Why 'is AI regulated yet' is the wrong question for EU buyers

IT buyers evaluating AI vendors keep collapsing a set of different legal instruments into a single question: is AI regulated yet? That question has no single answer, because a transparency duty, a high-risk-system annex, a public-procurement rule and an executive order do not take effect on the same date, for the same people, or with the same force. The EU AI Act's Article 50 transparency duty, for instance, entered into application on August 2, 2026, with a grace period to December 2 for systems already on the market before that date — a specific, dated obligation that applies to providers and deployers, not a blanket statement that "AI is now regulated." Treating every such instrument as one clock leads to two opposite mistakes: freezing a project that remains lawful, or making a compliance claim that will not survive scrutiny.

Three clocks, not one

One clock marks when a duty becomes legally enforceable. A second marks when a buyer in a public tender starts asking vendors for evidence of compliance, which can arrive well before or after the legal deadline. A third is political mood — speeches, draft guidance, agency blog posts — which moves headlines and, sometimes, markets, but does not amend a statute on its own.

How to read a policy headline

• Name the instrument: is this an act, an annex, an executive order, a technical standard, or a speech?
• Name the subject: does the obligation fall on the provider, the deployer, the importer, or the buyer?
• Name the verb: does it require disclosure, registration, assessment, prohibition, or a procurement condition?
• Name the date from the primary legal text, not from a summary or newsletter.

Where residency and latency fit

Data residency is a matter of policy and contract; latency is a matter of network topology and model size. The two get conflated constantly, but they answer different buyer questions and should be addressed with measurable requirements rather than marketing language. For MSPs comparing where to run inference for EU customers, that split — plus a clear answer on who can access logs and what an exit looks like — matters more than which vendor claims the loudest sovereignty label. Altovar's Lodestar is one option for teams that want an EU-based control plane for that kind of routing decision, without treating it as a substitute for reading the underlying instrument.

A serious compliance answer cites the primary document, states plainly what it does not decide, and never turns a voluntary code into a fine or a marketing claim into a certification.

Sources: EU Artificial Intelligence Act — Article 50 transparency obligations.