The EU AI Act became law in August 2024. Enforcement didn’t start immediately, but the clock has been running since then.
Most companies treating this as a future problem are already behind. The phased implementation timeline means different requirements kicked in at different dates, and several deadlines have already passed. Companies that waited for “more clarity” are now scrambling while enforcement mechanisms are already active.
This isn’t a regulation you can comply with in a few weeks. Building compliant AI programs takes months.
How the Act Classifies AI Systems
The EU AI Act uses a risk-based framework that determines what requirements apply to each AI system.
Prohibited AI is banned entirely. Social scoring systems, AI that manipulates psychological vulnerabilities, and real-time biometric surveillance in public spaces must be shut down immediately. These prohibitions took effect in February 2025.
High-risk AI covers systems affecting people’s safety, rights, or livelihoods. Hiring and HR systems, credit decisions, healthcare AI, educational assessment, law enforcement tools, and critical infrastructure management all qualify. Requirements for these systems take effect in August 2026.
Limited risk AI requires transparency. Chatbots must disclose they’re AI. Deepfakes must be labeled. These obligations are already in force.
The Enforcement Timeline
February 2025: Prohibited AI provisions in force. Companies still operating banned systems are already violating the Act.
August 2025: General purpose AI model requirements active. Foundation model providers must maintain technical documentation and publish training data summaries.
August 2026: High-risk AI requirements take full effect. This is the deadline most enterprises are focused on, but building compliant programs by then requires starting now.
August 2027: High-risk AI embedded in regulated products like medical devices gets additional time, but preparation should begin immediately.
What High-Risk AI Compliance Requires
Companies with high-risk AI systems face demanding requirements that most are underestimating.
Risk management must be maintained throughout the entire AI lifecycle, not just at deployment. Ongoing monitoring, documentation, and regular review are required as the system evolves.
Data governance requires that training and testing datasets meet quality criteria. Data sources, preparation methods, and known limitations must all be documented. This creates challenges when companies use third-party AI systems where they don’t control training data.
Human oversight must be meaningful. The Act requires humans to genuinely understand what AI is doing, monitor for problems, intervene when necessary, and shut systems down when required. Rubber-stamp approval processes don’t satisfy this requirement.
Post-market monitoring requires actively collecting performance data after deployment, identifying problems that emerge in real-world conditions, and taking corrective action when issues arise.
Registration and Conformity Assessment
High-risk AI systems must be registered in an EU database before deployment. Companies can’t quietly deploy high-risk AI – the system must be registered, giving regulators visibility and the ability to target systems for inspection.
Some high-risk categories require third-party conformity assessments before deployment. These include AI used in biometric identification, employment decisions, access to essential services, and law enforcement. Assessment bodies with AI expertise are limited and wait times are growing. Companies needing third-party assessments for August 2026 should be engaging assessors now.
The Penalties
Prohibited AI violations carry fines up to €35 million or 7% of global annual turnover. High-risk AI violations carry fines up to €15 million or 3% of global annual turnover. These calculations apply to global revenue, meaning US companies with limited EU presence still face substantial penalties.
The Extraterritorial Reality
Many US companies believe the EU AI Act doesn’t apply without EU operations. This is wrong.
The Act applies whenever AI outputs reach EU users, employees, or customers. A US company using AI to make decisions about EU customers faces EU AI Act obligations regardless of where the company is located. The regulation follows the impact, not the company’s address.
What Companies Should Do Now
Start with inventory. Document every AI system in operation, what it does, what data it uses, and what decisions it influences. Without this foundation, assessing compliance obligations is impossible.
Classify each system under the Act’s risk framework. Legal analysis of how systems function and what decisions they affect will reveal which regulatory categories apply. Most companies discover more high-risk AI than expected.
Conduct gap assessments for high-risk systems, comparing current practices against what the Act requires across documentation, risk management, human oversight, and testing.
Build remediation plans with realistic timelines. August 2026 approaches faster than it appears when compliance programs need to be built from scratch.
The companies that will meet the August 2026 deadline are the ones that started building compliance programs months ago. For everyone else, the window is narrowing quickly.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor