Let’s talk about the day the rules went live — and the machines they didn’t reach.
Today, the second of August, the EU AI Act’s high-risk obligations become applicable. The biggest activation date in the law’s rollout. From today, new AI systems that decide who gets hired, who gets credit, who gets into a school, who gets flagged by law enforcement — they have to carry a paper trail before they touch your life. Risk management. Data governance. Logging. A conformity assessment somebody actually signed. Human oversight. The algorithm has to prove itself.
That part is true. It is also half the story.
Put a person in front of it, because the carve-outs are easier to miss than the consequence.
Picture a woman in Lisbon on Monday morning, applying for a home loan. She was turned down in March by a credit-scoring model nobody could explain to her. The manager couldn’t. The call centre couldn’t. The fine print didn’t even try. The model said no, and the model keeps no minutes.
That model was deployed in 2024. It is exactly the kind of high-risk system this law now regulates. And it does not have to comply today.
Because the law came with an exit for what already existed.
Under the transitional provisions, high-risk systems that were already on the market before today get until August 2027 to come into compliance. A full year. Unless the design undergoes significant changes — then the obligations snap on immediately.
And the carve-out goes deeper. AI that is a component of the big EU border-control and migration systems — the machines that help decide who crosses a border — those get until the end of 2030.
Sit with that. The machines that have been deciding your life the longest, trained on the most data, embedded in the most decisions, with the most history and the most to hide — those are exactly the machines today’s law does not reach. The law protects you from the model that hasn’t been built yet. The model that already knows you gets another year. Some of them get four.
Here’s what people are missing.
Start with the grandfather clause, because that is where the real fight now lives. Every headline today is about the new obligations. Almost nobody is watching the transition — but that is where the systems with the most power over ordinary lives are sitting. The compliance scramble will happen around new deployments and shiny pilots. The legacy systems doing the daily work of scoring people just got a year of quiet.
Then there’s the perverse incentive hiding in a legal detail. If a vendor substantially redesigns a legacy high-risk system, the full obligations switch on. So the rational move is to never call a change significant. Retrain quietly. Patch quietly. Recalibrate on new data and file it as maintenance. The systems that evolve the fastest are the ones most motivated to look frozen. The law rewards the appearance of stasis. That is how you get theatre with better lawyers.
And then there’s the calendar nobody is reading carefully. AI inside medical devices, machinery, vehicles — the safety-component rules — don’t fully apply until August 2027. The machine that reads your scan and the model that rejects your loan are both waiting on the same slow schedule. Oversight sits with national market surveillance authorities — twenty-seven of them, most without AI inspection capacity or budget. The EU AI Office coordinates, but it doesn’t walk into a bank and demand the logs. So year one of this law will mostly be paperwork review. The machines the law does reach today will be judged on whether the documents exist, not on whether the systems are safe. Paperwork is the doorway to safety. It is not the evidence of it.
And the 2030 date is the one nobody will discuss. Biometric matching, risk scoring at the border, migration decisions — the most consequential automated decisions a state makes about a person — exempt until the end of the decade. If you want to know where machine power over human life is most concentrated and least accountable, follow the exemptions. The law’s mercy is a map of the machine’s grip.
So what do you do with this?
If you deploy high-risk AI — and in Europe that means most banks, insurers, and large employers — the next year is not a holiday. It is the cheapest window you’ll ever get to build the audit trail, before the authorities grow teeth and before the first big case makes the news. Build the logs like they will be read in court. Eventually they will be.
And for the rest of us, don’t wait for the law to reach the machine that is already deciding. Ask the question yourself: what model scored me, when was it built, and who is watching it? The question costs nothing. Not asking it is what the machine is counting on.
The principle underneath all of this cuts against the law’s own mercy. The machine with seniority should not get the most slack. The systems that have been deciding longest are the ones that owe the most proof.
Because a law that protects you from tomorrow’s machine while today’s machine keeps deciding is not regulation. It is a grace period for the machine that already knows you.
You’ve got this. Watch the exemptions. They tell you where the power actually is.