Are you ready for the AI Act?

1. Which dates really matter?

Two above all, 2 August 2026 and 2 December 2027, in a timeline that has four. Regulation (EU) 2024/1689, known as the AI Act, has been in force since 1 August 2024¹. Regulation (EU) 2026/1744, known as the AI “Digital Omnibus”, published in the Official Journal on 24 July 2026, moved part of its timeline².

Two other dates are circulating, and they are wrong for admission. 2 December 2026 concerns machine-readable marking, an obligation of the provider. In August 2027, nothing applies to Annex III (in the original timeline, that was the date for Annex I, postponed to 2 August 2028 by the omnibus).

Check which date appears in the latest minutes of your senior leadership team.

2. Are your uses high-risk?

It depends on what they do. The Regulation classifies uses, never an entire sector. Annex III, point 3, “education and vocational training”, names four³:

(a) AI systems intended to be used to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels;

(b) AI systems intended to be used to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in educational and vocational training institutions at all levels;

(c) AI systems intended to be used for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within educational and vocational training institutions at all levels;

(d) AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels.

The criterion comes down to one question: what does the system do to the person? If it determines access, evaluates learning outcomes, steers a study path or monitors an exam, it is in the annex. If it provides information, checks that a file is complete or helps write a text without evaluating anyone, it is not.

Three cases you probably have in your institution:

1. 1)Your student records office's assistant provides information (opening hours, documents required, where to submit a file). It is outside Annex III. The same assistant comes within it if it steers a student towards a study path or handles a request for an exemption. This change can come from a single modified instruction: without a dated sheet of uses, nobody sees it.
2. 2)A syllabus drafting aid offers a text to the teacher, who uses it or not. It stays outside Annex III as long as it evaluates nobody.
3. 3)An admissions process in which agents read applications, rank them and reject some is in Annex III. An admissions process in which agents check completeness, request missing documents and prepare a summary sheet for a committee that decides comes closer to support for case review. Only take it out of Annex III on the basis of a written qualification approved by your legal counsel; until then, treat admission as a high-risk use: the agent prepares and records, the committee decides.

Whatever the category, have each decision approved by a person. For a high-risk use, an inspection will ask you to prove it: at which step a person approves, who, with the right to refuse.

3. What does the law require of you as a deployer?

The provider designs the system; you, the deployer, use it. For a high-risk system, Article 26 sets out your obligations; here are five of them⁴:

1. 1)Use the system in accordance with the instructions for use that the provider must give you (Article 13: what it does, its limits, how to monitor it). Ask for them before signing.
2. 2)Assign human oversight (Article 14) to people with the necessary competence, training and authority, including to override and stop the system. An administrator who cannot reject a draft does not exercise this oversight.
3. 3)Keep the logs that the system generates automatically, for at least six months (paragraph 6). This is a minimum; your records retention rules and your DPO set the actual period.
4. 4)Inform workers' representatives and the staff concerned before putting the system into service (paragraph 7). The text does not require this to be in writing; a dated memo proves that the information came before the system went into service.
5. 5)Inform applicants and students that they are subject to such a system, when it takes or helps take a decision concerning them (paragraph 11).

A public institution in France must also state, on any individual decision taken on the basis of algorithmic processing, that this is the case⁵. Examine a refusal of admission prepared with agents from this angle.

Article 50 applies to any system that interacts directly with people, high-risk or not, and it already applies. The provider must design the system so that the person knows they are interacting with an AI, at the latest at the first interaction. Check that the notice appears on your own channels (website, messaging, replies to applicants). Saying how to reach a person goes further than the text requires and takes one line.

4. What will an inspection ask for first?

The list of your agents. When each department adds its own without a shared list, nobody can say which ones are compliant. An inspection will therefore start with the sheet of uses: each agent in service or on trial, what it does, its category (Annex III or not) justified in one sentence, dated and signed. Set the rule: no agent goes into service without appearing on it.

It will then ask for seven written documents:

1. 1)The three names per agent: who designs it (instructions and access, every version kept), who monitors it (reads the log, can stop the agent), who signs off what goes out. The article “How should you govern your AI agents?” sets out the method.
2. 2)The human approval step on the process map: which step, by whom, within what time, with the right to refuse.
3. 3)The training record of those who approve (Article 26(2)).
4. 4)The log: what it contains (what the agent read, what it produced, who approved or rejected), how long it is kept, who can export it.
5. 5)The transparency notice, visible at the moment of the interaction (a line in the terms and conditions informs nobody at the first interaction).
6. 6)The information file: the dated memo to staff from before the system went into service, the notices to applicants and students, the Article 27 impact assessment if you are required to carry one out.
7. 7)The provider's instructions for use and the contract that sets the intended purpose (for example, that the system is not used as a decisive criterion for admission).

Most fit on one page. The lead named in action 2 below drafts them and keeps them up to date with the DPO.

Do not wait for a text specific to agents. The exploratory note published on 20 July 2026 by the CNIL and the CIANum (Conseil de l'IA et du Numérique) points out that the GDPR and the AI Regulation already apply to agentic AI, with arrangements to be adapted⁶. Among the risks it names: loss of control over personal data, hyper-personalised profiles, greater decision-making autonomy, responsibilities shared among several parties, and cybersecurity risks extended to all connected services. An agent that cross-references attendance, grades and late payments to identify a student in difficulty builds a profile, even if it only alerts an advisor. Your DPO must have examined it before the first piece of data is processed.