Why now
The AI Act turns AI use into a responsibility a company must be able to document.
For many companies, the first risk is not “too much AI.” It is not knowing where AI is used, by whom, with which data and under which controls. If a client, investor, procurement team or lawyer asked tomorrow, could you answer?
AI entered companies faster than the processes meant to govern it. One team drafts proposals with a generative tool, another summarizes support tickets, HR tests screening software and finance automates invoice processing. Individually, each use may look manageable. Together, they create responsibility.
The first job is organizational: know what is used, for which purpose, with which data, under whose ownership and with what human oversight. Legal review is much stronger when it begins from maintained company facts.
The deadlines are not all in the future.
The calendar is already in motion. Companies that wait for a formal request risk reconstructing months of AI use under pressure.
The AI Act enters into force
The regulation becomes the European framework for the adoption and use of AI.
Prohibitions and AI literacy start to apply
Companies must pay attention to prohibited practices and to the competence of people using or supervising AI systems.
Governance and general-purpose AI rules apply
Additional parts of the regulation become applicable, including governance rules and obligations for general-purpose AI models.
General application of the regulation
Many rules become operational. Some areas have specific transition periods, but internal mapping cannot wait for the final deadline.
Some rules have exceptions, transition periods and possible updates. For a B2B company, the goal is not to memorize every article. It is to build a maintained evidence base that can be reviewed over time.
The useful question is not “are we compliant?” It is “can we show how we use AI when someone asks?”
This is not only for companies that build AI models.
A company can create operational responsibility simply by using AI in HR, marketing, sales, product, finance, customer support or operations. Before classifying anything, it needs an inventory.
Every confirmed AI Use Case should have a real purpose, responsible owner, tool, data description, preliminary assessment and connected evidence. Without that base, even excellent legal advice starts from incomplete information.
Penalties provide context, but fear is not the method.
The practical value is reducing internal uncertainty before it becomes a problem in front of clients, investors, procurement, lawyers or authorities.
Specific criteria apply to SMEs and startups, and actual penalties depend on the case. Actus does not calculate fines, certify compliance or replace legal advice.
The first external request usually looks like due diligence.
The pressure often arrives through a large client questionnaire, procurement review, investment round, board discussion or request from legal.
Which AI systems do you use across business functions?
What data enters those systems, and who is affected?
Who is responsible for each AI Use Case?
Do you have a preliminary risk assessment?
Have you reviewed vendors, retention, hosting and sub-processors?
Can you demonstrate AI literacy, policies and human oversight?
The first step is not a generic policy.
A policy disconnected from real uses is an isolated document. Useful work begins with the register, its evidence and the open questions that need review.
- Collect real AI Use Cases, function by function.
- Assign a responsible owner to every use case.
- Document purpose, data, tools, vendors and affected people.
- Create a preliminary, revisable risk assessment.
- Connect vendor checks, training evidence and policies to real uses.
- Prepare a dossier and request professional legal support where needed.
Where Actus fits
A company-owned Dossier, reviewed by the people it authorizes.
The company buys the annual Actus license and owns its Workspace and data. An authorized internal lead can review the work, or the company can involve an external adviser. Actus prepares the context; it does not replace advice.