What is the EU AI act, and
what does it mean for you?
The EU AI act’s deadline just moved to December 2027. Here’s what it actually requires, which enterprises it applies to, and how enterprises should plan.
By Aishwarya Rajasekar · 8 min read
Introduction
Somewhere in an organization right now, the legal team is reviewing the 113-article regulation and quietly panicking. The EU AI Act (Regulation (EU) 2024/1689) is the first comprehensive law anywhere to regulate AI directly, instead of approaching AI governance as a data-privacy afterthought.
Adopted jointly by the European Parliament and the Council of the EU and published on July 12, 2024, it predicts the damage a given AI system could realistically cause, and scales its 113 controls to the assumed damage. Most obligations will be enforceable from December 2, 2027, though a fraction of the controls have been enforceable been enforceable since February 2025. If we strip away the jargon, then the EU’s goal becomes straightforward: keep AI safe, transparent, and accountable, while protecting people’s rights, without shutting European companies out of the race.
However, proving compliance to the AI Act is neither cheap, nor straightforward. According to a CEPS/ICF/Wavestone study, compliance costs estimates range from:
- Upfront setup: €193,000-€330,000
- Ongoing: ~€71,400 a year
Though these costs may seem massive, it’s still cheaper than a fine that runs into the tens of millions. And proving compliance comes down to five things:
- Documented risk management
- Technical documentation
- Human oversight
- A conformity assessment
- EU database registration
Skip any one of these requirements, and “compliance” is just a word on a slide deck. To understand how to go about this, we have to take a trip back memory lane to 2018, when the GDPR first came into effect.
Every company scrambled to figure out what “personal data” even meant for them, half the internet sprouted cookie banners overnight, and a handful of businesses got hit with fines large enough to make the evening news. The EU AI Act is recreating that moment again, except this time it’s not your data practices under the microscope, but rather the AI making decisions on your behalf.
At its core, the act sorts every AI system into one of four tiers, based on how much damage it could do if it goes wrong.
What's already in effect: bans and GPAI rules
Some parts of the Act are already in effect. Some enterprises are unaware of the same, with the deadline being treated as a static date, penciled in for December of 2027.
Effective date
What kicked in
February 2, 2025
Prohibited practices banned outright: manipulation, social scoring, unconsented biometric scraping
August 2, 2025
General-purpose AI model obligations in force: transparency, documentation, systemic-risk assessment for the largest models
December 2, 2027
Most high-risk system obligations take effect, the one everyone’s actually bracing for
If your teams build on or fine-tune a foundation model, some of this already applies to you. And the deadline still ahead isn’t a light one: penalties run up to €35 million or 7% of global turnover for the worst violations, whichever number is bigger. We’ve seen the payoff of building this early in our own work, wiring risk-assessment logic directly into an insurance sales assistant rather than bolting it on after launch. Treating that future date as the only deadline is precisely the blind spot this section exists to close.
penalties run up to €35 million or 7% of global turnover for the worst violations, whichever number is bigger.
You are on a deadline to prove compliance. You should have started yesterday.
The EU didn’t push this deadline back because enterprises were ahead of schedule. It pushed it back because, in its own words, implementation was “visibly off track.” Regulators looked at the compliance infrastructure enterprises were supposed to have built by now and found most of it missing, half-finished, or entirely theoretical.
That’s not a relief. That’s a confession that the first attempt failed, dressed up as generosity.
Under the Digital Omnibus agreement, the timeline now looks like this:
- High-risk AI systems (the Annex III category covering hiring, credit, insurance, and similar decisions): pushed from 2026 to December 2, 2027
- AI embedded in regulated products, think medical devices and machinery: extended to August 2, 2028
- Transparency and content-labeling rules: largely unchanged, with existing systems getting a grace period on watermarking until December 2, 2026
Notice what didn’t change? Transparency obligations, the ones covering deepfakes and AI-generated content, barely budged. That’s the EU telling you exactly where it’s still watching closely even while giving ground elsewhere.
The honest inference from this delay isn’t that we have more time. It’s that we have one more shot at doing this properly, and the companies that waste it will conspicuously fall behind the ones that don’t. Sixteen extra months sounds generous until you remember most enterprises couldn’t get their act together in the first sixteen they were given.
The excuses enterprises are already making
“We’re not EU-based, so this doesn’t apply to us.” The Act’s scope isn’t drawn around headquarters, it’s drawn around impact. If an EU customer uses your product, if an EU employee runs through your hiring model, if an EU applicant’s credit or insurance decision touches your AI, you’re in scope, no matter where your servers happen to sit. Non-EU providers of high-risk systems are even required to formally name an authorized representative inside the EU to handle exactly this kind of exposure.
“The deadline moved, so we’ve got time.” Deadlines creep up on you when nobody’s assigned to spend it. Companies that treat this extension as a pause tend to rediscover the deadline the way you rediscover a parking ticket, right when it’s already overdue.
“Legal has this handled.” Legal can write the policy. Legal cannot build the human oversight checkpoint into your hiring pipeline, cannot inventory every model your engineering team quietly spun up last quarter, and cannot retrofit an audit trail into a system that was never built to produce one. This is an architectural decision wearing a legal-sounding name.
All three excuses share the same blind spot: they treat the AI Act as a document to be filed rather than a system to be built.
What a 2026 readiness snapshot actually found
It is kind of hard to govern something you never even wrote down, right? Sounds like common sense, but that’s basically what a formal 2026 readiness assessment found when it looked at enterprises heading into this deadline.
Finding
Share of enterprises
Show no meaningful AI Act readiness at all
78%
Have no formal inventory of the AI systems running in their own production environment
83%
Have no one specifically owning AI governance
74%
Can’t produce the technical documentation their high-risk systems are required to have on file
61%
Source: Vision Compliance, 2026 EU AI Act Readiness Report
Honestly, I would sit with that for a second, because it’s a little unsettling. Most enterprises are one internal audit away from finding out how much of their own AI footprint has just been quietly operating in the dark this whole time, making calls about who gets hired, who gets a loan, who gets flagged, with nobody really watching closely enough to catch it when something goes wrong.
Turns out GDPR was practice
The funny thing is, nobody enjoyed building a GDPR program back in 2018. Endless meetings over what counted as “personal data,” budgets that nobody wanted to sign off on, all cumulatively contributing towards IT overheads at the time. But the companies that did it properly then are, oddly enough, the same ones cruising into the AI Act with a head start.
Quick check: who is responsible for data governance at your company, and did that team survive the GDPR years? If yes, you’re likely in better shape than you think, because the regulator wants to see the exact same things twice, documented data flows, clear accountability, a reflex of asking “should we even be doing this” before shipping.
That infrastructure doesn’t expire once an audit passes. It pays out again, cheaper and faster, every cycle after. We built that logic into a comprehensive HRMS solution, treating governance as load-bearing from day one rather than a report stapled on at the end, since employment decisions are exactly what regulators watch closest.
Four things to watch before you build your AI Governance programme
The failures rarely look dramatic from the inside. They look like an ordinary Tuesday nobody flagged, a dataset nobody double-checked, a small decision that turns into a lawsuit two years down the line. Compliance programs tend to crack along four fault lines, and it’s almost always more than one giving way at once.
People
No one is named the owner of AI governance, so the responsibility sits everywhere and, functionally, nowhere. Legal and engineering operate in separate rooms, each quietly assuming the other has it covered.
Process
There’s no continuous monitoring and no incident-reporting workflow in place. AI governance gets treated like a one-time launch gate instead of an ongoing discipline, which means nobody’s watching once the system goes live and starts drifting.
Data
There’s no AI system inventory and no fundamental rights impact assessments on file. You can’t classify risk in a system you never catalogued to begin with.
Infrastructure
There are no audit trails and no human checkpoint standing in front of employment, credit, or insurance decisions before they go out the door.
This isn’t just a hypothetical worth worrying about, it’s already playing out in court. Mobley v. Workday is a real, still-unresolved federal case alleging that an AI hiring-screening tool systematically filtered out a qualified applicant over race, age, and disability status across more than a hundred job applications. Nobody needed to intend discrimination for that outcome to happen. An unwatched dataset, trained on historical hiring patterns that already carried bias, was enough. That’s precisely the kind of infrastructure gap this section is describing, and precisely why employment AI sits squarely in the Act’s high-risk category.
Stop chasing Legal. Own the compliance journey end-to-end.
Hand this to legal alone and you get a great policy document and zero say over what your systems actually do. But what you really need to effect change is taking ownership of the compliance journey within your organization.
Three moves to prioritize in the next 90 days:
Inventory everything
Thirty days to list every AI system running in production, sanctioned or not. You can’t govern what you won’t look at.
Map the high-risk categories
Employment, credit, and insurance use cases each carry their own deployer obligations: training records, logs, human oversight, incident reporting. Treat them differently.
Name an owner with real authority
Not a title tacked onto someone’s job description, but someone who can pull legal, data, and business leadership into a room the moment it matters.
Compliance you can actually see, not just report on
Most compliance programs are built to answer one question, once a year: did we pass the audit. Our AI-driven workplace compliance and safety solution was built to answer it every day instead, giving teams a live, bird’s-eye view across every site and every incident, the moment something drifts, not the moment someone finally goes looking. It’s the same discipline this issue’s feature is built on: you can’t govern what you can’t see, and a once-a-year checklist only ever tells you where you stood twelve months ago.
Closing notes: Building the actual compliance timeline
Every enterprise gets handed the same clock, and the EU doesn’t care whether you started today or start scrambling in November 2027, what matters is what you do with the months in between: name the governance owner in the first 30 days, spend the next 60 running inventory-to-risk-mapping across every team that touches AI with legal, data, and engineering actually in the same room instead of trading documents by email, and get an internal audit dry run done well before the deadline so the first stress test isn’t the day a regulator asks for one.
Think back to that mid-sized insurer: the version that starts now walks into December 2027 with a documented model, a named owner, and an audit trail already in place, while the version that waits walks in scrambling, despite having the same deadline and rulebook.
So where do we go from here?
AI systems can remain in production for years without a clear label, risk classification, or owner. Understanding the Act is rarely the main challenge. The difficult part is turning its requirements into a working process that connects legal, engineering, and data teams.
When governance begins late, teams must revisit old decisions, trace data sources, and determine who is responsible. So, bringing governance into development prevents that scramble. Following the steps will eventually lead the system to reach production with a defined purpose, tested controls, a risk classification, and a named owner.
Begin the introspection by asking if the organization reviews AI before launch, or only after a concern appears.
The following steps offer a practical place to begin
AI systems can remain in production for years without a clear label, risk classification, or owner. Understanding the Act is rarely the main challenge. The difficult part is turning its requirements into a working process that connects legal, engineering, and data teams.
When governance begins late, teams must revisit old decisions, trace data sources, and determine who is responsible. So, bringing governance into development prevents that scramble. Each system reaches production with a defined purpose, tested controls, a risk classification, and a named owner.
To begin with, look if you could answer the question: Does the organisation review AI before launch, or only after a concern appears?
The following steps offer a practical place to begin.
01
Inventory every AI system in use:
Create a complete record of approved and unapproved systems within 30 days. Each entry should include its purpose, owner, data sources, users, and current status.
02
Classify each system and the company’s role:
Record the risk category and whether the company acts as a provider or deployer. High-risk systems may require controls such as risk management, automatic logging, human oversight, ongoing monitoring, and serious incident procedures.
03
Appoint one accountable owner:
This person should have the authority to bring legal, engineering, data, and business leaders together when action is needed. Ownership must be a genuine responsibility, not an additional title without support.
04
Build governance into development:
Testing, monitoring, change reviews, and incident handling should be designed with the system, not added shortly before launch.
05
Run an internal readiness review:
Test the controls, records, and ownership structure before a customer, auditor, or regulator requests evidence. Any gaps should be fixed while the company still controls the timeline.
FREE EBOOK
Navigating the EU AI act
Here's your free copy
If your download doesn't start automatically, please click here.
A copy of the ebook has also been dispatched to your inbox.
FROM THE BLOG: EU AI ACT
A tiered compliance playbook for startups, mid-market, and enterprises
This piece covers the landscape. If you’re the one actually accountable for getting your enterprise ready, you’ll want more than a landscape view.
The Gap Between Ready and Not
Only 22% of enterprises show any meaningful AI Act readiness today, according to that same 2026 readiness assessment referenced earlier. That gap isn’t luck. The enterprises on the right side of it share a few habits:
- They've already run a formal inventory of every AI system in production
- They've already named someone to own AI governance, rather than leaving it to drift between legal and engineering
- They can already produce the technical documentation a regulator would ask for, instead of assembling it under deadline pressure
FREE EBOOK
Navigating the EU AI act
Here's your free copy
If your download doesn't start automatically, please click here.
A copy of the ebook has also been dispatched to your inbox.
Are you looking for AI solutions for your organization?
Be it AI projects, bespoke solutions, or staffing, we’ve got you covered.
