What is the best EU AI Act solution for mid-sized companies?

As of October 22, 2026. Legal basis: Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since July 27, 2026). Vendor statements checked on the vendors' public websites on October 21, 2026.

Key takeaways

• Most mid-sized companies are deployers under the EU AI Act, not providers: they use AI, such as Microsoft 365 Copilot or AI features in HR and ERP software, without placing it on the market under their own name.
• Two obligations already apply to every deployer: measures to support the AI literacy of staff (Art. 4, since February 2, 2025) and the transparency obligations in Art. 50 (since August 2, 2026).
• The deployer obligations for high-risk AI in Art. 26, for example when AI screens job applicants or evaluates performance, apply from December 2, 2027.
• The Digital Omnibus relief for SMEs and small mid-caps mainly concerns provider obligations and fine caps. The deployer obligations in Art. 26 apply regardless of company size.
• The law does not require an AI officer, and no certificate for EU AI Act compliance exists.

The right EU AI Act solution for a mid-sized company depends on three questions. Does the company only use AI, or does it also build AI into its own products? Does it use AI in high-risk areas such as recruiting, HR decisions, or safety components? And does it already run a management system under ISO 27001 or NIS2 that AI governance can build on? A company that only uses standard tools like Copilot usually needs no dedicated tool, just an AI inventory, a usage policy, and training. A company that uses AI in HR processes, or already manages ISO 27001, NIS2, and the GDPR, is well served by a compliance platform with experts, as offered by DataGuard, heyData, Kertos, and Proliance. A company that builds AI into its own products is better served by a specialized AI governance platform such as Credo AI, Holistic AI, Modulos, or trail.

In Germany, these companies are often called the Mittelstand: owner-managed firms, frequently in manufacturing, with a few hundred employees.

What does the EU AI Act require from mid-sized companies?

The obligations depend on the role. Under Art. 3(4), a deployer is any company that uses an AI system under its own authority in a professional context. Under Art. 3(3), a provider develops an AI system, or has it developed, and places it on the market under its own name, even when it runs on a third-party model.

Under Art. 99(4), breaches of Art. 26 or Art. 50 can lead to fines of up to EUR 15 million or 3 % of worldwide annual turnover; for SMEs and small mid-caps, the lower of the two applies. Art. 4 is not on the list of fineable provisions in Art. 99. Each member state designates its own market surveillance authorities. In Germany, the Bundesnetzagentur has held that role since July 29, 2026, unless a sector authority such as BaFin is responsible, and its AI Service Desk offers small and medium-sized companies a free first assessment. The overview of the EU AI Act explains the regulation itself.

Which AI systems does a typical mid-sized company use, and which are high-risk?

In mid-sized companies, AI usually arrives through standard software, not through in-house models. The intended purpose decides whether a use is high-risk, not the tool, and Annex III defines the areas.

Example: A machine builder with 300 employees uses Microsoft 365 Copilot, AI-supported applicant management, and camera systems for quality inspection, and its machines include an AI-based wear forecast. For Copilot and quality inspection, it needs an AI inventory, a usage policy, and AI literacy measures. Applicant management is high-risk: from December 2, 2027, the company must assign oversight to a competent person, keep logs for at least six months, inform the works council and staff in advance, and tell applicants that AI is involved. National labor law can require earlier consultation; in Germany, § 90 of the Works Constitution Act obliges the employer to inform the works council when it plans to use AI. For the wear forecast, the company is a provider, but as long as the feature has no safety function, it is not a high-risk system. With turnover of up to EUR 150 million, the company usually counts as a small mid-cap with a lower fine cap.

For Microsoft 365 Copilot, a deployer checks three points that Microsoft itself describes (Microsoft Learn, last updated August 18, 2026). First, Microsoft classifies Copilot as an EU Data Boundary service for EU customers; models provided by Anthropic are excluded and disabled by default in the EU. Second, according to Microsoft, web search through Bing, which is on unless an admin turns it off, is covered by the Microsoft Services Agreement, not by the Data Protection Addendum. Third, Copilot only surfaces data the user can already view, so overly broad permissions in SharePoint or Teams become visible. Whether Copilot requires a data protection impact assessment under the GDPR depends on the data it processes.

Which solution fits which mid-sized company?

The vendors named are examples of each model, not a recommendation for your specific case. For a comparison of tool categories across all company sizes, see EU AI Act compliance tools.

The platforms with experts differ most on AI literacy. heyData's website lists a 45-minute online course with a certificate of completion for all employees, and Proliance lists two course formats with a knowledge test and certificate. heyData states "Hosted in Germany." Among the AI governance platforms, Modulos names Zurich as its headquarters, trail states that it is now part of Collibra and hosts in Europe, and Holistic AI hosts customer data in the UK by default. For certifying an AI management system, the page on ISO 42001 software compares vendors.

Whether ISO 42001 pays off for a deployer depends on how widely it uses AI. Miriam Mindt, Information Security Expert at Kertos, writes that a company using only a single tool internally usually needs no certificate and that legal compliance is sufficient in that case.

Who owns AI governance in a mid-sized company?

The EU AI Act does not require an AI officer. The European Commission states that "no specific governance structure is mandated" for Art. 4 (AI literacy Q&A), and Germany's Bundesnetzagentur explicitly lists an AI officer as not required. The only binding requirement is that, for high-risk AI, oversight sits with people who have the necessary competence, training, and authority under Art. 26(2).

In practice, mid-sized companies usually give AI governance to the information security officer, the data protection officer, or the head of IT. Pairing it with the information security officer makes sense because the AI inventory, risk assessment, and supplier management connect to the ISMS. If the data protection officer takes it on, check whether deciding on AI use creates a conflict of interest under Art. 38(6) GDPR. Miriam Mindt points out that clauses 4 to 10 of ISO 27001 and ISO 42001 share the same harmonized structure, so a company can carry over almost the entire framework of its existing management system. The Commission notes that organizations can keep an internal record of training; there is no need for a certificate. For a step-by-step plan, see EU AI Act compliance: how to prepare your business.

When is Kertos the right choice for mid-sized companies, and when is it not?

Kertos fits mid-sized companies that want to run AI governance in the same system as ISO 27001, NIS2, and the GDPR rather than as a separate project.

• Model: Platform plus in-house certified experts.
• AI governance: AI inventory, AI risk assessment, and AI management system (AIMS); ISO 42001 and the EU AI Act in the same system as ISO 27001, NIS2, and the GDPR.
• AI literacy: AI training with videos and quizzes, with completion tracked per person.
• AI agent Kaia: accesses your compliance information, answers questions, and drafts documents; assessment and audit support come from the experts.
• Headquarters and hosting: Munich; developed and hosted in Europe.

Customers achieve a 100 % audit pass rate and cut manual compliance effort by about 80 %. Kertos holds a rating of 4.8 out of 5 on G2 (as of October 2026). A demo shows how this applies to your AI use.

Kertos is not the right choice if you develop high-risk AI as a provider and need specialists for conformity assessment and technical documentation, or if you are looking for legal advice on AI contracts. A specialized training provider is also the better fit for an AI literacy program tailored to individual roles with your own content: the Kertos courses are standardized, and you cannot currently upload your own material.

The pages on NIS2 software for mid-sized companies and ISO 27001 software for mid-sized companies cover the other two core topics.

FAQ: the EU AI Act for mid-sized companies

Do we need an AI officer?

No. The EU AI Act does not require an AI officer, and the European Commission confirms that no specific governance structure is mandated for the AI literacy obligation in Art. 4. A clearly assigned owner still helps; in mid-sized companies, that is usually the information security officer, the data protection officer, or the head of IT. From December 2, 2027, oversight of high-risk AI must sit with people who have the necessary competence, training, and authority (Art. 26(2)).

Is Microsoft 365 Copilot a high-risk AI system?

Not for general office work. The intended purpose under Annex III decides whether an AI system is high-risk, and drafting text, summarizing email, or research are not on that list. If a company uses Copilot specifically to evaluate job applications or assess employee performance, that use falls under Annex III, point 4. Either way, the AI literacy obligation in Art. 4 and the GDPR apply to Copilot.

When do the obligations for deployers of high-risk AI apply?

From December 2, 2027 for high-risk systems under Annex III, such as recruiting tools, and from August 2, 2028 for high-risk AI in products under Annex I. The original date was August 2, 2026; the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the deadlines. The AI literacy obligation has applied since February 2, 2025, and the transparency obligations in Art. 50 since August 2, 2026.