The companies in scope
The regulation does not only target model providers. Any company that uses an AI system is in scope as a user, with lighter obligations than providers, but real ones: know what you use, inform the people concerned, train your teams.
A services company using AI assistants, a chatbot or automations is therefore covered. For the vast majority of these uses, the obligations come down to transparency and documented control; there are no certification files to assemble. The point is to be able to show, in writing, what you use and how.
The risk tiers
The regulation classifies systems by level of risk. At the top, prohibited practices such as manipulation and social scoring. Then high-risk systems, subject to heavy obligations from 2 December 2027: they touch on recruitment, credit and other sensitive areas, and remain rare in a services company.
Next come systems with a transparency duty: a chatbot must say it is an AI, generated content must be identifiable as such. Finally, minimal risk: the majority of productivity tools, with no particular obligation beyond common sense.
The useful exercise for a leadership team is to place your own uses in these tiers, with no need to learn the text. That classification fits on one page and determines everything else.
The timeline since July 2026
Regulation (EU) 2026/1744, known as the AI Omnibus, entered into force on 27 July 2026. It moves the obligations for high-risk systems to 2 December 2027, and to 2 August 2028 for systems built into regulated products such as machinery or medical devices.
The transparency obligations have applied since 2 August 2026. From 2 December 2026, systems that generate intimate content of a person without their consent, or child sexual abuse material, are prohibited.
The register of AI uses
The register of uses is the foundation. For each AI use: the tool, the purpose, the data it touches, the people who use it, the provider and its contract. Include the unofficial uses: they are often the riskiest, precisely because they escape any framework.
This register serves beyond compliance: it answers the questions of clients and larger buyers, who increasingly ask how their data is handled. A written, up-to-date answer becomes a selling point.
Keep it alive: one new use, one new line. A register dated eighteen months ago is barely better than no register at all. Give its upkeep to the internal AI lead, and review it every time a new tool enters the company: the update takes minutes, the rebuild takes weeks.
Training your teams
Since 2 February 2025, the regulation has expected staff who use AI to understand its limits and its rules of use. The Omnibus that entered into force on 27 July 2026 eased this obligation: the Commission and the Member States take a more active role in promoting it. Training your teams remains the surest way to limit mistakes, and clients increasingly ask for it.
Useful training starts from the company's real cases: which tools, which data may go into them, what to check before reusing an output. And it is documented: who was trained, when, on what content.
We deliver this training and we document the record. The evidence file counts as much as the training itself: it is what you produce the day the question arrives. Plan short sessions, team by team, on the tools actually used: more effective than one general day for everyone.
This quarter's priorities
This quarter, three steps are enough. One: the inventory of uses, official and unofficial, to build the register. Two: appointing an internal AI lead, which simplifies everything even where nothing requires it. Three: the transparency notices where they are missing, starting with the chatbot.
Then plan the team training, starting with the people who handle client data, and prepare your providers for the 2 December 2027 deadline if a use touches on high risk. For a services company, the essentials are handled in a few weeks of structured work.
The Strategic Diagnostic structures this start: a map of your uses, your risks and your priorities, and a dated action plan. €3,500, deducted if you continue with us. You leave with a document you can present as it stands to your board, your clients or your insurer.