Let’s talk about the law that went live nine days ago — and why almost nothing has changed for you yet.
On the second of August, the real body of the EU AI Act started applying. Not the part that made headlines last year. The part with teeth. If an algorithm decides who gets hired, who gets credit, who gets into a school, who gets flagged, it now has to carry documented risk management, data governance, logging, and human oversight before it touches your life.
This was supposed to be the biggest reset in the history of software regulation.
And here’s what nobody is covering: nothing happened.
Not literally nothing. Registrations are being filed. Compliance teams are working weekends. Consultancies are selling AI Act readiness like fire insurance. But in your actual life, the machine that scored your loan application last month is probably scoring this month’s the same way it always has.
Here’s the reason, and it’s a word you won’t hear in the press releases: grandfathering.
Most of the high-risk systems already in use don’t have to meet the new obligations until August 2027. Not because the law is soft. Because the alternative was switching off half the credit infrastructure of Europe overnight. So the law drew a line in the sand — and then moved the line two years back.
Picture the person this law was written for. A nurse in a public hospital, applying for a home loan. The bank’s scoring model has been running for four years. Nobody outside the bank has ever audited it. It is exactly the kind of system the AI Act was written to control. And it will keep running, untouched, until 2027. The law was written for her. She just won’t feel it for two years.
Now here’s what people are missing. The 2027 deadline is not the story. The story is what happens between now and then — because that’s when the law actually gets defined.
A law is not alive when it’s signed. It’s alive when it’s interpreted. Over the next eighteen months, the guidance gets written. The standards get drafted. Auditors figure out what “conformity” actually means. Providers quietly declare their own systems out of scope. Every one of those decisions becomes the template for everything that follows. And almost none of them will happen in public.
Meanwhile, the enforcement side is a skeleton. The EU AI Office is small. Most national authorities are new. Nobody has the staff to knock on the door of every bank that filed a self-assessment written by the bank. And the public registry — the list where every consequential system is supposed to show up — is only as complete as the people who volunteer to be on it.
Here’s the uncomfortable truth: this law runs on self-reporting. The company that builds the system writes the documentation. The company that deploys it writes the risk assessment. The human oversight the law demands gets signed by a human who has never seen the model’s reasoning. The thing being regulated gets to describe itself.
I’m not saying the law is worthless. I’m saying the opposite. The AI Act is the most important piece of software regulation ever written. The next two years decide whether it’s a guardrail or a form.
Operator lesson, whether you’re a founder, a buyer, or just someone scored by machines you never met: don’t confuse paperwork with protection. A compliance binder is not an audit. A signed form is not oversight. If you’re deploying AI, the question is not “are we compliant?” It’s “could anyone actually check that we are?” Because that gap — between what the law demands and what anyone can verify — is where the machine’s mistakes become human consequences.
And if you’re one of the people this law was written to protect, the window to shape what human oversight means is open right now. Once the guidance is written, once the standards are set, once the first conformity assessments become the template — that’s the law. Not the text. The interpretation.
So watch the machinery, not the headlines. The law went live on the second of August. The real fight is happening now, in documents you’ll never see. And the law can’t watch itself. That part is still yours. You’ve got this.