How it works in a data room
The AI Act entered into force in August 2024 and applies in phases. Some practices are banned outright, high-risk uses such as certain employment or credit decisions carry heavy duties, general-purpose AI models have their own rules, and many other systems face mainly transparency obligations. AI features in a data room, such as summaries, search or Q&A drafting, generally fall outside the high-risk category, but the provider still has duties as a supplier and customers have duties as deployers, including staff AI literacy. Some later deadlines have been the subject of EU simplification proposals, so confirm current dates with counsel.
Why it matters in a deal
The Act matters twice in a transaction. First, when choosing a data room, buyers and sellers should ask providers how their AI features are classified and documented. Second, targets that build or use AI may carry obligations, and AI due diligence should map them. Non-compliance can lead to significant fines, and some uses may have to stop. This is general information, not legal advice.
Example
A US buyer looking at a German HR software company learns that the target’s candidate ranking tool likely counts as high-risk under the Act. Diligence focuses on the target’s risk management, documentation and human oversight plans. The buyer budgets for compliance work and adds specific warranties. The Germany guide covers local context.