Navigating AI Compliance
for Teams That Want to Ship

Every company I talk to in Germany has the same ghost in the building. Someone has an idea. Someone else says no. Nobody can quite produce the rule that says no.

I have been on the wrong end of this more times than I can count, and I have never got used to it:

Alexa's answer is more generous than my question deserved, and it is the reason this article exists. The people saying no are not villains. They are doing precisely the job they were trained for.

Read that carefully, because it changes what you do next. If the person blocking you is trained to imagine failure, then arriving with more enthusiasm is the worst possible move. You are bringing optimism to a risk assessment.

What actually moves them is the thing almost nobody brings: an accurate reading of what the law says.

The EU AI Act is new, which is exactly why it functions so well as a blanket no — nobody in the room has read it, so nobody in the room can contradict the most cautious person present.

Here is what it actually asks you to do first.

The high-risk category is real, and it is narrow on purpose. Her examples: a health insurance claim processed 100% automatically. A credit decision where an agent alone decides whether you get the money. Those sit under heavy regulation, and Alexa's view is that they should.

Then comes the sentence that most projects never hear.

I wanted to test this against something I had built myself, because abstract reassurance is worth nothing in a meeting. I made an HR funnel tool with candidate scoring, and had long arguments with Claude about where it landed. The answer I got was about where the human sits.

No human in the loop on who gets hired, and you are squarely in the high-risk category. But:

Roughly, she said. With the caveat that it always depends — she has worked with lawyers long enough that she can produce that answer on reflex.

But notice what just happened. The risk level was not a property of the technology. It was a property of how the workflow is designed. The same model, doing the same scoring, is high risk or low risk depending on whether a person is still making the call.

Which means most of the time you are not asking permission. You are choosing a design.

We went through all of this once before, with GDPR. I got exactly one genuinely useful frame out of that entire era, and it came from lawyers in the middle of a big case.

That question does something the other question cannot. "Are we allowed?" hands the decision to whoever is most afraid. "Is this a manageable risk?" hands it back to the person who owns the outcome.

Alexa agreed, and put it in the language of the Act itself:

This is the single most portable thing in the episode. It converts a gate into a dial. There is no version of this conversation where the answer is a locked door — there is only a question of how much management sits behind the thing you want to do.

Walk into the next meeting with the dial, not the door.

So you have classified honestly and you are in the ordinary category with almost everyone else. I asked the obvious follow-up: what does the Act actually demand of us then?

Her answer is the part of this conversation I have not been able to put down.

Sit with that for a second, because it inverts the whole argument.

The regulation that gets quoted as the reason to stay away from AI opens by requiring that your people learn to use AI. It is not a permission you have to win. It is an obligation you are already behind on.

And because the law never specified what that training should contain, a market appeared to fill the gap. Alexa was blunt about the result — "kind of boring":

A legal obligation to make people AI-literate, discharged by sitting them in a room and explaining risk tiers. Everybody complies. Nobody can do anything on Monday.

Then I asked about documentation, expecting the GDPR nightmare — the registers, the records, the consultants. Here is the entire requirement, in her words:

Two names, a date, a topic. If an audit ever comes, you have evidence that the people using AI in your company were trained, and what they were trained on.

That is the paperwork. Four lines in a text file.

Put the two halves next to each other and the arithmetic stops being close.

On one side: classify the use case, keep a human where the decision matters, write four lines down. On the other side: the months and years a company spends not building, because the most cautious sentence in the room went unchallenged.

Alexa knows the price of that delay from the inside, because she paid it herself. She had the computer science degree the whole time. What she did not have was the belief that the building part was hers to do.

The magical technical co-founder is the same character as the regulation nobody can produce. Both are stand-ins for permission. Both are somebody else's signature you have decided you need before you are allowed to start. Neither is coming.

What replaced it for her was not a qualification. It was somebody standing next to her while the agent misbehaved:

And the cost is not evenly distributed. Late in the conversation she raised something she had clearly been carrying, and she used a specific word for it.

Falling behind is what the "no" buys you. Not a fine, not a breach, not a headline — just a slow, compounding distance between the people who started and the people who waited to be told they could.

The risk you were avoiding was manageable. The cost of avoiding it wasn't.

Here is where the two halves of this argument finally close on each other. The Act wants your people AI-literate. The literacy trainings that grew up to serve it mostly teach risk tiers. Alexa's version of what literacy actually is has nothing to do with a classroom.

Which means the building is not a detour from the compliance work. The building is the compliance work, and it is the only version of it that leaves your team able to do something afterwards.

I asked her for the concrete steps. She gave three.

Pay the twenty euros. Build a website you actually want. That is the entire on-ramp, and if it sounds too small to count as corporate AI literacy, that is the point — it produces people who have done the thing, which no slide deck about risk tiers has ever managed.

If you want the version that scales past one person, her other recommendation is the one I'd push hardest on inside a company:

A folder of plain text your agent can read. It is how we run our own company brain, it is where project rules live, and — usefully for this argument — it is also exactly where four lines saying who was trained, when, and on what would go.

The same markdown file that makes your agent useful is the file that makes you audit-ready.

The whole argument, compressed:

Classify the use case honestly, and accept that high risk is narrower than the room believes. Keep a human where the decision matters, and watch the risk level move. Ask is this a manageable risk? instead of are we allowed?, so the call lands with the person who owns the outcome. Write down who was trained and on what. Then get your people onto the keyboard, because that is the requirement the law actually leads with.

None of that is a fight with your compliance team. It is the conversation they were trained to have, held with someone who has read the thing — which is the dialogue Alexa argued for from her very first answer.

If you want the safety side done properly while you move, Safety First and Zero Trust in the Pirate Codex are the two chapters that keep "we moved fast" from turning into the incident that proves the naysayers right. And if the keyboard part is the bit that feels out of reach, the three levels of AI engagement is the shortest route from chat to actually building.

Alexa is at Vibe Coding Cologne on 2 September with the laptop open — a live look at REGULIGHT and how it got built, not slides about it. She came to these as an attendee. That is usually how this starts.

Nobody is going to hand you the permission slip. It turns out it was already in the regulation.