Regulation \u00b7 14 August 2026<\/p>\n
On 2 August 2026, part of the AI Act entered into application. It is not \u201cthe whole AI Act\u201d. High-risk systems under Annex III are postponed to 2 December 2027. Embedded systems under Annex I are postponed to 2 August 2028, via the Digital Omnibus (Regulation EU 2026\/1744, in force since 27 July 2026). A VSE or SME that reads alarmist headlines has an interest in separating what is already due from what is not. Panicking over a conformity assessment file whose deadline is 2027, while forgetting the chatbot disclosure, is the wrong trade-off.<\/p>\n
Three layers now coexist.<\/p>\n
Already applicable, and for longer than is often said: prohibited practices, with fines of up to \u20ac35 million or 7% of worldwide turnover. Also already applicable since 2 February 2025: Article 4 on AI literacy, for providers and for deployers.<\/p>\n
Applicable since 2 August 2026: Article 50 transparency (information on interactions with AI, machine-readable marking of synthetic content, visible labelling of professional deepfakes, a mention on certain texts of public interest). Systems already on the market before that date have until 2 December 2026 for the machine-readable marking under Article 50(2). The AI Office may investigate providers of general-purpose models since 2 August 2026. Failures on the transparency strand expose you to up to \u20ac15 million or 3% of worldwide turnover.<\/p>\n
Not yet applicable: the full regime for Annex III high-risk systems (2 December 2027) and Annex I embedded systems (2 August 2028). That postponement is what many comments too quickly summarised as \u201cthe AI Act is delayed\u201d. No. One part is in force. Another is shifted.<\/p>\n
Most of the agents we see in VSEs and SMEs (appointment booking, FAQ, quote follow-up, hotel reception, site tracking) are not, by that fact alone, high-risk systems within the meaning of Annex III. For as long as the postponement holds, you do not have to produce the assessment file, formalised risk management in the high-risk format, or the post-market monitoring duties of that regime.<\/p>\n
That does not mean your use is \u201coutside the AI Act\u201d. You remain a deployer. You remain subject to Article 50 if a human talks to the system. You remain subject to Article 4 if your teams deploy AI without a minimum of competence. You remain subject to the GDPR as soon as personal data transits.<\/p>\n
Also beware of an overly optimistic self-diagnosis. A tool that steers recruitment, scores candidates, assists a medical diagnosis or weighs on access to an essential service may fall into high-risk when the time comes. The postponement gives time to prepare. It does not turn a sensitive use into a trivial one.<\/p>\n
The first mistake is panic: freeze every AI project until 2027, or buy a \u201chigh-risk compliance pack\u201d for an FAQ chatbot. You spend, you think you are covered, and you still have not told the user they are talking to a machine.<\/p>\n
The second is denial: \u201cthis is only for the big platforms\u201d. The deployer of an SME is named in the text. Fine caps are also calculated as a percentage of worldwide turnover. For a group, the percentage weighs. For a VSE, reputational and contractual risk often weighs faster than the theoretical cap.<\/p>\n
Patrick Dajan Mouelle, director of Cybernecs, insists on this order of battle: first the inventory and the disclosure, then access security, then only the heavy files if a use truly approaches high-risk. The reverse order produces binders and opaque agents.<\/p>\n