Chronicle · Governing the machines
I understand nothing about the AI Act
Since Sunday, some forty posts have explained the European regulation on artificial intelligence to me. Almost all of them announce the same fine: fifteen million euros. If you run a small or medium business, that figure does not concern you, and the fact that nobody told you says a great deal about the advice being sold right now.
Since August 2, if it is not a human you have to say so; the December delay exempts you from almost nothing; and for an SME the maximum fine is not fifteen million euros but three percent of turnover, because the regulation applies the lower of the two.
What happened on August 2
The European regulation on artificial intelligence came into force in August 2024, but it applies in slices, like a tax spread over time. This year's slice landed on August 2, 2026, and it covers transparency. That is Article 50.
The idea fits into one sentence a seven-year-old understands: if it is not a human, you have to say so.
Four situations are covered.
One, somebody talks to your machine. The chatbot on the website, the voice assistant on the switchboard, the agent taking appointments. The person must know they are not talking to a human. Unless it is obvious, and obvious does not mean written in light grey at the bottom of the terms and conditions.
Two, your machine manufactures content. Image, sound, video, text. It must carry a machine-readable mark.
Three, you analyse people. Emotion recognition, biometric categorisation. The people exposed must be informed.
Four, imitations and texts of public interest. Content that imitates a real person, or a text published to inform the public on a matter of general interest, must be clearly flagged.
There. That is all. The rest is commentary, and there is plenty of it.
The figure everybody keeps repeating
Article 99 sets the penalties. For a transparency breach: up to fifteen million euros, or three percent of worldwide turnover. You take the higher of the two.
That is the figure being brandished everywhere since Sunday. It is accurate. It probably does not concern you.
Because there is a paragraph 6 to the same article. It runs to a single line, and it says this: for small and medium-sized enterprises, start-ups included, you take the lower of the two.
The lower. Not the higher. The exact opposite. And it is not a favour left to a judge's discretion: it is an obligation placed on member states.
Do the sums with your own figures.
A company with two million euros of turnover that fails to comply with transparency is not risking fifteen million. It is risking three percent of two million. Sixty thousand euros.
Sixty thousand euros is still very bad news and a very bad evening. It is not the death of the company, and above all it is not the same conversation with your management board.
Why does nobody say so? Because fifteen million makes a much better headline. Fear sells better than arithmetic, and above all it sells dearer.
Announcing fifteen million euros to the head of a small business gets you one of the two most expensive reactions: either he panics, or he decides it is not about him. Both lead to doing nothing.
The question that decides everything: provider or deployer
It is the only genuinely difficult question in the text, and it is the one dispatched fastest.
A provider develops the system, or puts it on the market under its own name. A deployer uses it in its business. Most companies are deployers, and breathe out.
That is where the trap sits. You plug a model's engine into your product, you give it your name, you sell it to your clients: you have just become a provider. Nobody will warn you. No contract will start flashing. And the obligations are not the same: the provider has to design the marking into the system, the deployer has to inform people and label what it publishes.
A piece of old advice: this answer gets written into the contract, not into the minutes of a meeting. In eighteen months, nobody will remember who said what. The contract will remember perfectly well.
The December delay, and what it does not cover
You may have read that an extension was granted until December 2, 2026. That is true, and it is almost always badly told.
That delay covers one thing only: machine-readable marking, for systems that were already on the market before August 2, on the provider side.
It exempts you from nothing else. Your obligation to announce that your chatbot is a bot, and to label what you publish, has been running since Sunday. If somebody sold you that delay as a general reprieve, change advisers.
The exception almost nobody relays
And yet it is the one that concerns you most, you who publish texts.
Content generated by a machine and published to inform the public can escape the labelling obligation if it has undergone genuine human review, and if an identifiable person takes editorial responsibility for it.
Genuine review. Not a glance, not a click on "approve" at the end of the day. Somebody read it, corrected it, made calls, and put their name on it.
In other words: the regulation does not punish the use of the machine. It punishes the absence of a human. I find the distinction elegant, and I do not often say that about a European text.
Incidentally, the Commission has published its final guidelines, a voluntary code of practice, and a set of official icons for flagging generated content. The icons are optional. And sticking an icon on something makes nobody compliant: what counts is the clear statement, not the pictogram.
What you do on Monday morning
One hour. Not a project, not a steering committee, not a consultancy at thirty thousand euros.
List the places where a machine speaks to a human in your stead. The chatbot on the site. The synthetic voice on the switchboard. The automated support replies. The generated visuals in the brochure. The blog texts. The videos with an avatar. The follow-up emails drafted by an assistant.
You will find more than you think. You always do. Marketing has plugged in three tools the IT department has never heard of, and sales has plugged in two more that marketing has never heard of.
Then, for each line, three columns. Who is the provider, who is the deployer. Does the person on the other side know they are talking to a machine. Who takes responsibility for the review when content is published.
The gaps jump out at you. You plug them with a sentence, not with a project. And if you are looking for a place to start in order to understand what these machines actually do, the Atelier's course is free and runs to ten modules.
And to finish, the awkward question
This text was written with a machine's help. I cut, rewrote, checked the articles one by one, and I sign it with my own name. So I fall squarely within the exception I have just described to you, and I am under no legal obligation to tell you.
I am telling you anyway, because that is the subject.
Now go back over the posts that explained transparency to you this week, and count how many carry a statement themselves.
Take your time. I will wait.
- Signé
- Milton Thomas
- Fontes
- Cinzel / Literata / JetBrains Mono
- Relevé
- Chronicle · Governing the machines