The European AI Act enters its enforcement phase: businesses must act now
The European Regulation on Artificial Intelligence (AI Act) has been progressively coming into force since 2025. In February 2026, the obligations concerning general-purpose AI models (GPAI) are now fully applicable. By August 2026, the rules for high-risk systems — recruitment, credit scoring, surveillance — will apply to all companies operating in the EU. Fines can reach 35 million euros or 7% of global turnover.
What it changes for you
✦ The opportunity
Companies that anticipate AI compliance gain a measurable trust advantage. According to an Accenture study from January 2026, 68% of B2B decision-makers say they favor providers able to demonstrate responsible use of AI. Achieving compliance also means putting your AI usage in order and avoiding redundant spending.
Three concrete benefits for SMBs and mid-market companies that get started early:
Commercial differentiation
Displaying your AI Act compliance in your commercial proposals reassures large accounts. It is a growing selection criterion in public and private tenders, just as GDPR was five years ago.
Mapping of AI use cases
The compliance exercise forces you to inventory all the AI systems used in the company. This mapping often reveals duplicates, unmanaged tools and optimization opportunities. On average, companies discover 30% more AI tools than they thought they were using.
Reduced legal risk
Structuring AI governance reduces exposure to disputes related to algorithmic bias, data leaks and contested automated decisions. The cost of an average AI dispute in Europe exceeds €200,000 — prevention is always cheaper.
âš The risk
Underestimating the scope involved
Many companies think they are not affected because they “haven't developed any AI.†Yet the AI Act also applies to deployers: if you use a CV scoring tool, a customer chatbot or a recommendation system, you have obligations. The inventory often reveals unsuspected uses in marketing, HR and finance.
“High-risk†classification broader than expected
The regulation classifies as high-risk the AI systems used in recruitment, credit assessment, insurance management, education and access to public services. If your AI tool influences a decision with a significant impact on a person, it is probably affected. The obligations include a conformity assessment, detailed technical documentation and post-deployment monitoring.
Our recommendation
AI Act compliance is prepared in three phases. Start now to be ready before August 2026:
Map your AI uses (March-April 2026)
Inventory every tool or service incorporating AI in your organization. For each, identify: the provider, the type of data processed, the decisions influenced and the people impacted. Use a structured spreadsheet or an AI registry tool. This mapping is the foundation for everything else.
Classify your systems by risk level (May 2026)
For each identified use, determine its risk category under the AI Act: prohibited, high-risk, limited risk (transparency) or minimal risk. Focus your efforts on high-risk systems: they require a documented conformity assessment, a risk management system and effective human oversight.
Put governance in place (June-August 2026)
Appoint an AI lead, write your AI usage policy and train your teams. For high-risk systems, document the conformity assessment and set up post-deployment monitoring. Plan a budget of €10,000 to €30,000 for external support if your legal team lacks the in-house expertise.
In summary
Frequently asked questions
Is my company affected by the AI Act?
If you use or deploy an AI system in Europe — even one developed outside the EU — you are affected. This includes using ChatGPT, Claude or any tool incorporating generative AI. The level of obligation depends on the risk category of your use case.
What are the penalties for non-compliance?
Fines can reach 35 million euros or 7% of global turnover for the most serious violations (prohibited AI). For breaches of transparency obligations, fines go up to 15 million euros or 3% of turnover.
When do the obligations actually take effect?
The timeline is progressive. The prohibitions (social scoring AI, manipulation) have applied since February 2025. The obligations for high-risk systems come into force in August 2026. The rules for general-purpose AI have applied since August 2025.
Do I need to appoint an AI officer in the company?
It is not strictly mandatory under the regulation, but it is strongly recommended. An AI lead (who can be the DPO, the CIO or a dedicated role) facilitates mapping use cases, managing risks and dialogue with supervisory authorities.
For technical profiles
AI Act compliance tools
AI systems registry
Open source tool developed by Algorithm Audit that lets you map and document all your AI systems. Compliant with the requirements of Article 49 of the AI Act. Self-hostable so you keep control of your compliance data.
Governance and automated audit
SaaS AI governance platform that automates risk assessment, bias tracking and the generation of compliance reports. Native integration with the main ML frameworks. Pricing starting at €2,000/month.
Cost of achieving compliance
Quick comparison
| Criterion | Proactive compliance | Waiting on regulation | No action |
|---|---|---|---|
| Initial cost | €15-50k | €0 | €0 |
| Risk of fine | Minimal | Moderate | High |
| Commercial advantage | Strong | Neutral | Negative |
| Implementation time | 6 months (relaxed) | 3 months (rushed) | Post-penalty |