August Arrived and Nobody Was Ready
The first full week of EU AI Act enforcement exposed the gap between compliance paperwork and operational reality — and codified agentic risk for the first time.
6 August 2026 — The EU AI Act's high-risk obligations became enforceable this week, and the most common response across European small business was quiet panic followed by nothing.
That is not a criticism of small businesses. The Act arrived with a decade of interpretive ambiguity attached and no harmonised standards to work from. A business owner reading Article 6 and trying to decide whether their recruitment tool counts as high-risk is being asked to perform a legal classification without a legal department.
But the ambiguous parts should not obscure the unambiguous ones. There is a clear obligation to know what AI you use. There is a clear obligation to log what it does. And there is now, for the first time, a codified taxonomy of agentic risk to organise that work around: OWASP published its Agentic Top 10, and for the first time there is a shared vocabulary for the ways autonomous systems fail — goal hijacking, tool misuse, identity abuse, memory poisoning, and six more.
The practical value of a standard like that is not that it tells you what to do. It is that it lets you ask a vendor a question and get an answer you can evaluate.
The other thread this week was measurable returns, and field operations remains the most reliable place to find them. Scheduling, dispatch, route optimisation, service documentation and parts reconciliation — the unglamorous middle of a service business — consistently produce numbers that survive an audit, because the baseline was already being counted. That is the difference between a proof of concept and a business case.
What this means if you run an SME. The deadline has passed, so the useful question is no longer whether you are late. It is which single obligation you can evidence by the end of the month. An inventory of AI systems is achievable in August. A full conformity programme is not. Pick the achievable one — it is the foundation every later step builds on, and it is the only one an inspector will ask for first anyway.
Mid-week review, in parallel with the Monday series.