Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
Keeping ten years of documentation you don't generate
Article 18 requires five documents to be kept for ten years from the moment the system is placed on the market. All five are produced or received by the provider, and the clock starts from an event the deploying company had no part in.
What a system cannot do for you, and what it can: where the line is
A system holds the record, the relationships between decisions, and detection of what has expired. It does not hold the decision or the accountability. The line is sharp, and it's worth knowing where it falls before you buy anything.
The Article 17 quality management system isn't yours to set up
Article 17 requires a documented quality management system for high-risk AI systems. It applies to providers, and its content is about product design and development — nothing a deploying company can put in place.
You change what a system is for: what stops being true in everything you had already documented?
The obligations in Article 26 are chained together. Classification decides who oversees, which decides which records matter, which decides who must be informed. Change the first link and half the chain lapses — with nothing to flag it.
The EUR 35 million fines — and the paragraph almost nobody quotes
The EUR 35 million headline belongs to the prohibited practices of Art.5. For SMEs, Art.99(6) caps every fine at the lower of the two magnitudes, not the higher. And most AI uses in a mid-sized company never reach that bracket.
The eight original prohibited practices in Article 5: which ones can touch an ordinary company
Saying none of them applies to you is as false as saying all of them do. Three of the original eight have scenarios a private company can reach without meaning to — and one usually assumed dangerous isn't, once you read its literal wording.
The 'you're talking to an AI' notice is the provider's job, not yours
Article 50(1) requires informing people that they are interacting with an AI system. The subject is the provider, and the obligation is met at the design stage. Deployers have duties under the same article, but in other paragraphs.
A classification made in June cites a calendar that no longer exists
The Digital Omnibus rewrote articles and moved dates in the AI Act. Decisions made before that stayed on file exactly as they were, because a record keeps the conclusion, not the text it was based on.
AI in B2B and food distribution: your operations aren't high-risk; your HR might be
Demand forecasting, routes, pricing, CRM: the technological core of a distributor is minimal risk under the AI Act. High risk enters through another door — human resources — and knowing how to tell them apart avoids both panic and neglect.
Marking synthetic content: whose obligation it is, and how far the transitional period reaches
Article 50(2) requires AI-generated content to be marked in a machine-readable format. The obligation belongs to the provider, not to whoever uses the tool, and the transitional period until December 2026 only covers what was already on the market.