EU AI Act readiness
The AI Act rewards organisations that know what they run. Inventory first, classification second, paperwork last — the reverse order is how programmes stall.
By Piotr Zenon Żabrowski · Published · Updated
Sequence
01Inventory
Every AI system: built, bought, and embedded in SaaS you already pay for. Include shadow usage found via egress and SaaS admin data.
02Role
For each system decide whether you are provider, deployer, importer or distributor — obligations differ sharply.
03Risk tier
Classify: prohibited practice, high-risk, transparency-obligation, or minimal risk.
04Obligations map
Map tier and role to concrete obligations: risk management, data governance, logging, human oversight, technical documentation, transparency notices. ISO/IEC 42001 is a common structural reference for the risk-management and documentation parts of this step, though certification against it is voluntary and does not by itself satisfy the legal obligation.
05Evidence
Wire the evidence into systems that already run — logs, change records, review approvals — instead of a document set that ages instantly.
06Gate
Put an intake gate in front of new use cases so the inventory stays true.
Timelines move; the underlying obligations mostly do not
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices banned (in force, unaffected by later amendments) |
| 2 August 2025 | GPAI model provider obligations and governance rules apply (in force) |
| 2 August 2026 | Original date for Annex III high-risk system obligations — superseded by the Digital Omnibus deferral below |
| 2 December 2027 | Deferred Annex III high-risk system deadline, per the Digital Omnibus adopted by Parliament (16 June 2026) and Council (29 June 2026) — now in force |
| 2 August 2027 | Original date for the remaining high-risk obligations under Annex I product-safety legislation — also deferred, see below |
| 2 August 2028 | Deferred Annex I high-risk deadline under the same Digital Omnibus text — now in force |
1Internal control set
- Access control
- Logging
- Third-party risk
- Resilience testing
2Mapped to
- DORA
- NIS2
- ISO 27001
- GDPR
- EU AI Act
3Evidence source
- Cloud config
- Identity logs
- Change records
- Test reports
4Output
- Audit evidence pack
- Gap register
- Remediation plan
Frequently asked questions
Does the AI Act replace GDPR duties?
No. They stack. AI Act obligations sit on top of existing data-protection duties for personal data.
Where do most companies underestimate effort?
Vendor-embedded AI. Features arrive in tools you already own, without a decision anyone remembers making.
What actually changed with the Digital Omnibus?
The EU's Digital Omnibus package was adopted by the European Parliament (16 June 2026) and the Council (29 June 2026) and is now in force. It defers the Annex III high-risk system deadline from 2 August 2026 to 2 December 2027, and the Annex I product-safety high-risk deadline from 2 August 2027 to 2 August 2028. Prohibited-practice bans (in force since February 2025) and GPAI transparency duties (in force since August 2025) are untouched. The dates moved; the inventory, role determination and risk classification work does not depend on them and should proceed regardless.
Related
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
Compliance
Turning DORA, NIS2, ISO 27001, GDPR and the EU AI Act into one control set with reusable evidence and aligned reporting clocks.
LLM security controls
A control checklist for enterprise GenAI: data handling, retrieval isolation, agent authority, cascading-failure containment, monitoring, cost limits and vendor terms.
High-risk AI system
An AI system placed in the EU AI Act's high-risk tier, triggering risk management, data governance, logging and human-oversight obligations.
DORA, NIS2 and the AI Act
A control-level comparison of DORA, NIS2, the EU AI Act, ISO/IEC 42001 and ISO 27001 — what you can evidence once and reuse across all of them.
AI governance checklist
A printable checklist for establishing AI governance: inventory, classification, policy, review gate and evidence, mapped to the EU AI Act and NIST AI RMF.