GOVERNANCE

August 2 came and went and most SMBs didn't notice a thing — here's what actually changes

All obligations under the European AI Act are now enforceable as of August 2, transparency included (Article 50): telling the user they're talking to a machine, labeling AI-generated content. But the vast majority of an SMB's everyday AI use — a chatbot, an automation rule, a product recommendation — stays outside the "high-risk" category of Annex III. The real change is narrower, and easier to comply with, than people think.

On the morning of August 2, nothing happened for most French SMB owners — no email from an authority, no surprise audit, no notification. That very silence is what leads many to believe the text doesn't apply to them yet. Wrong: as of that date, the entire body of the AI Act is enforceable, including Article 50 on transparency, which applies well beyond systems classified as "high-risk." The rule is simple to state: if a customer or employee interacts with an AI system — a chatbot on a website, an agent that answers an email — they must be able to tell. And if AI-generated content is published (text, image), it must be identifiable as such. The SMB compliance guide published by Delbion sums up the spirit of the text well for this exact case: for a limited-risk use like a chatbot, the core obligation fits in one line — let the user know they're talking to a machine.

What the text doesn't say — and what many SMBs wrongly fear — is that their chatbot or automation rule would automatically fall into Annex III's "high-risk" category. That's almost never the case. Annex III targets specific, sensitive uses: automated recruitment, credit scoring, medical devices, biometric surveillance, access to essential services. A customer-support chatbot, a rule that follows up on a quote left unanswered, a product recommendation — these are limited-risk uses, subject only to the transparency obligation, not the full arsenal (risk assessment, technical documentation, formalized human oversight) Annex III imposes. At AppH, the site's conversational assistant already explicitly identifies itself as such from the first interaction — not because the law has required it since August 2, but because clearly saying who you're talking to follows the same logic as never letting an agent act alone on something with real consequence: a human stays in the loop, and the user knows it.

The most tempting move, for any software vendor, would be to write "this isn't a big deal" to reassure and sell faster. That would be half true and therefore misleading. What's true: the law targets the real risk of a use, not the presence of an AI tool somewhere in a workflow, and most of what an SMB does day to day lands on the lighter side of that line. What also stays true: the boundary moves with the use, not the software, and nobody — AppH included — can promise a future use case will always stay on the right side of it. Our job isn't to guarantee a compliance we can't certify in a lawyer's place, it's to build on the cautious side by default — visible transparency, a human who approves — so an SMB owner never has to choose between moving fast and staying within the rules.

Reviewed by an AppH human