Blog

Fear sells better than precision, so it's worth saying what the Regulation does not provide for. There is no automatic fine, no registration duty for a private company, and the high-risk regime does not apply yet.

Almost all of your AI risk enters through the vendor door. These ten questions — before signing, and at every renewal — separate serious vendors from the ones with just a pretty landing page. And an evasive answer is information too.

Admission, learning outcomes, level guidance — and exam monitoring. Point 3 of Annex III covers almost the whole student cycle, including one tool most schools don't think of as AI.

Not a year-long project, not an afternoon checklist: a well-sequenced month leaves an SME with an inventory, a classification, a policy, recorded training and its first transparency evidence. Week by week, this is what can genuinely be done.

In almost any company, the high-risk system is the one HR uses. In a recruitment agency, HR and the business are the same thing — and the people being evaluated are not its own workers, which changes who has to be informed.

2 August doesn't just activate obligations: it starts up the machinery that can ask about them. What a market surveillance action is, what documentation it will request, and why the market surveillance powers coming into play shouldn't cost you any sleep — if your file is in order.

The Article 50 transparency obligations apply from 2 August 2026. A company that already has its inventory up to date can close the gaps in little time: here's what to check — and what not to.

Annex III.5 reaches creditworthiness assessment and life and health insurance pricing. Three carve-outs in the literal wording itself — natural persons only, fraud detection expressly excluded, and life and health insurance only — leave out much of what is feared.

The text lets the deployer cross-reference the relevant sections of the DPIA, or include parts of it, in the fundamental rights assessment. Reusing is not skipping — and before you get there, it's worth checking whether the FRIA even applies to you, because its list of subjects is short.

Law firms look at Annex III.8 and see their own name in it. The literal text says something else: it covers systems used by a judicial authority. The only high risk a professional firm is likely to have sits in the software it uses to hire.