Is Your Company Ready for the EU AI Act?

What is the EU AI Act, and who does it actually bind?

The EU AI Act is the first comprehensive law governing artificial intelligence, and it sorts AI systems by risk: a small set of prohibited uses, a regulated tier of high-risk systems, lighter transparency duties, and minimal-risk uses. It is also extraterritorial. If your AI is placed on the European market, or its output is used in the Union, the Act reaches you whether you sit in Frankfurt, London, or San Francisco.

Why is the deadline closer than it looks?

Because it arrives in phases, and the phases have started. Certain prohibited practices already apply, obligations for general-purpose AI models have begun, and the substantial duties for high-risk systems land in 2026, with further requirements following. Penalties run up to 7 percent of global annual revenue. The work that earns compliance, classifying systems, documenting data and testing, and building human oversight, takes months. A company that begins when the auditor calls has already lost the timeline.

What does real readiness require?

Four things, in order. First, an inventory: know every AI system you build or buy and classify each by its risk tier under the Act. Second, documentation: record the data, testing, performance, and human oversight behind each high-risk system, because the Act rewards what you can prove, not what you assert. Third, governance: assign clear ownership, change control, and the ability to explain and contest automated decisions. Fourth, conformity readiness: prepare each high-risk system for the assessment and technical file the Act expects. This is a board-level program, not a checkbox.

Where should a company start?

Start with the inventory and the classification, because you cannot govern what you have not mapped. From there the path is concrete: close the documentation gaps, stand up the governance, and prepare the high-risk systems for conformity assessment. Done early, the 2026 deadline becomes a date you are ready for. Done late, it becomes a scramble in front of a regulator. The difference is months, and those months are running now.

Read next: Is Your Company Ready for the First Real AI Law in the United States?  ·  Is a Single Misconfigured File Your Biggest AI Risk?