{"id":9058,"date":"2026-05-28T17:09:30","date_gmt":"2026-05-28T15:09:30","guid":{"rendered":"https:\/\/nextra-consulting.com\/sustainability-x-ai-talk-ai-act\/"},"modified":"2026-06-09T15:21:04","modified_gmt":"2026-06-09T13:21:04","slug":"sustainability-x-ai-talk-ai-act","status":"publish","type":"post","link":"https:\/\/nextra-consulting.com\/en\/sustainability-x-ai-talk-ai-act\/","title":{"rendered":"AI? Yes, but… what about the AI Act?"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

AI regulation is not just an IT issue\u2014sustainability departments are also affected by the EU AI Act<\/strong>. In this talk from the “Sustainability x AI” series<\/strong>, Janika Ofterdinger (Nextra Consulting GmbH) and Bengt Petersen (Partner and Lawyer, Front Wing Litigation) discuss what the AI Act specifically means, which misconceptions frequently arise in practice, and how companies can take a structured approach. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
What the AI Act regulates\u2014and why it also affects non-tech companies<\/span><\/h6>\n

The EU AI Act is the world’s first comprehensive AI regulation and applies directly as an EU regulation in all member states without national implementation. Unlike the GDPR, which regulates the handling of personal data, the AI Act focuses on the AI system itself: which system may be used for what purpose and under what conditions. Obligations apply not only to developers of AI models but also to operators\u2014meaning companies and, in some cases, even individual employees who use AI applications in a professional context. <\/p>\n

Four risk classes\u2014and where sustainability teams should pay attention: Typical misconceptions in practice<\/span><\/h6>\n

The AI Act follows a risk-based approach with four categories: prohibited applications, high-risk AI, limited-risk AI, and minimal risk. For sustainability teams, two areas are particularly relevant: the use of AI in an HR context\u2014such as automated applicant screening or performance appraisal\u2014falls into the high-risk category. AI-supported creditworthiness assessments based on ESG criteria could also fall under this, as the corresponding annex of the AI Act is not limited to natural persons. Furthermore, a transparency obligation applies to chatbots in a stakeholder context: it must be clearly recognizable that no natural person is responding. <\/p>\n

Typical misconceptions in practice<\/span><\/h6>\n

A common misconception is the assumption that only specifically procured AI systems fall under the AI Act. In fact, common Large Language Models such as ChatGPT, Copilot, or Claude can also be classified as high-risk AI depending on the use case. Another risk is so-called shadow AI: if employees use AI applications without the knowledge of company management, they can become operators of high-risk AI themselves\u2014with corresponding obligations and risks of fines. One should not blindly rely on provider assurances regarding AI Act compliance. <\/p>\n

Timeline and concrete preparation<\/span><\/h6>\n

The AI Act has been in force since mid-2024; the obligation for AI literacy has already applied since February 2025 and affects every company that uses AI. The extensive obligations for high-risk AI (Annex 3) have been postponed to December 2027. Bengt Petersen recommends starting now with an AI inventory: which applications are in use, and which risk class do they fall into? Compliance structures should be linked with existing data protection processes to avoid duplication of work. New AI applications should be categorized into this system from the start, and provider contracts should be checked for operator obligations. <\/p>\n

<\/p>\n

What you will learn in this talk<\/span><\/h6>\n