Updated 23 September 2026. This post first ran in June, before the timetable changed. In July 2026 the AI Digital Omnibus deferred the high-risk obligations, so a good deal of what is still online about "August 2026" — including the original version of this piece — is now wrong. This is the corrected version.
Most Belgian business owners I talk to are working from a timetable that no longer holds. The high-risk obligations everyone was told would land in August 2026 were deferred: to 2 December 2027 for stand-alone systems, and 2 August 2028 for AI built into already-regulated products.
What did not move is the transparency regime. Since 2 August 2026 you have to tell people when they are dealing with an AI system, and mark AI-generated content. That part is live right now — and it is the part most Belgian companies have not looked at, because everyone was watching the deadline that moved.
I'm not a lawyer, and this isn't legal advice. I'm an engineer who builds and audits AI systems for Belgian companies, and I spend a lot of my week explaining what this regulation actually means once you strip away the legalese. This is the version I give to operations directors and CEOs who don't have a compliance department.
The part almost nobody knows: the literacy obligation is already live
Here's the one that surprises people. Since 2 February 2025, Article 4 of the AI Act has required that any organisation using AI systems ensures its staff have a sufficient level of AI literacy.
Not "should consider." Required. As of over a year ago.
In practice this means: if your team uses AI tools — and almost every Belgian company now does, even if it's just staff pasting things into ChatGPT — you are expected to be able to show that those people understand, at a basic level, what the tools do, what their limits are, and what the risks are.
There's no certificate to buy and no government inspector knocking on your door tomorrow. But the obligation exists now, and the simplest way to meet it is also the cheapest: a short internal AI usage policy plus a basic briefing for the team. Most companies have neither. If you do nothing else after reading this, do that.
The timeline, in plain language
- February 2025 — in force. Banned AI practices (social scoring, certain manipulation, untargeted face-scraping) are prohibited. The AI literacy obligation (Article 4) applies.
- August 2025 — in force. Rules for general-purpose AI models (the big foundation models) and the governance structure.
- 2 August 2026 — in force, and this is the live one. Article 50 transparency: you must disclose that a person is interacting with an AI system, label deepfakes, mark AI-generated content in machine-readable form, and give notice where you use emotion recognition or biometric categorisation. Transparency breaches sit in the tier carrying fines up to €15 million or 3% of worldwide turnover.
- 2 December 2026. End of the grace period for machine-readable marking of AI-generated content on systems that were already on the market before 2 August 2026.
- 2 December 2027. Obligations for stand-alone high-risk AI systems (Annex III) — deferred from August 2026 by the Digital Omnibus.
- 2 August 2028. High-risk rules for AI built into already-regulated products (Annex I).
So the question that matters in 2026 is no longer "do I have high-risk AI." It is: does anyone dealing with my company know when they are talking to a machine? The high-risk work still has to happen. It just has a later date on it now.
"High-risk" — does it apply to you?
"High-risk" is a specific legal category, not a judgement about how advanced your AI is. A simple, well-built system can be high-risk; a flashy one might not be.
You're likely in high-risk territory if you use AI for:
- Hiring and HR — CV screening, candidate ranking, performance evaluation, decisions about promotion or termination. This is the one that catches the most Belgian SMEs by surprise, because HR teams adopt these tools without realising the classification.
- Credit and insurance — creditworthiness scoring, risk pricing.
- Access to essential services — anything that decides who gets what.
- Safety components — AI in critical infrastructure or as a safety function in a product.
If your AI just summarises documents, drafts emails, powers a chatbot that's clearly labelled as AI, or recommends products — you're almost certainly not high-risk. You have lighter transparency duties (mainly: tell people when they're talking to AI) and that's it.
The honest answer for most Belgian KMOs: you're probably not high-risk, but you can't assume it — you need to actually check the one or two systems that might be, and write down the conclusion. (I'll write a separate piece on exactly how the classification works.)
Who enforces this in Belgium?
This is where Belgian businesses get lost, because the EU writes the law but each member state names its own enforcers. In Belgium, two bodies matter:
- BIPT (the telecoms/digital regulator) has been designated as a key part of Belgium's market-surveillance setup for the AI Act. They're the AI-Act-specific authority.
- The GBA / APD (the Data Protection Authority — Gegevensbeschermingsautoriteit / Autorité de protection des données) handles where AI meets personal data. They published formal guidance on AI and the GDPR in December 2024, which tells you they're already paying attention.
You don't need to memorise this. You need to know that "no one is watching" is not true, and that AI + personal data has two sets of rules pointing at it (AI Act and GDPR), not one.
The checklist I actually give people
If you do these five things, you're ahead of the large majority of Belgian companies:
-
Inventory your AI. List every AI tool and system in use — including the unofficial ones your team adopted on their own. You can't comply with rules about systems you haven't named. This single step takes an afternoon and surfaces surprises every time.
-
Classify the risky ones. For anything touching hiring, credit, access to services, or safety — determine whether it's high-risk, and write down the reasoning. For everything else, note that it's minimal/limited risk and move on.
-
Write a one-page AI usage policy. What's allowed, what isn't, what data must never be pasted into a public AI tool, who to ask. This is your cheapest single compliance win and it doubles as your Article 4 literacy evidence.
-
Brief your team. Fifteen minutes. What the tools do, where they're wrong, what not to feed them. That's the literacy obligation, met.
-
For genuine high-risk systems, get a real assessment. Documentation, logging, human oversight, bias testing — these are substantial and they need to be in place before 2 December 2027, not bolted on after. The deferral bought you time to do it properly; it did not remove the obligation. Don't improvise this one.
Steps 1–4 you can do yourself this month — and step 3 now has a second job, because your policy should also say how you disclose AI to customers, which is the Article 50 obligation that is already live. Step 5 is where it's worth getting help, because the cost of getting it wrong is regulatory, not just operational.
The honest bottom line
The EU AI Act is not the catastrophe some vendors are selling it as (conveniently, alongside the expensive product that "solves" it). For most Belgian KMOs, compliance is a few hours of honest inventory, a one-page policy, a short team briefing, and being straight with people about when they are talking to a machine.
The exception is real high-risk AI — and if you have it, 2 December 2027 is your date. That is further off than it looked in June, which is precisely why it is worth starting now instead of rediscovering it in 2027.
The mistake I see is the two extremes: companies that panic and overspend on consultants for systems that were never high-risk, and companies that assume it doesn't apply to them and discover otherwise the hard way. The cure for both is the same: spend the afternoon, do the inventory, write it down.
I write a short, practical newsletter on exactly this — the EU AI Act, GDPR and AI, and senior engineering for Belgian businesses, in plain language and without the fear-selling. If that's useful to you, subscribe below.
There are also free templates to start from — an AI usage policy and an AI audit checklist, both written for Belgian businesses.
If you'd rather have someone go through your actual systems with you, WDC's AI Readiness Audit does exactly that — an honest, written review of what you're running and where it sits under the Act.