n\n

<\/div>\n\n\n
\"\"<\/picture>
<\/div><\/div>

The EU AI Act is viewed by many German companies as a bureaucratic monster. At the same time, even the developers of AI technology are warning more loudly than ever before about the risks of AI\u2014a shift that hardly anyone has noticed and that, ironically, makes the much-maligned EU AI Act a model to follow.<\/p>

\n
\n
Dr. Tasso Enzweiler<\/a><\/div><\/div> <\/div>\n\n<\/div><\/div>
\"\"<\/picture><\/div><\/div><\/div><\/div><\/div>\n\n\n
\n
\n

The critics have changed sides<\/h2>

On September 14, security law expert Dennis-Kenji Kipker made a statement on ZDF that, not too long ago, would have been considered irresponsible alarmism\u2014and that still sounds a bit like it: \u201cWe are getting closer to an AI catastrophe.\u201d<\/p>

Whatever \u201cAI catastrophe\u201d may mean, Kipker describes this development as a house of cards that is growing ever higher and faster, posing risks to energy, infrastructure, logistics, and military systems.<\/p>

The occasion was a warning from Dario Amodei, the CEO of Anthropic: A group of AI agents could take over the internet within six to twelve months. Sam Altman has expressed a similar view. Kipker believes the specific timeframe cannot be empirically verified, but he does not dispute the general direction of the prediction.<\/p>

What\u2019s more interesting than the prediction is who\u2019s making it. For years, criticism of AI came from regulators, while enthusiasm for AI came from industry. Now it seems to be the other way around. Kipker adds a point that is rarely mentioned in the German debate: The EU was initially underestimated for its regulatory approach, but with the AI Act, it is now ahead of the U.S. and China.<\/p>

A Goal Without Boundaries<\/h2>

In July 2026, the British AI Safety Institute documented just how little it takes for AI systems to go haywire. In controlled test environments with internet access, 122 test runs were conducted across seven models. In ten cases, the agents behaved in an unauthorized manner on the real internet. Nineteen actions targeted real people and organizations: attempts to inject malicious code into an open-source project, fabricated identities, and social engineering.<\/p>

The most revealing figure in the report is zero. Not a single one of these actions had been expressly prohibited to the agents. They had a goal, but no guidelines.<\/p>

A case from the same year shows that there is another way. When the U.S. financial services provider Robinhood granted AI agents access to brokerage accounts and credit cards in May 2026, four safeguards were in place: a separate account, a fixed spending limit, a push notification for every transaction, and the ability to disconnect the agent at any time. In other words: minimal permissions, a complete audit trail, and the ability to disable the agent. One broker has understood what AI governance is. Most companies currently rolling out agents likely haven\u2019t yet.<\/p>

The bill isn’t coming from Brussels<\/h2>

At this point, you\u2019re probably expecting us to mention fines: depending on the violation, up to 15 million euros or three percent of global annual revenue. That figure appears in every presentation on the topic, and for the vast majority of companies, it remains a theoretical figure because they\u2019re unlikely to ever be affected on that scale.<\/p>

The real threat comes from elsewhere\u2014from the competition. The bill comes from your largest customer\u2019s purchasing department, in the form of a questionnaire that strictly adheres to the AI Act. One key question, in essence, is: Which AI systems do you use, and how do you ensure their compliance? At that moment, it\u2019s not the quality of your product that matters, but whether you can provide a well-founded answer.<\/p>

Three companies that have long been acting on this principle demonstrate that this is not just an empty prediction. Mastercard provides bank customers with model documentation before contracts are signed, thereby shortening sales cycles in B2B business. SAP has been certified to ISO\/IEC 42001 since September 30, 2025, and undergoes annual audits. Deutsche Telekom has integrated its AI guidelines into its Supplier Code of Conduct, thereby extending the requirement to its entire supply chain.<\/p>

The pattern is the same for all three. Governance artifacts are not cost centers, but rather selling points. The competitive advantage doesn\u2019t come from the law itself. It arises because most people still view it as a burden\u2014and haven\u2019t understood how important it is to set guidelines for AI so that it can realize its full potential. <\/strong><\/p>

The Crucial Preliminary Question<\/h2>

Anyone looking to get started immediately runs into a question that sounds trivial but, in practice, takes months to answer: What AI systems do we have, and in what capacity do we use them?<\/p>

For day-to-day purposes, a three-step approach suffices. Anyone who places an AI system on the market under their own name is a provider, subject to the full range of obligations\u2014from risk management to conformity assessment. Anyone who uses third-party systems unchanged under their own responsibility is an operator. Anyone who merely clicks on what their employer provides is not a party subject to these requirements.<\/p>

The typical counterarguments are well known. First: \u201cWe\u2019re just buying it.\u201d Purchasing makes you an operator, not a bystander. The second objection is more costly: The situation becomes critical when a company modifies the intended use of an AI system\u2014as defined by the provider\u2014in such a way that it becomes a high-risk system under Annex III. In that case, the previous operator can, for regulatory purposes, become a provider itself. No one has changed a single line of code. The only thing that has changed is the purpose.<\/p>

This preliminary question is not a legal one, but an organizational one. It takes months to resolve because no one in the company has a clear overview of the situation.<\/p>

What’s the problem?<\/h2>

So why aren’t companies already actively implementing these changes? There are three reasons for this, and none of them is technical in nature.<\/p>

First, the issue has no owner. It cuts across Legal, IT, Procurement, Human Resources, line departments, and employee representation. The most costly mistake is the compliance silo: the project gets stuck solely in the Legal Department, with no connection to day-to-day operations. The result is policies that no one follows and no one understands.<\/p>

Second, the works council is often involved too late. Section 87(1)(6) of the Works Council Act (BetrVG) is interpreted broadly when it comes to AI, and anyone who waits until the very end to address the issue of co-determination will, realistically, lose many months. Here\u2019s a detail: Since the enactment of the Works Council Modernization Act, the works council\u2019s right to an expert when AI is used\u2014pursuant to Section 80(3) of the Works Constitution Act (BetrVG)\u2014is considered mandatory. The works council no longer needs to justify this request. Anyone who goes into these negotiations ill-prepared ends up paying for the opposing side\u2019s expert with their own time.<\/p>

Third, there is a lack of expertise: people who understand the legal and technical requirements and recognize that this is a management and project management task.<\/p>

What Needs to Happen in the First Few Weeks<\/h2>

I use a four-step process, which I’ve deliberately kept simple:<\/p>