The AI Rules Land on 2 August. Most People Do Not Know They Are Covered.

there is a date coming that almost nobody outside compliance is talking about. on 2 August 2026, the EU AI Act's most consequential provisions take effect. high-risk system requirements, transparency obligations and enforcement mechanisms all switch on at once.

the assumption is that this is an engineering problem, or a legal one, and that somebody senior will handle it. that assumption is wrong in a specific way that matters if you use AI in your job, which at this point is most people in marketing, creative, HR and operations.

the obligations do not land where you think

the law is not written around who built the system. it is written around what the system does and who is affected by it. so the exposure follows the use case, not the job title.

that means the person running AI-assisted screening in a hiring process is inside the scope of something, even though they did not build the screening tool. so is the person using generative AI to produce customer-facing claims. so is anyone using it in a way that shapes a decision about a person, which covers far more of the average marketing or ops week than people assume.

the practical consequence is that obligations around documentation, transparency and human oversight land on the people running the process, and those people mostly do not know it yet. the frameworks this all runs on, the NIST AI Risk Management Framework, ISO/IEC 42001 and the Act itself, are not engineering documents. they are process documents. reading one and applying it to a business is closer to operations than to code.

the reason nobody has told you

because there is nobody to tell you. 77% of organisations are actively building AI governance programmes, rising above 85% among those already deploying AI. only 1.5% report being satisfied with their current governance headcount.

read that gap properly. it does not mean companies are ignoring this. it means they have started and they do not have the people, so the work is landing on whoever is nearest to the AI use case. that is usually the person operating it, not a specialist. if you have been quietly using AI to do half your job faster, you may already be the nearest person.

what this is actually worth to you

this is the part that makes it worth ten minutes rather than a shrug.

when an obligation exists and nobody owns it, the person who can describe it clearly becomes valuable in a way that is hard to argue with. not because they are compliant, but because they removed a risk nobody else had named. that is the kind of contribution that gets remembered at review time, and it is very different from being reliable and thorough, which is the thing that stopped commanding a premium.

there is also a defensive version. if AI use in your area does turn out to be in scope and nobody documented it, the questions land somewhere. better to be the person who raised it than the person who was running it.

and if you freelance or work fractionally, this is straightforwardly commercial. clients deploying AI in regulated contexts need someone who can evidence how it is being used. that is a service you can charge for, and it did not exist as a line item eighteen months ago.

the workflow: check your exposure in ten minutes

step one. open Claude or ChatGPT and paste in your job description, or a plain list of what you actually do in a week. ask it: which of these tasks involves an AI system making or influencing a decision about a person, and which of those would fall under the EU AI Act's high-risk categories.

step two. take what it flags and ask a follow-up. for each of these, what documentation or human oversight would the Act require, and who in a company my size would normally own that.

step three. run your own company through Perplexity. search the company name alongside AI policy, AI governance and responsible AI. you are looking for whether anything public exists. if nothing comes back, that is the finding, because it means nobody has been given this yet.

step four. the useful output is the gap between what step two says is required and what step three says exists. write that gap down in three lines. that is not a compliance document, it is a conversation with your manager, and it is a considerably better one than asking for a pay rise on the grounds of having worked hard.

the window

the requirement relaxes when demand outruns supply, and it tightens again when it does not. right now the people who understand this are scarce enough that noticing counts for something. in three years there will be a profession, a certification path and a queue, and noticing will count for nothing because everyone will have noticed.

which is a strange thing about timing generally. the advantage is never in the information itself, it is in how few people currently have it.