Organizations that develop or use AI covered by the EU AI Act should begin readiness work before 2 December 2027, when the Act’s requirements for Annex III high-risk use cases apply. That date is not a universal deadline for every organization or AI system: some obligations already apply, and high-risk AI embedded in regulated products has a later application date of 2 August 2028. Start by inventorying AI systems, identifying your organization’s role for each, and checking the use case against the applicable rules.
What does the 2027 date cover?
The 2027 date is about high-risk AI systems in Annex III of the EU AI Act. The European Commission’s AI Act Service Desk identifies 2 December 2027 as the application date for those rules, and 2 August 2028 for high-risk AI systems embedded in regulated products. The dates reflect amendments under the Digital Omnibus that entered into force on 27 July 2026.
As an Amazon Associate I earn from qualifying purchases.
Neither date means that all AI use becomes regulated for the first time then. The Act entered into force on 1 August 2024 and became generally applicable on 2 August 2026, subject to phased exceptions. The Commission’s timeline distinguishes obligations that applied earlier from those with later dates:
| Date | What the Commission says applies |
|---|---|
| 2 February 2025 | Prohibited-practice rules and AI-literacy provisions. |
| 2 August 2025 | Governance rules and obligations for general-purpose AI (GPAI) providers. |
| 2 August 2026 | General application of the Act, subject to phased exceptions. |
| 2 December 2027 | Requirements for Annex III high-risk AI systems. |
| 2 August 2028 | Requirements for high-risk AI systems embedded in regulated products. |
These dates are from the European Commission’s AI Act Service Desk and AI Act overview. The Commission notes that its overview is informational and does not replace the Regulation itself.
Does your AI use count as high-risk?
Do not classify a system as high-risk—or assume it is outside scope—based only on the broad sector in which it is used. Annex III covers specified use-case categories, including biometrics, critical infrastructure, education, employment, migration, asylum, and border control. The intended purpose and legal classification of the particular system matter; not every AI tool used in one of those sectors is automatically high-risk.
For each system, establish where it is used, what it is intended to do, who may be affected, and what role your organization plays. If the classification is uncertain, escalate it for legal review rather than treating a sector label or vendor description as conclusive. The EU materials distinguish duties by role and system, and other applicable geography or sector rules may also matter.
Rank #2
Which obligations depend on your role?
An organization may have different roles for different systems. A company that develops one system may deploy a separate vendor’s system; record the role system by system rather than assigning one label to the whole organization.
Recommended Free Tools
| Role or activity | Readiness implications described in the EU materials |
|---|---|
| Provider of a high-risk system | Establish a documented quality-management system covering regulatory compliance, design and development controls, testing and validation, technical specifications, and other listed areas. Prepare technical documentation, conformity assessment, corrective-action processes, and cooperation with competent authorities. |
| Deployer of a high-risk system | Use the system according to its instructions, monitor its operation, respond to identified risks or serious incidents, and assign human oversight to a person in the organization. Inform workers where applicable. |
| Provider or deployer controlling system logs | Preserve the logs covered by the Act for the applicable period, subject to applicable law. The specific duties depend on role and system. |
The European Union’s consolidated Regulation (EU) 2024/1689 specifies a 10-year period for providers to keep specified high-risk-system documentation available to authorities after the system is placed on the market or put into service. For automatically generated logs under a provider’s control, the minimum specified period is at least six months, subject to applicable law; the Act includes a corresponding deployer provision for logs under the deployer’s control. These are distinct recordkeeping duties, not a single retention rule for every AI-related record.
How should an organization prepare?
The following sequence turns role-specific obligations into accountable operational work. It is a practical approach, not a universal inventory template published by the Commission.
- Inventory systems and uses. Include AI developed internally, purchased, embedded in products, and supplied by third parties. Record the intended use, business owner, technical owner, supplier, and where the system is used.
- Scope each system. Document geography, sector, intended purpose, affected people, system type, and the organization’s role. Check whether a specified high-risk use case or other Act obligation may apply; send unresolved classification questions for legal review.
- Assign accountable owners. Name people responsible for risk review, documentation, human oversight, monitoring, incident escalation, and vendor coordination. Make sure operational teams know who can investigate, escalate, and take corrective action.
- Connect governance to evidence. For systems in scope, map policies and procedures to technical documentation, testing, quality management, change control, logs, and corrective action. Providers of high-risk systems have explicit documentation and quality-management responsibilities.
- Plan ongoing operation. Define how staff will monitor system behavior, report problems, respond to serious incidents, and pause or correct unsafe use. Set record-preservation practices that also account for applicable data-protection and sector rules.
- Review and update. Revisit classifications, ownership, documentation, and controls when a system’s intended purpose, deployment, or applicable requirements change. Maintain a route for staff to raise concerns rather than relying on a one-time compliance review.
Can NIST’s AI Risk Management Framework help?
NIST’s AI Risk Management Framework (AI RMF) is a voluntary risk-management resource that can inform governance and implementation work; it is not a substitute for the EU AI Act and does not itself demonstrate legal conformity. NIST’s official AI RMF page links to version 1.0 and its playbook and says the framework is being revised. NIST released its Generative AI Profile, NIST AI 600-1, on 26 July 2024; the page also records an April 2026 concept note for a critical-infrastructure profile. Check NIST’s current resources and revision status before relying on a particular version. NIST states that “The AI RMF 1.0 is being revised as part of the White House AI Action Plan.”
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What do the stated maximum fines mean?
The European Commission’s enforcement framework, accessed in 2026, lists different maximums for different infringement categories. They are statutory ceilings, not estimates of likely penalties, and do not mean every organization faces the same cap.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Infringement category | Commission-stated maximum |
|---|---|
| Infringements involving prohibited AI practices | Up to €35 million or 7% of worldwide annual turnover, whichever is higher. |
| Other breaches, including GPAI obligations | Up to €15 million or 3% of worldwide annual turnover, whichever is higher. |
| Certain failures to comply with an information request, or provision of incorrect, incomplete, or misleading information | Up to €7.5 million or 1% of worldwide annual turnover, whichever is higher. |
The Act uses a two-tier enforcement structure: national competent authorities enforce rules for most AI systems, while the AI Office is responsible for GPAI model obligations and specified systems. The applicable authority and penalty depend on the matter and the regulated role.
Best Value
What should readiness look like in practice?
A credible readiness program should leave evidence that people can use to operate and govern systems—not just a policy statement that the organization is “AI ready.” For each potentially in-scope system, decision-makers should be able to find its intended purpose and classification rationale, accountable owners, relevant documentation, testing and change records, monitoring arrangements, human-oversight responsibilities, and incident-response path. Whether the organization is ready depends on its systems, roles, jurisdictions, and sector obligations; the cited official materials do not establish a general statistic for how prepared organizations are.
The Regulation and Commission guidance do not determine whether a particular reader’s system qualifies as high-risk. Organizations should assess each system and role against the applicable legal text and seek qualified legal advice where classification or obligations are uncertain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
