Blog
Regulatory analysis of the AI Act and the GDPR for SMEs
You change what a system is for: what stops being true in everything you had already documented?
The obligations in Article 26 are chained together. Classification decides who oversees, which decides which records matter, which decides who must be informed. Change the first link and half the chain lapses — with nothing to flag it.
The EUR 35 million fines — and the paragraph almost nobody quotes
The EUR 35 million headline belongs to the prohibited practices of Art.5. For SMEs, Art.99(6) caps every fine at the lower of the two magnitudes, not the higher. And most AI uses in a mid-sized company never reach that bracket.
The eight original prohibited practices in Article 5: which ones can touch an ordinary company
Saying none of them applies to you is as false as saying all of them do. Three of the original eight have scenarios a private company can reach without meaning to — and one usually assumed dangerous isn't, once you read its literal wording.
The 'you're talking to an AI' notice is the provider's job, not yours
Article 50(1) requires informing people that they are interacting with an AI system. The subject is the provider, and the obligation is met at the design stage. Deployers have duties under the same article, but in other paragraphs.
A classification made in June cites a calendar that no longer exists
The Digital Omnibus rewrote articles and moved dates in the AI Act. Decisions made before that stayed on file exactly as they were, because a record keeps the conclusion, not the text it was based on.
AI in B2B and food distribution: your operations aren't high-risk; your HR might be
Demand forecasting, routes, pricing, CRM: the technological core of a distributor is minimal risk under the AI Act. High risk enters through another door — human resources — and knowing how to tell them apart avoids both panic and neglect.
Marking synthetic content: whose obligation it is, and how far the transitional period reaches
Article 50(2) requires AI-generated content to be marked in a machine-readable format. The obligation belongs to the provider, not to whoever uses the tool, and the transitional period until December 2026 only covers what was already on the market.
The AI Act's grace period: the article stopped stating the date
Article 111(2) sets a grace period for high-risk systems placed on the market before a given date. The Digital Omnibus rewrote the paragraph and removed the date: it now refers to Article 113, which gives two different dates depending on the annex.
Does the AI Act even apply to you? Article 2 answers before any classification
If your company is in the EU and uses AI in its operations, the answer is yes — and none of the article's exclusions change that. It's worth knowing what they are, because three of them are almost always cited wrong.
Article 50 transparency, in application since 2 August 2026
2 August 2026: the AI Act's transparency obligations move from a date on a calendar to a rule in application. What exactly changes that day, for whom — and why, for those who did their homework in July, entry into application demands nothing special.