The Month Before the Wall

30 July 2026 — With the August deadline for high-risk obligations now days away, the pattern among European small businesses has become clear enough to describe.

The organisations handling it well are not the ones with the best policies. They are the ones with the best lists. Somebody in those businesses sat down and enumerated what AI they use, what each system touches, and who is accountable for it. From that page, everything else followed naturally: classification took an afternoon, vendor review became a short conversation, and the controls the Act requires turned out to be mostly things they wanted anyway.

The organisations struggling are not careless. They are operating without the list, and every obligation loops back to it. What AI do you use in high-risk contexts? Cannot answer without the list. Can you evidence human oversight? Cannot answer without knowing which systems require it. Is your data governance adequate? Depends what data goes where.

There is a version of this that is genuinely reassuring: the work is front-loaded and finite. A business that builds the inventory this month will find August unremarkable. A business that defers it will spend the autumn doing the same work under time pressure and regulatory attention.

One detail worth noting for anyone still assembling the picture: the classic high-risk categories — recruitment and screening, employee evaluation, creditworthiness, access to essential services — catch tools people do not think of as AI. Automated CV filters, performance-scoring features inside HR software, and credit-check integrations all qualify, and all were often bought without anyone considering the classification question.

What this means if you run an SME. If you have one hour this week, spend it listing every tool that makes or influences a decision about a person. That list is short, it is high-value, and it is what the Act actually cares about. Do that before anything more elaborate.

Weekly review from the mid-week signal archive.