EU AI Act Compliance Guide: What Organizations Must Do Before August 2026

What the EU AI Act is and why it matters now

As of June 2026: This guide describes the original, legally binding phase-in plan. The Digital Omnibus proposed by the European Commission on November 19, 2025 would shift the high-risk obligations under Annex III from August 2, 2026 to December 2, 2027 — but until it is formally adopted by the Council and Parliament, the original timeline remains authoritative. The prohibitions in force since February 2025 and the GPAI obligations effective since August 2025 are unaffected by the proposal. For the full picture, see our update "EU AI Act 2026: What the Digital Omnibus Delay Really Changes."

The EU AI Act — formally Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 — is the world's first comprehensive, legally binding regulation of artificial intelligence. Published in the Official Journal on July 12, 2024, it entered into force on August 1, 2024. Its most consequential obligations, however, phase in across four stages — and the decisive stage begins on August 2, 2026.

Unlike other EU regulations, the AI Act is not sector-specific. It is horizontal in scope, covering any organization that develops, distributes, imports, or deploys AI systems in the EU — regardless of where the organization is headquartered. Its legal basis rests on Articles 114 and 16 TFEU: internal market harmonization and personal data protection. Maximum fines reach €35 million or 7% of global annual turnover — exceeding the maximum penalties under the GDPR.

The extraterritorial reach is remarkably broad. Under Article 2(1)(c), providers and deployers outside the EU fall within scope whenever the output of their AI system is used within the EU — even without intentionally targeting the EU market. That is stricter than the GDPR, which requires deliberate offering of services to EU residents. A US SaaS company whose AI feature is consumed by a German customer is in scope.

The AI Act does not replace the GDPR, the Digital Services Act, or sector-specific product safety legislation. It operates alongside them. Where a violation infringes both the AI Act and another regulation, Article 99(8) applies only the higher fine — no stacking.

What of this concretely applies to your organization is clarified by our free EU AI Act readiness check — including the deadlines that actually apply after the Digital Omnibus.

The four risk tiers at a glance

The entire architecture of the AI Act rests on a risk-based classification system. Every AI system is assigned a tier, and obligations scale with it. Correct classification is the first and most important compliance step — misclassified systems either produce unnecessary work or lead to violations.

Unacceptable risk refers to practices banned entirely since February 2, 2025. Eight categories fall into this tier with no compliance pathway: subliminal or manipulative techniques distorting behavior; exploitation of vulnerabilities based on age, disability, or socioeconomic situation; social scoring by public authorities; criminal risk prediction based solely on profiling; untargeted scraping of facial images from the internet or CCTV; emotion recognition in workplaces and educational institutions (with exceptions for medical and safety reasons); biometric categorization to infer sensitive attributes like race or political views; and real-time remote biometric identification in public spaces for law enforcement.

High-risk AI systems form the regulatory core. Two paths lead to high-risk classification. Under Article 6(1), a system is high-risk if it is a safety component of — or itself is — a product covered by EU harmonization legislation in Annex I (medical devices, machinery, toys, vehicles, aviation, and others) that requires third-party conformity assessment. Under Article 6(2), a system is high-risk if it falls within one of eight domains in Annex III.

Limited or transparency risk applies to systems that interact directly with people or generate synthetic content. Chatbots must disclose that users are interacting with AI. Deepfakes must be labeled as artificially generated. Emotion recognition and biometric categorization systems must inform affected persons. These obligations apply from August 2, 2026.

Minimal risk covers the majority of AI systems — spam filters, recommendation engines, search tools. No mandatory obligations. The AI Office encourages voluntary codes of conduct under Article 95, but legal duties do not apply.

Who is affected: six roles across the AI value chain

The AI Act assigns obligations to six roles. Who bears which obligations depends not on the company name but on the functional position in the AI system's lifecycle. Organizations can simultaneously hold multiple roles — for example, as deployer of a pre-built AI and provider of a self-developed component.

What high-risk systems must do (Art. 9–15)

Providers of high-risk systems sit at the center of the regulatory architecture. Articles 9 through 15 describe the operational core obligations that must be met across the entire lifecycle — from design to post-market monitoring. Taking these articles seriously means building substantial engineering, documentation, and governance practices.

The implementation timeline: what applies when

The AI Act does not apply all at once. Under Article 113, obligations phase in across four stages. Compliance projects planning against the wrong deadline fail at the wrong time. Important: August 2, 2026 is the reference deadline for most obligations — less than four months away at the time of this article's publication.

GPAI: special rules for foundation models

General-purpose AI models — defined under Article 3(63) as models displaying significant generality capable of competently performing a wide range of tasks — are subject to a dedicated regime that has been applicable since August 2, 2025. GPAI models include the large language models from OpenAI, Anthropic, Google, Meta, and others.

All GPAI model providers must meet four core obligations under Article 53: technical documentation covering training and testing processes (Annex XI); information for downstream AI system providers about model capabilities and limitations (Annex XII); a copyright compliance policy in line with the Copyright Directive (EU) 2019/790; and publication of a sufficiently detailed summary of training data content, for which the Commission published a template in July 2025.

Models released under free and open-source licenses where parameters, architecture, and usage information are publicly available are exempt from documentation and downstream information obligations — but must still comply with copyright and training data summary requirements.

Penalties and enforcement

The fine structure of the AI Act is three-tiered and exceeds the GDPR's maximum penalties in the top tier. Enforcement operates at two levels: EU-wide through the AI Office in Brussels, and nationally through each member state's market surveillance authority.

10-step compliance roadmap

EU AI Act compliance is not a project with a start and end date — it is a continuous program. Organizations starting now have less than four months until the Phase 3 deadline. This roadmap synthesizes guidance from the EU AI Office, leading law firms, and consulting practice into a staged approach.

A note on ordering: steps are not randomly sequenced. No classification without inventory. No gap analysis without classification. No meaningful prioritization without gap analysis. Starting at step 5 produces documents that do not reflect reality.

1. 1Build an AI system inventory. Catalogue every AI system in use, under development, or sourced from vendors — including embedded AI in SaaS tools like CRM systems, HR platforms, or code editors. For each system: purpose, provider, geographic deployment, and your own role (provider, deployer, importer, distributor). Result: a centralized AI registry as part of the quality management system under Article 17.
2. 2Perform risk classification. Map each inventoried system against prohibited practices, Annex I, Annex III, and the transparency rules in Article 50. Document the classification rationale for every system, especially when relying on Article 6(3). Remember: profiling is always high-risk.
3. 3Conduct gap analysis for high-risk systems. For each high-risk system, compare current practice against Articles 9–15 requirements. Assess documentation, logging, human oversight, bias monitoring, data governance, and vendor contract provisions. ISO/IEC 42001:2023 and the NIST AI Risk Management Framework are proven crosswalk benchmarks.
4. 4Set up the governance structure. Establish a cross-functional AI governance committee with legal, compliance, engineering, risk management, and data protection. Designate an AI Risk Officer. Build the quality management system under Article 17: regulatory strategy, design processes, testing, data management, risk management, monitoring, incident reporting, accountability.
5. 5Prepare technical documentation. For each high-risk system, prepare documentation per Annex IV: system description, design choices, architecture, data requirements, training methodology, human oversight assessment, anticipated changes, applied standards, post-market monitoring plan. Must be complete before market placement.
6. 6Operationalize data governance. Document data lineage end-to-end, establish active bias monitoring, conduct data quality audits, and define policies for sourcing, cleaning, annotation, and validation. Ensure datasets are representative of the actual deployment context.
7. 7Establish a risk management system. Continuous risk identification covering both intended use and foreseeable misuse, with defined risk appetite, regular reviews, and documented mitigation decisions.
8. 8Operationalize human oversight and transparency. Design human-in-the-loop or human-on-the-loop mechanisms with clear escalation paths and override functions. Implement labeling, disclosures, and watermarking for transparency obligations.
9. 9Post-market monitoring and incident reporting. Establish proportionate monitoring systems collecting performance data across the system's lifetime. Register the system in the EU database before market placement. Observe incident reporting timelines: 15 days generally, 2 days for widespread or critical infrastructure incidents, 10 days for incidents involving death.
10. 10Ensure AI literacy. The Article 4 obligation has been in effect since February 2025. Develop tiered training programs for executives, developers, and operational staff. This is not a nice-to-have — it is already applicable law.

Common pitfalls in practice

In consulting practice, we see recurring patterns in EU AI Act projects. The following seven pitfalls arise not from negligence but from structural misreadings of the regulation. Knowing them allows systematic avoidance.

1. 1We are just deployers — ignoring Article 25. The most common misconception: organizations believe that buying pre-built AI systems exempts them from the provider role. But the moment the system is substantially modified — fine-tuning an LLM with proprietary data, integrating custom rules into a recruiting tool, changing the intended purpose — Article 25 kicks in and full provider obligations apply. This reclassification is the single largest source of underestimated compliance burden.
2. 2ChatGPT and Copilot rollouts without risk assessment. Many organizations roll out generative AI broadly without checking whether specific use cases are high-risk. An HR team using Copilot to pre-screen applications is no longer in productivity tool mode — it is operating a high-risk system for candidate pre-selection under Annex III point 4. The Article 4 AI literacy obligation applies regardless.
3. 3Treating AI literacy as a formality. The training obligation under Article 4 has been in effect since February 2025 and applies to every provider and deployer. Many organizations interpret this as a one-off e-learning. The regulation requires sufficient competence among staff — meaning role-specific training tied to the actual systems in use and their risk classification.
4. 4Waiting for harmonized standards. Harmonized standards under CEN-CENELEC JTC 21 are delayed. Many compliance projects wait until the standards are clear. This is a mistake: internal self-assessment under Annex VI is available for most Annex III systems without harmonized standards. Waiting costs preparation time and risks unpreparedness on August 2, 2026.
5. 5Equating GDPR compliance with AI Act compliance. GDPR and the AI Act overlap on personal data but regulate different things. The AI Act requires documentation of the entire development process, risk assessment for fundamental rights (not only data protection), and specific artifacts like the Fundamental Rights Impact Assessment. Saying we are GDPR-compliant, that covers it, underestimates the requirements.
6. 6Overlooking output-based extraterritoriality. Companies outside the EU often assume they are not affected. But Article 2(1)(c) rules: as soon as the output of an AI system is used in the EU, the regulation applies — whether or not the company actively targets the EU market. A US SaaS provider with German customers is in scope. The Brussels Effect will strengthen over time.
7. 7Delaying the Fundamental Rights Impact Assessment. The FRIA under Article 27 is mandatory for public bodies and deployers of certain high-risk systems. It is more than a data protection impact assessment: it requires analysis of fundamental rights impacts, affected groups, mitigation measures, and monitoring. Equating it with an existing DPIA produces insufficient documents.

The EU AI Act in global context

The EU AI Act stands alone internationally as the only comprehensive, horizontally applicable, legally binding AI regulation. Even globally operating organizations should understand how other jurisdictions shape the space — not least because the Brussels Effect may drive convergence over time.

The United States has no federal AI legislation. President Biden's Executive Order 14110 from October 2023 was rescinded by President Trump on January 20, 2025. The current line prioritizes deregulation and innovation promotion under EO 14179. A December 2025 executive order signals intent to preempt the growing patchwork of state AI laws. Individual states act independently: Colorado AI Act (effective February 2026), California AI Transparency Act (January 2026), Texas TRAIGA (September 2025). The NIST AI Risk Management Framework remains a voluntary tool without binding obligations.

China follows a technology-specific, vertically segmented approach. Rather than one comprehensive law, separate binding regulations exist for algorithm recommendations (March 2022), deep synthesis/deepfakes (January 2023), and generative AI services (August 2023 — making China the first country with binding GenAI rules). Content must align with core socialist values. Mandatory labeling requirements for AI-generated content took effect in September 2025.

The United Kingdom pursues a principles-based, sector-specific approach with no comprehensive AI legislation. Five cross-sector principles (safety, transparency, fairness, accountability, contestability) guide existing regulators. The AI Safety Institute was renamed AI Security Institute in February 2025. A comprehensive AI bill is expected in the second half of 2026 at the earliest.