--- title: "A piece of AI Act enforcement news, and the two checks that don't confirm it" description: "A story about fourteen financial institutions and the AI Act is circulating online: two independent checks, run by us on 5 August, don't confirm it." url: https://csidia.com/en/notes/enforcement-ai-act-due-controlli-notizia-non-confermata/ lang: en date: 2026-08-05 label: "Method" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/enforcement-ai-act-due-controlli-notizia-non-confermata/ --- # A piece of AI Act enforcement news, and the two checks that don't confirm it Enforcement of the AI Act began on 2 August 2026. That is what the Commission's press release **IP/26/1714**, published on 31 July, says: "From 2 August 2026, the European Commission's AI Office, together with national authorities, will begin enforcing the Artificial Intelligence (AI) Act. On the same date, new transparency rules will start to apply, requiring certain AI systems to tell users when they are interacting with AI and when content has been generated or altered by it." Two days later, on AI-regulation aggregation sites, a more specific story began to circulate: on 4 August the French data protection authority had allegedly sent formal requests for information to **fourteen financial institutions** using credit-scoring algorithms, asking for the technical documentation required under **Article 11** of the AI Act for high-risk systems. It is exactly the kind of story that lands in an internal compliance note on Monday morning, before the coffee has even brewed. We could not verify it. And two independent checks, run this morning, make it improbable. ## First check: the authority's website The first check is the obvious one: if an authority sends formal requests to fourteen companies on the same day, it often says so. We reopened the CNIL's news page, `cnil.fr/fr/actualites`, on **5 August 2026 at 6:52**. The most recent item published is still the one from 31 July 2026, a webinar on the update of the MR-001 and MR-003 reference frameworks. There is nothing from August. Zero occurrences of "scoring", zero of "crédit", zero of "établissements financiers". On its own, that does not prove the action never happened: a request for information sent to a company does not have to be published, and many are not. It is an indication, not proof. But searching the same story across several aggregators already turns up details absent from the earliest version — institutions said to have requested an extension, then refused. An extra detail at every step is the symptom of a story writing itself, not proof that it happened. ## Second check: the obligation is not yet in force The second check is independent of the first, and carries more weight. Credit scoring falls among the high-risk systems of Annex III of the AI Act. The obligations on those systems — including Article 11, the technical documentation — sit in Chapter III, Sections 1, 2 and 3 of the Regulation. And for Annex III systems, those Sections do not apply from 2 August 2026: they apply from **2 December 2027**. That follows from Regulation (EU) 2026/1744 (OJ L 2026/1744 of 24 July 2026, in force since 27 July), whose Article 1, point 40(b), replaces Article 113, third paragraph, point (c) of the AI Act, and reads: "Chapter III, Sections 1, 2 and 3 (…) shall apply from: (i) 2 December 2027, as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III." The same regulation that pushed the national sandbox obligation back a year — [we wrote about that on 2 August](https://csidia.com/en/notes/sandbox-ia-obbligo-2-agosto-2026-rinviato-2027) — moves this deadline too. In other words: on 4 August 2026, an authority requesting that documentation from a credit institution would be asking for compliance with an obligation not yet in force for those systems. Not impossible outright — a data protection authority can always open an inquiry on other grounds, the GDPR first among them — but not in the form described: as a request for the Article 11 technical documentation of the AI Act. ## "Not verifiable" is not "false" It must be said with the same precision as everything else: we are not writing that the story is false. We have not proven that, and from the outside we could not. An authority can act without announcing it, a preliminary inquiry can stay confidential for months, a fact can be true even when the source reporting it is not verifiable. The correct formulation is different: as we write this, the story **is not verifiable against a primary source**. The second check makes it implausible in the form in which it is circulating. But that remains an argument, not a verdict — the same caution that applies to whoever publishes a benefit figure without the method behind it: [whoever publishes it is answerable for it](https://csidia.com/en/notes/chi-risponde-dei-numeri-di-beneficio), regardless of who calculated it first. ## Why now, of all times The weeks after an application date are exactly when this kind of story circulates most. The market is waiting for it: whoever has to write a compliance plan wants to know whether enforcement has genuinely begun, and a story that answers with a name, a date and a number — fourteen institutions — is reassuring, whether or not it is true. Whoever produces content for this market knows it. No bad intent is needed for a story like this to spread: it only takes someone writing it with confidence, and the next outlet repeating it without checking. ## The cost of an invented precedent Here is the operational part. An invented enforcement precedent in a compliance plan is worse than no precedent at all. Whoever aligns their team's priorities on an action that never happened diverts resources — legal time, technical time, management attention — towards an obligation not yet applicable to Annex III systems. And takes them away from the ones that already are, today: [the Article 50 transparency duty](https://csidia.com/en/notes/articolo-50-linee-guida-trasparenza-ia), in force since 2 August for every system that interacts with natural persons, regardless of when it was purchased; the obligations on providers of general-purpose AI models, in force since 2 August **2025**, a year earlier; the general enforcement announced by the Commission for that same 2 August 2026 — the real one, the one with a signed, verifiable press release. A compliance plan that invests in the wrong thing is not neutral: it is a plan that arrives late on the right obligation. ## The ten-minute rule The two checks behind this piece cost ten minutes, and both are free. The competent authority's website. The application calendar of the rule in question — for the AI Act, today, that means knowing the Omnibus pushed the obligations on stand-alone high-risk systems to 2027, and those on systems embedded in regulated products to 2028. They should be done before writing the internal note, not after it has already become an accepted fact inside the company. The rule that follows is as simple to state as to apply: an enforcement story is cited only if the act exists — a decision, a ruling — or at least the press release of the authority that adopted it. Not "according to sources". Not "it has been reported". If neither can be found, write that it cannot be found, with the date on which you looked: that is what we have done here. ## Sources - [European Commission — press release IP/26/1714, "Commission starts enforcing AI Act rules and new transparency requirements on 2 August" (31 July 2026)](https://ec.europa.eu/commission/presscorner/api/documents?reference=IP/26/1714&language=en) - [CNIL — Actualités, page checked on 5 August 2026 at 6:52](https://www.cnil.fr/fr/actualites) - [Regulation (EU) 2026/1744 — text on the Publications Office / EUR-Lex (CELEX 32026R1744)](https://publications.europa.eu/resource/celex/32026R1744) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/enforcement-ai-act-due-controlli-notizia-non-confermata/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com