As the first legislative framework dedicated to artificial intelligence, the European Union’s AI Act aims to regulate the development and use of these technologies within the European market. Based on a risk-based approach, with obligations tailored to the impact of AI systems on users and society, the AI Act marks a significant legislative turning point for artificial intelligence.
Its implementation requires special preparation, particularly on the part of small and medium-sized enterprises (SMEs), which must start planning now to avoid falling behind in their compliance efforts, despite the partial postponement of the timeline.
The Context
The development of artificial intelligence (AI) has accelerated at an unprecedented pace in recent years, with rapid adoption in both the business world and everyday life. The emergence of generative AI tools, chatbots, and automation systems has profoundly transformed practices, while also giving rise to new—and sometimes controversial—uses, such as deepfakes and the manipulation of information.
In light of this rapid growth, the European Union sought to step in to regulate these technologies and limit potential abuses. The lack of a harmonized legal framework at the European level indeed gave rise to concrete risks, particularly those related to algorithmic bias, discrimination, data exploitation, and the use of AI in sensitive contexts such as hiring or surveillance.
The AI Act is part of this effort to regulate the use of artificial intelligence, complementing the General Data Protection Regulation (GDPR), which already focuses on the protection of personal data. The goal is to establish clear rules applicable across the entire European market, in order to ensure safe practices while promoting their adoption.
This text is not intended to stifle innovation, but rather to regulate its use. It reflects a key priority of the European Union: to create a framework of trust that can reconcile technological development with the protection of fundamental rights, while providing concrete solutions to the risks associated with artificial intelligence.
What is the AI Act?
The European Regulation on Artificial Intelligence (RIA), also known as the AI Act, aims to establish a harmonized legal framework at the European level to regulate the uses and practices related to artificial intelligence. To this end, it introduces specific obligations regarding transparency, risk management, and liability, tailored to the level of risk posed by the systems in question. The implementation of the various rules will be phased in over several years to give companies time to gradually adapt to the new requirements.
Deployment Schedule
Most provisions of the AI Act were originally scheduled to take effect in August 2026, particularly those concerning high-risk AI systems and transparency requirements. However, a provisional agreement reached on May 7, 2026, between the European Parliament and the Council, as part of the Digital Omnibus VII, introduced several adjustments aimed at modifying the implementation timeline.
This agreement provides for a partial deferral of certain obligations to give companies the time they need to prepare, in the absence of finalized technical standards. However, it must be formally adopted by the European institutions before it can take full effect.
Specifically, the provisions originally scheduled to take effect on August 2, 2026, are now spread out over several deadlines:
- The transparency requirements (Article 50) remain in effect through August 2, 2026, and directly apply to the majority of business uses
- The technical marking requirements for AI-generated content (Article 50, §2) (watermarking) have been postponed to December 2, 2026
- The rules applicable to high-risk AI systems (Article 6 + Annex III + Articles 8 through 15) have been postponed to December 2, 2027
- The requirements regarding AI integrated into regulated products (Article 6(1) + Annex I) have been extended from August 2, 2027, to August 2, 2028.
Despite these adjustments, 2026 remains a pivotal year for SMEs, as it marks the implementation of the first concrete transparency requirements.
This additional time should not be viewed as a postponement of the issue, but rather as an opportunity for companies to structure their use of AI by establishing appropriate governance frameworks and anticipating future requirements.
Legal Framework
Classification of Risks Associated with Artificial Intelligence
The AI Act is based on a classification of artificial intelligence systems according to the level of risk they pose: minimal, limited, high, or unacceptable. This approach underpins the entire regulation and directly determines the obligations applicable to companies.
Minimal risk
Systems considered to pose a minimal risk are not subject to any binding requirements under the regulation.
However, Article 95 of the AI Act provides for a mechanism for voluntary codes of conduct. This mechanism aims to encourage companies to establish guidelines for their use of AI, even in cases not subject to strict regulatory requirements.
This system is based on a voluntary regulatory approach: organizations are encouraged to establish internal rules to govern their uses and practices and to anticipate issues related to artificial intelligence.
Limited Risk
Limited risk is the first level that involves specific obligations for companies.
It applies to the situations covered by Article 50, which establishes transparency requirements. The goal is to clearly inform users when they are interacting with artificial intelligence or when content has been generated or modified by it. This involves:
- To indicate that a user is interacting with a chatbot or an automated assistant
- Indicate that content (text, image, video) is generated by AI
- To identify content that could cause confusion, such as deepfakes
This requirement is intended to avoid any ambiguity between human intervention and automated processing.
High Risk
High-risk artificial intelligence systems are defined in Article 6 and further specified in Annex III of the regulation.
A system is considered high-risk when it:
- Is incorporated into a product subject to European safety regulations
- Is used in an area identified as sensitive in Annex III
These areas include:
- Recruitment and Human Resources Management
- Access to essential services (finance, health care, education)
- Systems used in the justice or security sectors
- Critical Infrastructure
These systems are not prohibited, but are subject to a strict regulatory framework designed to ensure their reliability and the protection of users.
As such, the AI Act requires:
- Implementing a risk management system
- Detailed technical documentation
- Data Quality Control
- Human oversight of decisions
- Robustness and safety requirements
Unacceptable Risk
Systems that pose an unacceptable risk are defined in Section 5 of the IA Act.
They involve practices deemed incompatible with the fundamental values of the European Union. Unlike the other categories, these systems are not regulated but are strictly prohibited and include:
- Systems designed to manipulate people’s behavior in a deceptive or subliminal manner
- Schemes that exploit the vulnerabilities of certain individuals (age, disability, social circumstances)
- Social scoring systems
- Certain uses of biometric recognition or large-scale surveillance
These practices are considered to pose too high a risk to be authorized on the European market, due to their potential impact on fundamental rights and individual freedoms.
Penalties Under the IA Act
In the event of noncompliance with the obligations imposed by the AI Act, the European Union has established a three-tiered system of sanctions, as defined in Article 99 of the regulation.
Level 1: Violations of Prohibited Practices (Article 99, §3)
The most serious violations, involving the use of prohibited AI systems, may result in fines of up to 35 million euros or 7% of global annual revenue, whichever is higher.
Level 2: Violations of Compliance Obligations (Article 99, §4)
Failure to comply with the obligations applicable to AI systems (regarding compliance, transparency, or risk management) may be punishable by a fine of up to 15 million euros or 3% of global annual revenue.
Level 3: Provision of Inaccurate Information (Article 99, §5)
Providing incorrect or incomplete information to the competent authorities is punishable by fines of up to 7.5 million euros or 1% of global annual revenue.
To ensure a balanced approach, the European Union also provides for a specific mechanism for SMEs and startups. For these companies, the amount of the fine is set at the lower of the fixed ceiling or a percentage of revenue, in order to preserve their economic viability (Article 99, §6).
How to Prepare for It
Compliance with the AI Act depends above all on the ability to structure the use of artificial intelligence within the company. This is not merely a technical issue, but a matter of overall governance.
Establish a Dedicated Governance Structure
It is recommended to appoint an AI lead responsible for overseeing these matters internally. Depending on the size of the company, this role may be filled by the CEO, the CTO, the DPO, or another relevant expert.
This point person should not work in isolation. Establishing an AI committee helps structure decision-making and ensure consistency across all applications. This committee must bring together complementary expertise—technical, legal, and business—to provide a comprehensive understanding of the issues at hand. It must also be equipped with adequate resources, including legal counsel and HR support, to ensure the effective implementation of the defined guidelines.
Mapping AI Applications
The first operational step is to identify:
- The AI tools used
- Real-world use cases
- The teams involved
This mapping provides a clear overview of existing practices and helps identify areas of concern.
Assessing Risks
Once the uses have been identified, they must be classified according to their level of risk:
- Minimal risk
- Common uses that require transparency
- Potentially Sensitive Cases
- Situations That May Be Considered High Risk
- Prohibited Practices
This step is essential for identifying the applicable obligations and prioritizing actions.
Regulating Usage and Data
The company must establish clear rules regarding:
- The Use of AI Tools
- Data Management and Protection
- Permitted usage limits
The selection of solutions must also be carefully managed, with a focus on reliable and appropriate tools that offer guarantees of compliance and security.
Implement Appropriate Measures
Depending on the level of risk identified, the company must implement proportionate measures:
- Human Oversight of Decisions
- Validation of User-Generated Content
- Internal Controls
The goal is to limit abuses while maintaining the tools’ performance.
Documenting Practices
The AI Act is largely based on the principle of traceability.
It is therefore necessary to formalize:
- Identified uses
- Decisions Made
- The internal rules that have been put in place
Technical documentation is becoming a key element, particularly for the most sensitive systems.
Train the teams
Article 4 of the regulation requires companies to ensure a sufficient level of understanding of AI within their organizations. This involves implementing awareness-raising and training initiatives so that employees are able to use these tools responsibly and with confidence.
Preparing for the AI Act is not about meeting a one-time requirement, but about establishing a sustainable framework for the use of artificial intelligence within the company. The most advanced organizations are not those that use AI the most, but those that know how to regulate its use.
In conclusion
The entry into force of the AI Act establishes a harmonized framework at the European level and fundamentally redefines the obligations of companies that develop or operate artificial intelligence systems. With increased transparency requirements, strengthened compliance mechanisms, and a duty of care, this new regulation mandates a structured and proactive approach to risk management.
In this context, the NG teams provide you with practical support in your compliance efforts by ensuring your practices are secure and integrating these new requirements into the core of your strategy.