Practical insights

The EU AI Act applies from 2 August 2026 (with earlier phases). If you don’t have an AI inventory by then (use cases, data flows, owners, control level, evidence), you’re not ‘catching up’ — you’re debugging chaos. A small internal mini app makes it auditable in 14 days.

When every team tests its own AI tool, you get risk, shadow IT, and constant stops from legal/security. A small internal ‘AI intake’ app captures use‑cases, does a lightweight risk triage, assigns owners, and stores evidence — so you can pilot fast with control.

Classic Mittelstand teams lose time (and deals) because DPAs, TOMs, sub‑processor lists and security questionnaires live in email threads. In 2026, the winners treat vendor onboarding like a product flow: request → review → approve → export, with an audit trail.

The EU Data Act applies from 12 Sep 2025 — and from 12 Sep 2026 additional design obligations kick in for new connected products. A practical checklist for SMEs: data access, contracts, interfaces, cost model and governance.

Since 2025‑01‑01 e‑invoicing is mandatory for B2B in Germany (with transition rules). In 2026, the pragmatic move is: receive + validate + approve + archive — with an auditable workflow.

A practical guide: agent architectures, tool use, guardrails, evaluations, and why most agent projects fail on data ownership and monitoring.