EU AI Act supervision since 2 August: what really changes for SMEs now?

What actually happened in the first month

Let us start with what did not happen. No fine was imposed under the AI Act in the Netherlands in the first month, and none could have been: the national law that gives Dutch regulators the power to enforce this Regulation is not yet in force. That is not leniency, nor a policy of tolerance; it is a missing legal basis.

What does apply has applied from that very day. The AI Act is a regulation and is therefore directly applicable: the Article 50 transparency obligations have applied since 2 August 2026, regardless of the state of Dutch legislation. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority) also communicated actively about this in the run-up to that date. Incidentally, there is nowhere to register a system for that obligation: the notice goes to the people who come into contact with the system, not to an authority.

So the distinction to keep clearly in view is not 'does it apply or not', but 'does it apply' versus 'can anyone here already take action against it'. The answer to the first is yes; to the second, not yet fully. Anyone who confuses the two arrives at one of two wrong conclusions: panic, or the idea that nothing needs to be done.

Who will soon be able to ask you for evidence

This is the point at which this spring's coverage becomes tangible. The Netherlands has not opted for a single new AI authority, but for a hybrid model in which existing regulators take on AI within their own remit. The Autoriteit Persoonsgegevens and the RDI (Dutch Authority for Digital Infrastructure) share the coordinating role, with the RDI as the central point of contact with Europe.

The draft bill designates ten market surveillance authorities in total. The allocation that is relevant to SMEs in logistics, food and agri-food looks like this:

• The Autoriteit Persoonsgegevens: the prohibited practices, most of the high-risk systems in Annex III and the Article 50 transparency obligations.
• The RDI: coordination between the regulators and the point of contact for the European Commission and the other Member States.
• The NVWA (Netherlands Food and Consumer Product Safety Authority) and the Nederlandse Arbeidsinspectie (Netherlands Labour Authority): AI in products and AI in the workplace, exactly where production equipment and working conditions meet.
• The ILT (Human Environment and Transport Inspectorate): AI in transport and the human environment.
• The AFM (Dutch Authority for the Financial Markets) and De Nederlandsche Bank (the Dutch central bank): AI in financial institutions.
• The IGJ (Health and Youth Care Inspectorate): AI in healthcare. The remaining two roles lie with the judiciary and are not relevant to business.

Why those powers do not exist yet

The Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act) settles exactly what is missing now: which regulator can impose a fine under Article 99, by which procedure, and with which powers to request information. Without that legal basis, a Dutch regulator cannot effectively impose a fine under the AI Act. The bill went into online public consultation on 20 April 2026; the consultation closed on 1 June 2026. Next come the processing of the responses, the advisory opinion of the Raad van State (Council of State) and consideration by the Tweede Kamer and the Eerste Kamer (the House of Representatives and the Senate). The Dutch government itself had already indicated that entry into force would come after 2 August 2026.

More interesting than the delay is what the regulators themselves make of it. In its implementation assessment of 12 June 2026, the AFM concluded that the bill is workable, but that adjustments are needed for effective supervision: sufficient capacity and resources, a clear division of tasks between the AFM and De Nederlandsche Bank, an explicit publication regime and clear frameworks for data sharing and confidentiality.

These are not technical details. They concern precisely who may request what from you, what a regulator may make public about it and how regulators share information with one another. Until that has been settled, supervision has been named but is not yet fully operational.

For your own planning, that means two things at once. You can build your dossier now without an ongoing investigation dictating the order and the pace. And you would do well to make use of this period, because as soon as the toolkit is complete, it will apply to obligations that by then will have been in force for years. There will be no transition period for the time you leave unused.

What was already mandatory, and is therefore not August news

This is where the biggest misunderstanding of the past month lies. The AI literacy obligation in Article 4 and the prohibition of certain AI practices in Article 5 have applied since 2 February 2025. That is a year and a half before the date in every headline. Anyone who took action in August 2026 because 'the AI Act is taking effect now' was therefore responding to the wrong date: for those two obligations, they were by then already more than a year and a half behind.

On the fear of fines, one thing matters. The penalty framework of Article 99 works with an exhaustive list of provisions, and Article 4 is not on it. The simplification package has also softened the wording of that article into a best-efforts obligation. That explains why the much-heralded multi-million fines for a missed course have not materialised. It does not make the obligation optional: what matters is that you can show which measures you have taken, for which roles, and when.

The distinction fits in one sentence: the supervision is new, the obligation is not.

New and concrete: the code of practice for AI content

One development from this spring was largely buried in Dutch news coverage, even though it is the most practical one for the transparency obligation. On 10 June 2026 the European Commission published the code of practice on transparency of AI-generated content. It elaborates the marking and labelling obligations of Article 50(2), (4) and (5) in practical terms, with one part for providers of generative AI systems and a separate part for deployers.

Participation is voluntary; the underlying obligation in Article 50 is not. The Commission and the AI Board have recognised the code as an adequate voluntary instrument for demonstrating compliance, and the Autoriteit Persoonsgegevens advises organisations that fall under these obligations to study it and to sign parts of it.

For most SMEs in our target group, signing is not necessary: you do not build generative AI systems yourself. But the code is the clearest available answer to the question of how to label AI content properly, and that question becomes a live one as soon as you publish AI-generated text or images. Use it as a reference, not as an obligation, and ask your vendor whether it has signed the code.

The form in which the request for evidence now arrives

We already noted in June that customers and auditors ask about your AI policy while the regulator does not yet have the power to do so. The refinement to make now concerns not so much who is asking as the form in which the request arrives. That form determines what you must be able to produce, within what time frame, and who signs it on your side.

• As a contractual condition. Customers and contracting authorities include AI use in supplier questionnaires and purchasing terms. Here the bar is a signed and dated statement, not a conversation to explain things.
• As an audit question. Auditors of quality schemes want to see how AI relates to your control measures and records, for example on traceability and quality data. Here what counts is whether it can be found in the documentation you already keep.
• As part of a risk assessment. Insurers and finance providers look at the role of AI in critical processes. Here the main question is which decisions a human takes, and where that is recorded.
• As a flow-down requirement. Clients in your supply chain ask you for the same supporting evidence that they themselves must give to their own customers. Here the format is usually your client's, not yours.
• As an employee participation question. Employees and the works council want to know what is happening with AI in planning, rostering and appraisal. Here an account you can explain carries more weight than a document.

What the first month adds to your dossier

The practical steps themselves have not changed this month. Which AI you use, who has been trained in it, what has been agreed and where AI communicates with people on your behalf: those four questions were already in our checklist for 2 August in July, and we developed the policy part of it in the article on ChatGPT and Copilot in the workplace. You do not need to redo that list. What the first month does add concerns the form in which you keep that material. Three things:

• An address. Now that the allocation across ten regulators is known, you know who covers your field: for a food producer, that is the NVWA and the Arbeidsinspectie; for a haulier, the ILT; and for the transparency obligation, the Autoriteit Persoonsgegevens. That is more than a name. You already have an inspection relationship with most of these bodies, and it saves work if your AI dossier follows the structure you already use in that relationship.
• A date on every document. The powers come later; the obligations are running now. What a regulator or auditor assesses later therefore includes the period you are in today. So for each measure, note when you took it: when the notice was placed on the system, when which employees were trained, when the agreements were adopted and when you last reviewed them.
• A vendor column. This is new since the code of practice of 10 June 2026 and the marking deadline of 2 December 2026. For each AI tool, record who the provider is, whether it has signed the code of practice in full or in part, and what it says about machine-readable marking of the output. You have to request that information anyway, and without a fixed place it disappears into email threads.

The next date that counts

Put 2 December 2026 in your diary. On that date, the transition period ends for the machine-readable marking of AI content by systems that were already on the EU market before 2 August 2026. Your vendor has to implement that marking technically, and there is no switch for it on your side, but it is the next moment at which the provider side must be able to show something. Simply ask about it at your next meeting; the answer also says something about how seriously that vendor takes the rest of the Regulation.

After that, things are quiet until 2 August 2027 (national AI sandboxes and older general-purpose AI models), 2 December 2027 (high-risk systems under Annex III) and 2 August 2028 (AI in regulated products). If you run AI in operational processes such as planning, forecasting and quality control, Annex III does not affect you and that date is mainly one to be aware of. If you use AI in recruitment, appraisal or rostering, December 2027 is your own horizon. In both cases the same applies: if you set up the dossier now, you only need to add to it at those dates. And by the time the Dutch enforcement toolkit is complete, the answer will already be in place.