The EU AI Act is a deployment deadline, not a memo.
What it requires, when each obligation applies, and how to be ready — explained for executives, not lawyers. The honest version: most obligations apply from 2 August 2026, and several proposed deferrals are not yet binding.
When it applies
Plan to the live date. Treat the proposed deferrals as provisional until the Official Journal confirms them.
GPAModel & governance obligations apply
General-purpose AI model rules and the bulk of the Act's obligations become applicable. This is the date that binds today — plan to it.
Transparency / watermarking (proposed deferral)
Marking of AI-generated content. A deferral has been proposed — it binds only if and when published in the EU Official Journal.
High-risk · Annex III (proposed deferral)
High-risk systems listed in Annex III (e.g. employment, credit, essential services). Deferral proposed; not yet binding until OJ publication.
High-risk · Annex I (proposed deferral)
High-risk systems tied to regulated products under Annex I. Deferral proposed; same caveat — confirm against the Official Journal.
How to get ready
The same four moves that make AI defensible also make it deployable: inventory, classify, evidence, govern.
Know what you run
Catalogue every AI system in use or in build, and classify each by risk tier. You cannot govern what you haven't listed.
Map to obligations
Tie each system to the obligations that apply to its risk tier and timeline — prohibited, high-risk, limited, or minimal.
Build the audit trail
Document data sources, testing, human oversight, and decisions. Evidence is the difference between a claim and a defensible position.
Gate and monitor
Put human oversight, logging, and a kill-path in place before deployment — governed autonomy, not autopilot.
Know where you stand?
Start with the AI Transformation Diagnostic to see where governance is your bottleneck, then book a working session to map your systems to the Act.
Book a readiness session →