A piece of AI Act enforcement news, and the two checks that don't confirm it

Enforcement of the AI Act began on 2 August 2026. That is what the Commission’s press release IP/26/1714, published on 31 July, says: “From 2 August 2026, the European Commission’s AI Office, together with national authorities, will begin enforcing the Artificial Intelligence (AI) Act. On the same date, new transparency rules will start to apply, requiring certain AI systems to tell users when they are interacting with AI and when content has been generated or altered by it.” Two days later, on AI-regulation aggregation sites, a more specific story began to circulate: on 4 August the French data protection authority had allegedly sent formal requests for information to fourteen financial institutions using credit-scoring algorithms, asking for the technical documentation required under Article 11 of the AI Act for high-risk systems.

It is exactly the kind of story that lands in an internal compliance note on Monday morning, before the coffee has even brewed. We could not verify it. And two independent checks, run this morning, make it improbable.

First check: the authority’s website

The first check is the obvious one: if an authority sends formal requests to fourteen companies on the same day, it often says so. We reopened the CNIL’s news page, cnil.fr/fr/actualites, on 5 August 2026 at 6:52. The most recent item published is still the one from 31 July 2026, a webinar on the update of the MR-001 and MR-003 reference frameworks. There is nothing from August. Zero occurrences of “scoring”, zero of “crédit”, zero of “établissements financiers”.

On its own, that does not prove the action never happened: a request for information sent to a company does not have to be published, and many are not. It is an indication, not proof. But searching the same story across several aggregators already turns up details absent from the earliest version — institutions said to have requested an extension, then refused. An extra detail at every step is the symptom of a story writing itself, not proof that it happened.

Second check: the obligation is not yet in force

The second check is independent of the first, and carries more weight. Credit scoring falls among the high-risk systems of Annex III of the AI Act. The obligations on those systems — including Article 11, the technical documentation — sit in Chapter III, Sections 1, 2 and 3 of the Regulation. And for Annex III systems, those Sections do not apply from 2 August 2026: they apply from 2 December 2027. That follows from Regulation (EU) 2026/1744 (OJ L 2026/1744 of 24 July 2026, in force since 27 July), whose Article 1, point 40(b), replaces Article 113, third paragraph, point (c) of the AI Act, and reads: “Chapter III, Sections 1, 2 and 3 (…) shall apply from: (i) 2 December 2027, as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III.” The same regulation that pushed the national sandbox obligation back a year — we wrote about that on 2 August — moves this deadline too.

In other words: on 4 August 2026, an authority requesting that documentation from a credit institution would be asking for compliance with an obligation not yet in force for those systems. Not impossible outright — a data protection authority can always open an inquiry on other grounds, the GDPR first among them — but not in the form described: as a request for the Article 11 technical documentation of the AI Act.

”Not verifiable” is not “false”

It must be said with the same precision as everything else: we are not writing that the story is false. We have not proven that, and from the outside we could not. An authority can act without announcing it, a preliminary inquiry can stay confidential for months, a fact can be true even when the source reporting it is not verifiable. The correct formulation is different: as we write this, the story is not verifiable against a primary source. The second check makes it implausible in the form in which it is circulating. But that remains an argument, not a verdict — the same caution that applies to whoever publishes a benefit figure without the method behind it: whoever publishes it is answerable for it, regardless of who calculated it first.

Why now, of all times

The weeks after an application date are exactly when this kind of story circulates most. The market is waiting for it: whoever has to write a compliance plan wants to know whether enforcement has genuinely begun, and a story that answers with a name, a date and a number — fourteen institutions — is reassuring, whether or not it is true. Whoever produces content for this market knows it. No bad intent is needed for a story like this to spread: it only takes someone writing it with confidence, and the next outlet repeating it without checking.

The cost of an invented precedent

Here is the operational part. An invented enforcement precedent in a compliance plan is worse than no precedent at all. Whoever aligns their team’s priorities on an action that never happened diverts resources — legal time, technical time, management attention — towards an obligation not yet applicable to Annex III systems. And takes them away from the ones that already are, today: the Article 50 transparency duty, in force since 2 August for every system that interacts with natural persons, regardless of when it was purchased; the obligations on providers of general-purpose AI models, in force since 2 August 2025, a year earlier; the general enforcement announced by the Commission for that same 2 August 2026 — the real one, the one with a signed, verifiable press release.

A compliance plan that invests in the wrong thing is not neutral: it is a plan that arrives late on the right obligation.

The ten-minute rule

The two checks behind this piece cost ten minutes, and both are free. The competent authority’s website. The application calendar of the rule in question — for the AI Act, today, that means knowing the Omnibus pushed the obligations on stand-alone high-risk systems to 2027, and those on systems embedded in regulated products to 2028. They should be done before writing the internal note, not after it has already become an accepted fact inside the company.

The rule that follows is as simple to state as to apply: an enforcement story is cited only if the act exists — a decision, a ruling — or at least the press release of the authority that adopted it. Not “according to sources”. Not “it has been reported”. If neither can be found, write that it cannot be found, with the date on which you looked: that is what we have done here.

How we solve it

This check — which obligation genuinely applies on which date, on which published act, against which verifiable reference — should not remain an exercise repeated once a year before an inspection. We turn it into a control that runs on the client’s own documents and systems: a register of regulatory deadlines linked to the actual text of the acts — not to summaries of them — with the primary source and the date of the last verification against every line, ready to be shown the moment an inspector asks, not reconstructed that same evening.

The same system ties together an organisation’s scattered data — regulatory archives, compliance systems, contracts, inventories of the AI systems in use — into a single operational model on which AI agents execute decisions with a human operator in command: for large enterprises, defence, public administration, healthcare. Compliance is the way in; the system that keeps every regulatory reference current, adjusts priorities when a rule is postponed, and flags when an obligation genuinely becomes applicable is what we sell. We are already active in the field, with systems in operation across a number of enterprise organisations and beyond, in both delivery modes — on-premises, on self-contained machines that require no deep integration into the client’s network, or a dedicated cloud with a dedicated VPN and a data centre in Italy, in premises we guard directly — always under shared management: whoever does not already have a team administering AI models in-house should not need to build one to get started — and always multimodel: the model is replaced whenever it needs to be, because the value sits in the ontology and the data, not in whichever model happens to be running today.

Are you writing Monday morning’s compliance note on a piece of enforcement news you read somewhere? Half an hour with one of our experts: we will check together whether the act exists, and on what date it actually applies.