The Two-Month Wall: Regulation and Open Models Converge
The EU AI Act's high-risk obligations arrive in August 2026 with no SME exemption, while open-weight models cut the cost of sovereign deployment to CPU-only hardware.
8 June 2026 — Two forces met this week, and they arrived from opposite directions.
The first is regulatory. The EU AI Act's obligations for high-risk systems become fully enforceable in August 2026, and there is no small-business exemption. If a company uses AI to screen job applicants, evaluate employees, score credit, or gate access to essential services, it is operating a high-risk system — regardless of how many people it employs. The requirements are not exotic: a documented risk-management process, data governance, event logging, human oversight by design, and adequate cybersecurity. Each of them is an obligation to produce evidence, and evidence takes time to assemble.
The second force points the other way. The past week produced an unusually dense wave of open-weight releases that undermine the idea that capable AI requires renting a frontier model from a California vendor. Meta's Llama 4 Scout carries a ten-million-token context window. MiniMax M3 delivers frontier-tier coding with computer use at 59.0% on SWE-Bench Pro. Kimi K2.6 supports up to a hundred parallel sub-agents on a trillion-parameter mixture-of-experts backbone. GLM-5.1 is tuned specifically for long-horizon agentic workflows. And Microsoft's BitNet b1.58 — a one-bit weight architecture — makes the economics interesting for the first time: reasoning models running on cheap, CPU-only servers, cutting hosting cost by an order of magnitude while keeping data on premises.
In the United States, a new executive order pushed the same direction from underneath: critical-infrastructure hardening against AI-orchestrated attacks, hardware-backed identity as the anchor for human-to-agent authentication, and a widening patchwork of state-level rules in California, Colorado and Illinois around automated decision-making.
What this means if you run an SME. The compliance clock and the cost collapse are running simultaneously, and they favour the same architecture: private, local-first, documented. The businesses that will find August uncomfortable are the ones that adopted third-party AI tools quietly over the last two years and cannot now produce a list of what they run. Build the inventory first. Everything else — the risk classification, the logging, the oversight design — depends on knowing what you actually have.
This is the first in a weekly series reviewing the developments that matter to small and mid-sized organisations.