I’ve been asking entrepreneurs and executives about this date for months. The most common response: a shrug.
That should be a wake-up call for you.
2 August 2026 is the first hard deadline under the EU AI Act. From that date onwards, certain AI systems will be banned in the European Union – not regulated, not restricted, but illegal. Anyone who continues to operate them after that date risks fines of up to 35 million euros or 7 per cent of their company’s global annual turnover.
And yet the majority of the companies affected have not yet carried out an assessment of their current situation.
What exactly comes into force on 2 August?
The EU refers to this category as ‘Unacceptable Risk’ – AI systems that interfere so profoundly with fundamental rights that no regulatory framework can render them acceptable. They are not subject to strict conditions. They are subject to a complete ban.
Specifically, the following will be prohibited from this date:
Social scoring by private or public bodies. Systems that assess people on the basis of their behaviour, social contacts or personal characteristics and disadvantage them on that basis – similar to the Chinese social credit system, but many Western variants also fall under this category.
Emotion recognition in the workplace and in educational institutions. This is the point that surprises many people. Tools that analyse facial expressions and mood during video calls to assess the ‘performance’ or ‘attention levels’ of staff or students – these are prohibited. Some of these features are already built into popular HR software and meeting tools, without users being aware of it.
Real-time remote biometric identification in public spaces. Real-time facial recognition via cameras – with narrow exceptions for law enforcement under judicial supervision.
Manipulation through subliminal techniques. AI systems that influence behaviour by operating below the threshold of conscious perception – for example, through targeted information distortion or by exploiting psychological vulnerabilities.
Predictive policing based on personal characteristics. Systems designed to predict criminal offences by individuals based solely on personality profiles – without concrete evidence of an offence.
The awkward question: Are you currently using any of these?
Probably not consciously. But you might be anyway.
The problem isn’t that companies are deliberately using illegal AI. The problem is that AI features are now deeply embedded in SaaS products – and most companies don’t have a complete overview of what their tools actually do.
Ask yourselves the following questions:
Do you use video analytics tools in HR processes that automatically monitor and assess applicants? Some ATS (Applicant Tracking Systems) have exactly this as a feature.
Do you use meeting intelligence platforms that measure participant ‘engagement’ - through camera analysis, not through surveys?
Do you have customer profiling solutions that derive personality profiles from behavioural data and use them to tailor offers or prices?
If you cannot answer these questions with certainty - then you still have work to do.
What happens if you do nothing?
In the short term: probably nothing. The EU authorities won’t be knocking on your doors on 3 August with fines. Setting up supervisory authorities and an enforcement infrastructure takes time.
In the medium term: a great deal. Regulatory bodies will build up their capacity. Whistleblower mechanisms will be introduced. And – something that is often underestimated – contractual partners, investors and customers will start demanding proof of compliance. Enterprise tenders in regulated sectors are already including the first AI Act clauses.
Those who fail to act now will be forced to act under pressure in 18 months’ time. That will be more expensive and more uncertain.
What you can do specifically by August
The first step is not a compliance project. It is an AI inventory - a simple list of all the AI systems your company uses or plans to use. This includes in-house tools, purchased SaaS products and models embedded in existing software.
For each system, ask yourself three questions:
What exactly does this system do automatically?
What data does it process - and from whom?
Does it make or influence decisions that affect people?
In most cases, these answers will already paint a clear picture: no problem, worth investigating, or urgent action required.
The second step is a legal assessment. Not every provider transparently discloses whether their products might fall under the prohibited category. Here, you need someone who knows the legal text and can apply it to your specific tech stack.
Why this is relevant now - and not in six months’ time
Every day I speak to companies who say: “We’ll deal with it when things become more concrete.”
I understand the impulse. But 2 August is concrete. It’s in the Official Journal of the European Union. It won’t be postponed.
However, anyone who waits until then will have no time left for a thorough review. The only option then will be a rapid shutdown – with all the operational consequences that entails if a prohibited feature is deeply integrated into a workflow.
The companies I work with today have a structured process. The companies that ring me in July are in a state of emergency.
We're happy to offer a free 30-minute call to assess together where you stand. No sales pitch, no agenda – just an honest assessment.
