AI Act: why, for whom, when and how to prepare for it?
Artificial intelligence has already entered the business.
ChatGPT, Microsoft Copilot, Gemini, integrated software assistants, recruitment tools, document analysis, image generation, customer support automation... In many organisations, AI is used daily, sometimes without management or IT having a complete view of its uses.
The European Union has decided to regulate these uses with the European regulation on artificial intelligence, better known as the AI Act.
And contrary to a still widespread belief, the AI Act does not only concern companies that develop artificial intelligence models.
A company that uses AI systems can also be affected.
Since 2 August 2026, the main part of the regulation is applicable and authorities have enforcement and control powers. Some obligations have even been applicable since 2025, while provisions concerning certain high-risk systems will be gradually implemented until 2028.
For companies, the question is therefore no longer really:
"Are we affected by the AI Act?"
But rather:
"What AI do we use, what risks do they present, and are we able to demonstrate that we control them?"
Why did Europe create the AI Act?
The aim of the AI Act is not to ban artificial intelligence.
It aims to enable its development and use while particularly protecting security, fundamental rights, and European citizens.
The principle adopted is relatively simple:
The more a AI system can have a significant impact on a person or society, the stronger the obligations governing it.
The AI Act therefore adopts a risk-based approach.risk.
Not all AIs are regulated in the same way.
A tool that helps a colleague rephrase an email is obviously not treated the same as a system that participates in a recruitment decision or a person's access to an essential service.
This is probably the most important point to understand: compliance does not start with the technology used, but with its use and level of risk.
For whom?
The AI Act distinguishes several actors.
A company can notably be:
a provider, when it develops or has developed an AI system and markets or puts it into service under its name;
a deployer, when it uses an AI system under its own authority;
but also an importer, distributor, or agent depending on its position in the value chain.
The regulation concerns actors established in the European Union, but may also apply to actors located outside the EU when the results produced by their AI system are used in the Union.
Is a SME that uses ChatGPT or Copilot concerned?
Potentially, yes.
Using a solution purchased from a large provider does not mean that all responsibilities are transferred to them.
Let’s take a few examples.
A company can use AI to:
write or summarise documents;
analyse contracts;
assist its customer service;
generate marketing content;
analyse CVs;
pre-select candidates;
evaluate employee performance;
detect fraud;
assign scores to customers;
automate certain decisions.
The regulatory consequences will vary greatly depending on the cases.
The first step in an AI Act approach rarely involves drafting a policy.
It involves knowing where AI is located in the company.
The four main categories of risks
The AI Act organises its approach around different levels of risk.
1. Prohibited practices
Certain uses are considered incompatible with European values and fundamental rights.
This includes certain manipulative or deceptive techniques, certain forms of exploitation of vulnerabilities, or certain social scoring systems.
These prohibitions have been in effect since 2 February 2025.
For the company, the principle is simple:
certain uses simply must not exist.
2. High-risk systems
This is where the obligations become much more significant.
A system may be considered high-risk when it operates in certain sensitive areas defined by the regulation.
These include, in particular:
employment and management of workers,
education,
certain biometric uses,
certain critical infrastructures,
access to certain essential services,
or certain uses related to justice, migration, and border control.
For example, an AI used to select job candidates may therefore fall under a very different regulatory framework than a simple writing assistant.
For these systems, the requirements may include risk management, data quality, documentation, traceability, human oversight, or monitoring of the system's operation.
For deployers of high-risk systems, the AI Act notably provides that human oversight should be entrusted to individuals with the necessary skills, training, and authority.
3. AIs subject to transparency obligations
Some systems are not necessarily high risk but must comply with specific transparency rules.
Since 2 August 2026, some of these obligations are applicable.
A user must, for example, be able to know, in certain situations, that they are interacting with an AI rather than a person.
Synthetic content generated by AI is also subject to identification obligations, while deepfakes must be accompanied by appropriate information.
This issue directly concerns companies that deploy chatbots or produce content en masse with artificial intelligence.
4. Limited or minimal risk uses
Fortunately, a large part of the current uses of AI in business falls into this category.
Using AI to :
prepare a draft of an email ;
summarise a meeting ;
search for ideas ;
translate a document ;
assist a developer ;
produce a first version of a presentation ;
does not automatically turn the system into high-risk AI.
But low regulatory risk does not mean absence of governance.
It remains necessary to address issues of privacy, intellectual property, cybersecurity, personal data, and control of the results produced.
When must one be compliant?
The AI Act came into force on 1 August 2024, but its application has been organised gradually. The timetable has also evolved in 2026 with the AI Omnibus.
2 February 2025
First major step.
Prohibited AI practices have become applicable.
The obligation of AI literacy — or AI literacy — has also come into effect.
Providers and deployers must take measures so that individuals using AI systems on their behalf have a sufficient level of knowledge and skill, tailored particularly to their experience and the context of use.
In other words:
training employees in AI is no longer just a good practice.
2 August 2025
The governance rules and obligations regarding general-purpose AI models — the GPAI — have started to apply.
2 August 2026
This is a major date for businesses.
Since this date, the bulk of the AI Act is applicable and the European AI Office as well as national authorities have their enforcement powers.
The new transparency rules regarding certain AI systems have also come into effect.
We are therefore now in a phase of operational compliance, and no longer just regulatory preparation.
2 December 2027
The rules concerning high-risk systems in certain areas of Annex III, notably employment, education, biometrics, certain critical infrastructures or migration, will come into effect on this date.
2 August 2028
The rules relating to high-risk AI systems integrated into certain regulated products will have a longer transition period, until 2 August 2028.
How to practically prepare your business?
For an SME or a mid-sized enterprise, immediately launching a huge compliance programme would often be counterproductive.
It is better to proceed gradually.
Step 1 — Take inventory of AI uses
The first question is very concrete:
Which AIs are actually used in the company?
And not just those purchased by the IT department.
It is necessary to look for:
SaaS solutions incorporating AI;
generative AI tools;
AI features activated in existing software;
AI APIs used by technical teams;
tools adopted directly by employees;
internal developments.
This last point also helps to identify the Shadow AI : uses of artificial intelligence of which the IT department or management is sometimes unaware.
Step 2 — Document each use
For each system, a few pieces of information are initially sufficient:
Tool / provider
User service
Purpose
Data used
Concerned individuals
Decisions influenced by AI
Level of autonomy
Human supervision
Assumed level of risk
Internal responsible
This gradually leads to a true register of AI systems and uses.
Step 3 — Classify the risks
Each use must then be analysed.
Ask the following questions, in particular:
Does the AI make or influence a decision regarding a person?
Is it used in recruitment or employee management?
Does it process personal or sensitive data?
Could it have an impact on a person's rights?
Does it produce content intended for the public?
Does it interact directly with customers?
Could an AI error have significant consequences?
This analysis helps to determine which systems require priority attention.
Step 4 — Define an AI usage policy
Banning ChatGPT for all employees is generally not a sustainable governance strategy.
An effective policy should rather clearly define:
what is allowed,
what requires validation,
what is prohibited,
which data can be transmitted,
which tools are approved,
when human validation is mandatory.
The objective is to enable innovation while maintaining control.
Step 5 — Train the employees
Since February 2025, mastery of AI has explicitly been part of the regulatory requirements.
But effective training should not be limited to explaining how to write a good prompt.
Employees must particularly understand :
hallucinations ;
risks related to confidential data ;
personal data ;
intellectual property ;
biases ;
the limits of automation ;
the internal rules of the company ;
situations requiring human validation.
And above all, the company must be able to demonstrate that this awareness exists.
Step 6 — Organise governance
Who authorises a new AI tool ?
Who determines its level of risk ?
Who validates sensitive uses ?
Who controls the suppliers ?
Who manages an incident involving AI ?
Who maintains the register ?
Depending on the size of the company, these responsibilities can be distributed among general management, IT, the CISO, the DPO, human resources, legal, and the business units.
It is not necessarily required to create a new organisation.
But it is necessary that responsibilities are defined.
And the sanctions ?
The amounts provided for by the AI Act can be significant.
For certain violations of prohibited practices, the penalties can reach 35 million euros or 7% of global annual turnover, according to the conditions set out in the regulation.
Other violations can reach 15 million euros or 3% of global annual turnover.
The regulation, however, provides for specific treatment for SMEs: for these, the applicable cap corresponds to the amount or percentage provided, the lower of the two being retained. Authorities must also take into account, in particular, the nature, severity, and duration of the infringement.
But reducing the AI Act to the fear of fines would be a mistake.
The most immediate risk for many businesses is probably elsewhere:
no longer knowing which data is sent to which AIs, by which employees, and for what decisions.
AI Act, GDPR, cybersecurity: three topics that must converge
The AI Act should not be treated as an isolated project.
When a company uses AI, several questions arise simultaneously.
AI Act: do we have the right to use this AI in this way?
GDPR: what personal data is being processed and on what basis?
Cybersecurity: what information leaves our information system and what are the consequences of a compromise?
Governance: who is responsible for this use?
Continuity: what happens if the provider changes its model, its conditions or interrupts its service?
A mature AI governance must therefore gradually align with the overall governance of the information system.
The right starting point: the AI register
For many SMEs and mid-sized companies, the first step of the AI Act can ultimately be summarised in a very simple question:
Can you today list the artificial intelligence systems used in your company, explain what they are for, what data they handle and who is responsible for them?
If the answer is no, there is no need to start by producing fifty pages of procedures.
Start with the register.
Identify the tools.
Identify the uses.
Identify the data.
Identify the responsible parties.
Classify the risks.
Then prioritise the most sensitive uses.
This approach allows for the gradual transformation of sometimes chaotic use of artificial intelligence into a governance of AI.
The AI Act is not just a regulatory constraint
For an SME or mid-sized company, the real challenge is not simply to be "AI Act compliant".
It is to be able to use artificial intelligence without losing control of its information system, its data and its decisions..
A company that knows which AIs it uses, why it uses them, which data they process and what risks they present already has a large part of the necessary foundations.
The AI Act is finally accelerating an evolution that should have accompanied the arrival of artificial intelligence in businesses:
moving from individual experimentation to true AI governance.
And in October 2026, for European companies, the time to start is no longer "soon".
It is now.