What the AI Act prohibits and what it regulates
The AI Act classifies AI systems into four risk levels. Unacceptable risk systems are outright banned: citizen social scoring, behavioural manipulation, real-time facial recognition in public spaces (with limited exceptions).
High-risk systems are permitted but regulated: automated recruitment, credit scoring, medical systems, critical infrastructure. They require full documentation, robustness testing and human oversight.
What this changes concretely for SMEs and mid-caps
Chatbots and AI assistants
Any AI system interacting with humans must now identify itself as such. Your chatbot must inform users they are speaking with an AI. Simple to implement, but mandatory or face sanctions.
Recruitment systems
If you use an AI tool to filter CVs or score candidates, it falls in the high-risk category. Mandatory documentation, regular audits, right of appeal for candidates.
Do this now: inventory all your AI systems in production and classify them by risk level. This is the first deliverable expected by supervisory authorities.
How to prepare: our 4-step method
Step 1: map the existing. Identify every AI system used in your organisation, including third-party SaaS tools with AI integration.
Step 2: assess each system's risk according to the AI Act framework. Most office AI tools (Copilot, ChatGPT for writing) are minimal risk.
Step 3: document high-risk systems. For each: objective, data used, identified biases, mitigation measures, designated owner.
Step 4: train your teams. Compliance is not just a legal matter, it is an operational governance issue.
DataSAI supports companies in their AI Act compliance. Our 2-week compliance audit gives you a complete mapping and prioritised action plan.
European regulatory texts, the AI Act included, are available in full in our scientific library, each with a structured summary in English and French.
