EU AI Act: transparency rules apply today, but France still hasn’t named who enforces them

August 2, 2026 is the date every AI Act briefing this summer has circled: the regulation’s Article 50 transparency obligations — disclosing that a customer is talking to an AI, labeling AI-generated content — become fully applicable today, untouched by the Digital Omnibus’s postponement of high-risk rules. What gets far less attention is a second date tied to the same regulation: Article 70 required every EU member state to designate its national competent authorities and market surveillance authority by August 2, 2025 — exactly one year ago. France missed that deadline, and one year later, it still has not caught up.

What France actually has — a draft, not a law

On September 9, 2025, the Direction générale des entreprises (DGE) and the DGCCRF jointly published a proposed governance scheme: the DGCCRF as coordinator and single point of contact, the CNIL for biometrics and personal-data processing, Arcom for deepfakes and generative-content transparency, the ACPR for high-risk financial systems, and ANSSI for cybersecurity. It is a sensible, decentralized design that leans on regulators that already exist. It is also, eleven months later, still a bill awaiting a parliamentary vote — not a designation. As of today, no French authority formally holds the power to inspect an AI system under this regulation.

Why the void doesn’t buy you time

A directly applicable EU regulation binds every company operating in France whether or not the national administrative machinery around it is finished — the absence of a French single point of contact does not suspend Article 50, it only leaves open who, domestically, will show up to check. A 2009 study by Christoph Engau and Volker H. Hoffmann on firms’ responses to regulatory uncertainty around post-Kyoto climate policy found that companies rarely benefit from a wait-and-see posture during an institutional gap: most respond by adapting their internal processes early rather than postponing, since the underlying obligation — not the identity of the inspector — is what eventually gets enforced, often retroactively once the missing authority is in place.

What it means for your SMB

If your business runs a customer-facing chatbot, a WhatsApp sales agent or any AI assistant your customers talk to, the disclosure obligation is live today regardless of who in France ends up checking it — and regardless of whether that inspector turns out to be Arcom, the DGCCRF, or a body not yet on anyone’s list. This is exactly the kind of moving regulatory target — an obligation that is live, an enforcer that is not — that a regulatory watch agent is built to track for you: it reads the official texts (JORF, entreprises.gouv.fr) rather than press summaries, and flags the day France’s designation bill actually passes, instead of leaving you to notice it months later.

• →Do not wait for France to name its AI Act authority before complying with Article 50 — the obligation applies today, independent of who inspects it domestically.
• →Audit every customer-facing AI touchpoint — support chatbot, WhatsApp sales agent, voice assistant — for a clear, first-message AI disclosure.
• →Keep a dated log of your compliance steps regardless of enforcement uncertainty: whichever authority France eventually designates will inherit whatever paper trail already exists, and read its absence as evidence of inaction, not caution.
• →Track the parliamentary vote on France’s national-authority bill through official channels rather than headlines — a regulatory watch agent can do this continuously so the news reaches you the week it happens, not the month after.

The comfortable reading of today’s date is “the rule is here, but nobody polices it yet in France.” The research on regulatory uncertainty suggests the opposite lesson: the gap closes eventually, and the companies caught out are rarely the ones that complied early — they are the ones that read the institutional void as permission to wait.