Regulatory law
for small businesses and start-ups

Which rules apply to a product depends on the product. But the answer is rarely ‘none’. Almost all consumer products are subject to product safety rules, which involve a risk analysis, labelling and a responsible person in the EU. Specific rules that include CE marking also apply to many product groups: machinery, electrical and radio equipment, toys, medical devices and protective equipment. The Cyber Resilience Act will cover connected products and software, and the AI Act will cover AI functions. The first step is to establish which legal acts apply, which role you have (manufacturer) and what must be documented before the product is sold.

Whether you are a manufacturer, an importer or merely a distributor largely depends on what you actually do, not on the contract. The exact allocation of roles differs depending on the legal basis that applies. As a rule, the manufacturer is whoever makes a product themselves. Anyone who has a product made by a third party and then offers it under their own name or trade mark is also a manufacturer. Even a business that has goods produced in Asia and prints its logo on them can be a manufacturer. The importer is whoever places a product from a country outside the EU on the EU market for the first time. Depending on the circumstances, importers may have the same obligations as manufacturers. A distributor is anyone who merely distributes products.

A provider is anyone who develops their own AI systems or offers them under their own name. Anyone who integrates a third-party model or open-source models into their product and markets this as their own feature is generally a provider as well. A deployer, by contrast, is anyone who merely uses a ready-made system in their own business. Deployers become providers if they substantially modify a system or use it for a new purpose. This classification determines which obligations under the AI Act apply to you. For most applications, only transparency and AI literacy obligations apply. Compliance takes considerably more work in high-risk areas such as recruitment, lending or medicine.

An authority’s letter (Anhörungsschreiben) gives you the opportunity to comment on a decision by an authority. Under German law, when an authority has indications of a breach and opens administrative proceedings, you have the right to be heard as the person concerned. Importantly, you are often not obliged to comment. However, responding is often the best chance to actively shape the investigation and set out your position. Even if there have been irregularities in your business in an individual case, good written statements and the right decisions can prevent or limit formal measures. Requesting access to the file is often sensible too. It is advisable to get external help to assess the right course of action and develop a strategy.