Enforcement is running, national supervision is not. What that means for you.

This analysis first appeared as the weekly Praxikon newsletter.

<h2>September opens with a supervision gap</h2> <p>Since 2 August the Commission has been enforcing the GPAI rules and Article 50 applies. But anyone who went looking for their national AI supervisor this summer mostly found a construction site. In the Netherlands, the implementation act that designates ten existing supervisors, with the AP and RDI as coordinators, has still not been submitted to parliament after its consultation closed on 1 June with thirty responses. And the mandatory national regulatory sandbox, which had to be operational by 2 August 2026, was pushed back a full year by the Digital Omnibus: Article 57 now says 2 August 2027.</p> <h2>What does this mean for your organisation?</h2> <p>Do not mistake the gap for a delay of your own obligations. Three things do not depend on the national pace. The Commission enforces the GPAI obligations itself, directly from Brussels, with fines of up to 3% of turnover. The prohibited practices and Article 50 simply apply, with or without a designated national supervisor: the law is there, only the counter is not open everywhere yet. And existing supervisors such as data protection authorities can already act within their current mandate, for instance under the GDPR, against AI applications that also touch personal data.</p> <p>The gap does have one practical consequence: for now there is nobody to check your homework officially. No sandbox to test your approach in, no counter answering your questions. Whatever you do in the coming months, you must be able to substantiate yourself, with your own records. When supervision does get up to speed, it will look back at what you documented now.</p> <h2>More nuanced than it looks: the sandbox moves, your evidence does not</h2> <p>The one-year delay for the sandbox is not a one-year delay for you. The sandbox is a facility for providers who want to test something, not a precondition for compliance. Participants will get something valuable: under Article 57, those who follow the sandbox plan in good faith receive no administrative fines for infringements of the regulation during that period, and the exit report counts towards conformity assessment. That makes the sandbox worth watching for anyone building a high-risk system towards 2 December 2027. But until then, your own records are all that counts.</p> <h2>Action for this week</h2> <p>September is when plans for next year are made. Record one thing this week: which of your AI applications fall under the rules that already apply (Article 50 transparency, the prohibited practices, the Article 4 duty to take AI literacy measures) and what evidence you hold per application. One page per application is enough: what the system does, which rule applies, what you have arranged, who checked it. That page is exactly what a supervisor will ask for first.</p> <p>Which rules started applying when, and what has shifted since the Digital Omnibus, is tracked by Praxikon in the <a href="https://www.praxikon.com/en/wijzigingen">AI Act change timeline</a>, with the official source for every change.</p> <p>You receive this weekly AI Act update because you signed up with Praxikon, formerly Praxikon, or used one of our tools or templates. You can unsubscribe with one click at the bottom.</p> <p>Until next Tuesday.<br/>Zahed Ashkara<br/>Praxikon</p>