August 2, 2026: a less brutal deadline than expected
The European regulation on artificial intelligence (AI Act), which came into force on 1st August 2024, became applicable for the most part on 2 August 2026. For municipalities, departments and regions, this date was long presented as the one when all obligations on "high-risk" AI systems would apply at once. This is no longer the case.
The "omnibus" on AI, proposed by the Commission on 19 November 2025, adopted by the European Parliament on 16 June 2026 and entering into force on 27 July 2026, has pushed back this timeline. The rules applicable to high-risk systems in Annex III, which notably cover education, employment, access to essential public services or biometrics, will apply from 2 December 2027. Those targeting AI integrated into regulated products (machinery, toys, lifts, medical devices) will apply from 2 August 2028.
What already applies to local authorities
The postponement does not mean a pause. Several rules already apply:
- Prohibited practices (Article 5), in force since 2 February 2025, such as social scoring.
- Transparency obligations (Article 50), applicable since 2 August 2026: a user interacting with a conversational agent must, in principle, know that they are speaking to an AI. This is directly relevant for municipalities deploying chatbots on their website or switchboard.
The sanctions regime falls under the Member States. The AI Act also provides that each State determines for itself the extent to which fines may be imposed on public authorities and bodies (Article 99, paragraph 8). However, France has not yet completed this work: the draft law adapting to Union law (known as DDADUE), which notably designates the CNIL and the DGCCRF as supervisory authorities, was adopted by the Senate on 18 February 2026 but was still awaiting, at the beginning of October, its examination in the National Assembly.
What local authorities must prepare by December 2027
The additional deadline is primarily a preparation window. When a local authority uses a high-risk AI system under its own authority, it is legally a “deployer”. From December 2027, it will notably have to:
- use the system in accordance with its instructions and ensure effective human oversight by trained agents (Article 26);
- retain the logs generated by the system and inform the individuals concerned when the tool contributes to decisions affecting them;
- carry out, as a public law body, a fundamental rights impact assessment before the first deployment, and notify the results to the supervisory authority (Article 27). This assessment may be based on the impact assessment already required by the GDPR.
The provider, for its part, bears the bulk of the design obligations: risk management, technical documentation, CE marking. The burden is therefore not transferred to local authorities, but shared. Hence the importance of contracts: documentation, auditability, reversibility and traceability clauses, as recommended by a joint report from the IGF, IGAS and IGA published in 2026.
Very uneven adoption depending on size
This same report, dedicated to the deployment of AI in administrations, paints a clear picture: adoption is “broadly correlated with size.” 90 % of metropolitan areas have launched AI projects, while 73 % of municipalities with fewer than 3 500 inhabitants have none. It also notes that approximately 40 % of local authority staff use AI tools in an unregulated manner, according to a study by the National Union of General Directorates of Local Authorities (SNDGCT) from September 2025. This “shadow AI” is arguably the first concrete legal risk, well before the obligations on high risk.
The Senate had already warned about these issues in an information report from March 2025 dedicated to AI in local authorities, designed as a “survival guide” for local elected officials.
Who pays? Some aid exists, still limited.
The question of funding remains unresolved, but mechanisms are being put in place. On 21 May 2026, the Banque des Territoires launched the « Territoires d’IA » program, in partnership with Mistral AI. The goal by 2030: to support 100 000 public agents in the use of AI and to deploy 15 use cases that can be replicated across local authorities. The program includes an “IA Factory” with pilot local authorities and a co-financing window, open since 22 May 2026 for three years, which covers 30 % to 50 % of the purchase of sovereign AI solutions. The next day, the Minister of Action and Public Accounts, David Amiel, announced that the State, via DINUM, was joining the program.
These aids do not cover everything, and small municipalities, without a dedicated IT department, will remain the most exposed. But the revised timeline leaves them a little more than a year to do the essential: inventory the AI tools actually used, including those adopted by agents on their own initiative; qualify those that could fall under high risk; renegotiate the contracts concerned; and pool expertise, via management centers, joint unions, or public digital service operators.
The real question is therefore no longer whether the AI Act hits local authorities as early as 2026, but whether they will use this reprieve to establish AI governance before the heaviest obligations come into force.
Sources: European Commission, “The AI Omnibus enters into force”, 27 July 2026 ; European Parliament, 16 June 2026 ; AI Act, Article 27 and Article 99 ; IGF-IGAS-IGA Report, “The deployment of AI in public administrations”, April 2026 ; Senate, information report No. 447 (2024-2025) ; Banque des Territoires, 22 May 2026 ; Banque des Territoires, Territoires d’IA offers ; Ministry of Action and Public Accounts, 22 May 2026 ; AI Governance, 5 October 2026.
