Field Notes · Note 004 · AI Act

AI Act: where
160 real AI uses fall.

By Baptiste Pigaux24 October 20267 min read

The AI Act is scary because it is discussed through its fines and banned uses. Set against companies’ real uses, the picture is simpler: most have no specific obligation, a significant share simply has to say that an AI is answering, and a small minority touches high risk. A reading of the 160 use cases in Acolyte, HOCUS’s catalogue.

The question

For a company that uses AI without building it, what does the AI Act concretely change in 2026 and 2027?

What we observed

Acolyte’s indicative reading as of 24 October 2026, with cautious rules based on each case’s sector, function and description. Not legal advice.

The data

Acolyte’s 160 cases cover SMEs, mid-sized companies and large groups, in sixteen sectors; 119 are documented by a public source. Each record carries a reading of its risk level, computed with the same rules for all:

• possible high risk when the AI assesses people or weighs on a decision about them in an Annex III area (employment, credit, life and health insurance, education, public services), or gives medical advice;
• transparency when it converses with customers or users, or generates content shown to the public;
• minimal risk for the rest.

The method

The regulation does not target a technology but a use. Three questions are enough to place your own:

1. Does the AI decide something about a person?Sorting applications, granting credit, setting a health insurance premium: that is high-risk ground. Summarising a meeting is not, with the same model.
2. Does it talk to someone, or publish?A chatbot, a voice agent, generated content put online: it must be disclosed (Article 50).
3. Are you a provider or a deployer?Most companies use a system designed by someone else. The heaviest obligations fall on the provider; the deployer keeps its own: instructions, human oversight, logs.

What the reading shows

1. The obligation that matters now is transparency

Since 2 August 2026, a person must know they are dealing with an AI, and generated content must be flagged. In the catalogue, 23 of the 27 cases concerned belong to customer service. It is a simple obligation, but it already applies, and it follows the adoption of agents: nearly one documented agent in two is subject to it.

2. High risk is rare, and it has been postponed

Regulation (EU) 2026/1744, known as the “digital omnibus”, in force since 27 July 2026, pushed back high-risk obligations: to 2 December 2027 for Annex III uses (employment, credit, education…), and to 2 August 2028 for AI built into regulated products. In the catalogue, only three cases come close, and two concern recruitment: that is the function to look at first.

3. For an SME, the essentials fit in four actions

Of the 10 documented SME cases, 9 are minimal risk and 1 falls under transparency. For most uses, the AI Act mainly asks you to know what you use, rule out banned practices, train teams (Article 4, since February 2025) and say when an AI is answering. The GDPR, for its part, applies fully as soon as personal data goes through the AI.

4. The next dates

2 December 2026: two new bans (intimate images without consent, child sexual abuse material) and content marking for generative systems placed on the market before August 2026. 2 August 2027: older general-purpose AI models must comply. 2 December 2027: high risk, Annex III. 2 August 2028: high risk, Annex I.

The limits

What to do about it

Do not wait for 2027 to take stock: the inventory is what tells you whether you are affected. In practice:

1. This monthList AI uses, including tools teams picked up without a framework, and note for each: who provides it, what data, who is affected.
2. Before DecemberCheck every chatbot, agent and published generated content: the “you are talking to an AI” notice and the flagging of content.
3. In 2027For uses in recruitment, credit or insurance: the provider’s instructions, human oversight by a trained person, logs kept, staff informed.
4. ContinuouslyTrain teams and apply the GDPR: purpose, minimisation, informing people.

Frequently asked questions

Baptiste Pigaux founded HOCUS after more than 20 years turning data and machine learning into business decisions, for more than 30 organisations. LinkedIn profile