Updated on 2 October 2026. We wrote this piece in May, before the deadline. Since then 2 August has passed and the Digital Omnibus on AI has changed a number of rules. We have updated the text accordingly.
The moment the dust settled
A Tuesday morning at a mortgage firm with 32 employees. An adviser is working through a complex file and pastes three paragraphs of client data into ChatGPT to get a summary faster. That saves four minutes. And it costs you something you cannot see right now.
Since 2 August 2026, that invisible something has also been legally real. On that day most rules of the European AI Act started to apply and supervisors across Europe got their task. In the Netherlands that supervision is still being set up: the implementing act still has to go to parliament, and the Dutch government proposes that the Dutch Data Protection Authority and the RDI coordinate supervision. For most owner-directors in our corner, that is no reason to panic, but it is the moment when a question you could put off until now can no longer be postponed.
What actually changed on 2 August
Since 2 August 2026 the transparency rules apply: people must know when they are talking to AI, and realistic AI images, video and audio must be recognisable as such. In addition, the European AI Office can enforce from that date against providers of large AI models, such as the makers of ChatGPT and Gemini. It can request information, mandate measures and impose fines.
The fines are set out in Article 99 of the AI Act. The heaviest, up to 35 million euros or 7 percent of global annual turnover, applies to prohibited AI practices under Article 5, such as social scoring, manipulative techniques or emotion recognition in the workplace. For most other obligations, including the transparency obligation and the obligations of deployers of high-risk AI, the cap is 15 million euros or 3 percent. For SMBs, the lower of the two amounts always applies. The AI Act itself sets no fine for AI literacy.
An important nuance, because this is where much of the panic comes from. The heavy obligations (technical documentation, conformity assessment, CE marking) apply to high-risk AI, such as AI in recruitment and selection, credit scoring, education and critical infrastructure. The Digital Omnibus on AI postponed those rules to 2 December 2027, and to 2 August 2028 for AI in products. A 30-FTE mortgage firm using ChatGPT rarely falls into that category. In most cases you are not a provider, you are a deployer.
What does change for you as a deployer
Three things become concrete. First, you need to know which AI tools are running within your organisation, including the tools nobody officially purchased. Without that overview you cannot meet the rest. Second, your employees need to know how they are allowed to use the tools, with which data and with which data never. That is the core of AI literacy under Article 4, which has applied in a lighter form since July 2026. Third, if customers talk to your AI or you publish realistic AI images, that must be recognisable.
What the law does not ask of you, but is sensible: ask your suppliers how they comply with the AI Act and the GDPR. For most tools that is not a legal obligation for you, but it is the fastest way to see where you are at risk.
On paper that sounds simple. In practice it rarely is. Ask around on any working day which AI tools are active internally at your firm. Chances are the list is longer than you think and that a few of those tools appear in no contract or policy anywhere.
The question the law asks is the same question you should be asking yourself
Which AI do we use, who is responsible, which client data passes through it, and what happens if a tool drops out or makes a mistake. That is not a legal exercise. That is operational hygiene, and it should have been done long ago, independent of Brussels.
For professional-services firms specifically, this weighs more heavily than for other sectors. A mortgage adviser, estate agent, insurance firm or accountant processes sensitive personal data by definition. Citizen service numbers, financing files, claims, purchase agreements, valuation data. If that data has been outside the building via an unofficial ChatGPT prompt, that is not an AI experiment, that is a GDPR incident in the making.
Where the law and practice meet
At the intersection of the AI Act and operational work sits the AI audit. Not as a legal product, but as a baseline. An audit answers three questions at once in 14 days. Which AI tools are running at your firm, official and unofficial. What is the risk of each of them, both legally and operationally. And, usually the pleasant surprise, where is the time saving you are currently missing.
An example we see often. A mortgage firm processes 60 financing requests per day. The advisers use three different AI tools on their own initiative to summarise files. Nobody on the management side knows which ones. An audit brings that into view, classifies the risk per tool, scraps two tools that are not GDPR-proof, and identifies which four processes can almost immediately free up 50 to 100 hours per month if you set them up officially and under control.
What comes after the audit
The audit is not the final stop. It is the inventory from which three paths follow. Option one, you get to work on the roadmap yourself, small steps, your own pace. Option two, you have us implement the first use case as a five-to-eight-week project, see also our page on custom AI software. Option three, an AIOS engagement in which we stay connected as a structural partner and keep developing the AI layer underneath your organisation.
Which path you choose depends on your company stage and on what the audit surfaces. But without that baseline, every subsequent decision remains a gut-feel gamble. AI that works in your field starts with knowing what is running at your firm.
The first step
The rules already apply, and Dutch supervision will formally get its powers in the coming period. That is plenty of time to do an audit, process the report and pick up the first priority. Not enough to put it off for another year.
Fourteen days from the interview day, a fixed price, a report with 8 to 15 scored opportunities, a priority list and a follow-up proposal. Eight to ten hours of time investment on your side. After that you know what is running, where the risk sits and which three processes should be tackled first.
