Blog

Regulatory analysis of the AI Act and the GDPR for SMEs

The AI Act's grace period: the article stopped stating the date

Article 111(2) sets a grace period for high-risk systems placed on the market before a given date. The Digital Omnibus rewrote the paragraph and removed the date: it now refers to Article 113, which gives two different dates depending on the annex.

Does the AI Act even apply to you? Article 2 answers before any classification

If your company is in the EU and uses AI in its operations, the answer is yes — and none of the article's exclusions change that. It's worth knowing what they are, because three of them are almost always cited wrong.

Article 50 transparency, in application since 2 August 2026

2 August 2026: the AI Act's transparency obligations move from a date on a calendar to a rule in application. What exactly changes that day, for whom — and why, for those who did their homework in July, entry into application demands nothing special.

What doesn't happen if you do nothing: there is no automatic penalty for not having an inventory

Fear sells better than precision, so it's worth saying what the Regulation does not provide for. There is no automatic fine, no registration duty for a private company, and the high-risk regime does not apply yet.

How to evaluate an AI vendor: the 10 questions of a proper due diligence

Almost all of your AI risk enters through the vendor door. These ten questions — before signing, and at every renewal — separate serious vendors from the ones with just a pretty landing page. And an evasive answer is information too.

Private education: Annex III has four letters for your school, and the fourth surprises everyone

Admission, learning outcomes, level guidance — and exam monitoring. Point 3 of Annex III covers almost the whole student cycle, including one tool most schools don't think of as AI.

The first 30 days of AI governance: a realistic roadmap

Not a year-long project, not an afternoon checklist: a well-sequenced month leaves an SME with an inventory, a classification, a policy, recorded training and its first transparency evidence. Week by week, this is what can genuinely be done.

Recruitment: when HR is the business, high risk stops hiding

In almost any company, the high-risk system is the one HR uses. In a recruitment agency, HR and the business are the same thing — and the people being evaluated are not its own workers, which changes who has to be informed.

Market surveillance from 2 August: what they can ask you, and who

2 August doesn't just activate obligations: it starts up the machinery that can ask about them. What a market surveillance action is, what documentation it will request, and why the enforcement powers coming into play shouldn't cost you any sleep — if your file is in order.

Before 2 August: what to close out on AI transparency

The Article 50 transparency obligations apply from 2 August 2026. A company that already has its inventory up to date can close the gaps in little time: here's what to check — and what not to.