If your company uses AI and has been told it faces an immediate fine, this is for you. This article exists to balance the others in its block. What follows deals with what the Regulation does not provide for, because in this field more fear than precision is in circulation, and fear sells better.
Nothing here says there is nothing to do. It says which specific things are not going to happen, and why.
There is no penalty for not having an inventory
Let's start with the most repeated one. The AI Act does not require keeping an inventory of AI systems — the word doesn't appear once in the Regulation — so its absence can hardly be penalised.
What does happen is subtler and less marketable: without an inventory you cannot meet the obligations that do exist, because all of them are written against specific systems. Not having an inventory is not an infringement. It is what makes it impossible to show that there isn't one.
No database registration for a private company
The EU database of Art. 71 exists, and Art. 49 imposes registrations. But it only reaches a deployer that is one of the “public authorities, Union institutions, bodies, offices or agencies or persons acting on their behalf”, and only for Annex III high-risk systems other than those in point 2.
A private company deploying high-risk systems has no duty to register itself, unless it acts on behalf of a public authority or a Union institution, body, office or agency. The one who registers the system is the provider or, where applicable, its authorised representative, and the one who registers its use is the public sector or whoever acts on its behalf.
The fine is not automatically set at the top bracket
The brackets exist and they are high. But the article that sets them deserves a full read: for SMEs, Art. 99(6) caps every fine at the lower magnitude of the two that would otherwise apply.
With two clarifications that that article develops and are only recalled here: the rule says “up to” — a ceiling, not an amount fixed in advance, and Art. 99(7) requires all the relevant circumstances of the specific situation to be taken into account in each individual case; and the top bracket, that of Art. 99(3), belongs to the prohibited practices of Art. 5, not to a company's ordinary use of AI.
The high-risk regime does not apply yet
This is the one most used as an urgency argument, and it is easy to check: the obligations in Chapter III, Sections 1 to 3, start applying on 2 December 2027 for Annex III high-risk systems and on 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as amended by Regulation (EU) 2026/1744). The date still circulating in some guides — August 2026 — is not the applicable one.
Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products.
So before those dates no infringement of Art. 26 is possible for anyone. Whoever claims otherwise is using a deadline that is not in the law.
And what does happen, so the conclusion doesn't come out crooked
Three things, and all three have been enforceable for a while.
Art. 4 and Art. 5 have applied since 2 February 2025, except the new prohibitions in points (ba) and (bb) of Article 5(1), which apply from 2 December 2026. Measures to support the AI literacy of staff and of those using the systems on the organisation's behalf — in the wording the Digital Omnibus gave it, which softened the duty without removing it — and a prohibition of certain practices, with the exceptions Article 5 itself provides but no exception by size or sector.
The GDPR has been applying for years, and it waits for the AI Act for nothing. Where an AI use processes personal data, there you have legal basis, information to data subjects, impact assessments where they apply, and rights to honour. Some of what gets presented as "AI Act work" may actually be data protection work that was already due.
And Art. 50 transparency applies from 2 August 2026: the notice that a person is interacting with an AI and the marking of synthetic content fall on the provider, with a transitional period until 2 December 2026 for the marking of systems placed on the market before 2 August 2026 (Article 111(4)); informing people about emotion recognition or biometric categorisation, and disclosing deep fakes and text published to inform the public on matters of public interest, fall on the deployer.
Why this matters more than the fear
Because an organisation acting out of fear does whatever it is told, in the order it is told — and what it usually does first is the most expensive and the least enforceable.
The order that comes out of reading the dates is the reverse: first what already binds any organisation that uses AI and costs little; then, calmly, what will bind a few from 2 December 2027 or 2 August 2028. In between, the single task that decides which of the two groups you are in.
None of that needs an invented urgency. And whoever puts one in front of you is telling you, without meaning to, that they haven't read the article that disproves it.
Content under Articles 2, 4, 5, 26, 49, 50, 71, 99, 111 and 113 and Annexes I and III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (OJEU of 24 July 2026).
This article is for informational purposes only and does not constitute legal advice.