Updated October 2026: The EU’s Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026, moved the main compliance deadline for Annex III high-risk AI systems from August 2, 2026 to December 2, 2027. Our take: the extra 16 months is a gift most teams will waste — the obligations themselves did not change, and buyers are already asking about AI governance today.
What Is the EU AI Act?
The EU AI Act is the world’s first comprehensive AI regulation. Signed into law in 2024 and rolled out in phases, it establishes a risk-based framework for how artificial intelligence systems can be developed, deployed, and monitored across the European Union.
This is not a future concern. Enforcement has already begun, and high-risk systems must comply by December 2, 2027 (Annex III) or August 2, 2028 (AI in regulated products). Any organization offering AI-enabled products or services to EU customers—regardless of where you’re headquartered—must comply.
For GRC teams, the EU AI Act represents a fundamental shift: AI governance is no longer optional. It’s now a regulatory mandate with material financial penalties and reputational consequences.
When Does the EU AI Act Take Effect?
The EU AI Act has a staggered enforcement timeline. Understanding each phase is critical to your compliance roadmap.
| Date | What takes effect |
|---|---|
| August 1, 2024 | The AI Act enters into force |
| February 2, 2025 | Prohibited AI practices (e.g., social scoring) and AI literacy duties apply |
| August 2, 2025 | General-purpose AI model obligations apply |
| August 2, 2026 | Article 50 transparency obligations apply (not deferred by the Digital Omnibus) |
| December 2, 2026 | New prohibitions on AI that generates non-consensual intimate imagery or CSAM apply |
| December 2, 2027 | High-risk obligations for Annex III systems (employment, credit, education, critical infrastructure) apply, deferred from August 2, 2026 |
| August 2, 2028 | High-risk obligations for AI embedded in regulated products (Annex I) apply |
If your organization uses AI in recruitment, criminal justice, critical infrastructure, education, or employment—you’re high-risk. December 2, 2027 is when regulators will expect high-risk systems to demonstrate compliance.
What Are the EU AI Act Risk Categories?
The EU AI Act uses a four-tier risk classification system. Your AI systems must be assessed and placed in the appropriate tier.
Unacceptable Risk (Banned)
Penalty: Immediate prohibition. €35 million or 7% of global annual turnover.
Examples: Social credit systems, subliminal manipulation, biometric identification in public spaces (with narrow exceptions), automated decision-making based on social behaviors.
What to do: Discontinue any systems in this category immediately. If you have developed or deployed these, document the phase-out and notify regulators.
High Risk (Strict Requirements)
Penalty: €30 million or 6% of global annual turnover for non-compliance.
Examples: Recruitment AI, employee monitoring systems, credit scoring, law enforcement decision-support, autonomous vehicles, education/training systems, critical infrastructure systems.
Requirements: Risk management systems, technical documentation, data governance, human oversight protocols, accuracy and robustness testing, cybersecurity controls, continuous monitoring.
What to do: This is your primary focus. Conduct a comprehensive audit of all high-risk systems and implement governance frameworks by mid-2027, leaving time for testing and conformity assessment before December 2, 2027.
Limited Risk (Transparency)
Penalty: €15 million or 3% of global annual turnover for non-compliance.
Examples: Chatbots, recommendation systems, deepfakes that users should know are AI-generated.
Requirements: Disclosure that users are interacting with AI, publication of summaries of training data and testing results.
What to do: Document your AI systems, prepare transparency statements, and implement clear disclosure mechanisms.
Minimal Risk (No Restrictions)
Penalty: None.
Examples: AI-powered spam filters, video games, standard automation tools with no direct user impact.
What to do: Maintain records of how systems are classified. Minimal-risk systems are not exempt from monitoring—they could be reclassified if deployed in new contexts.
How Should GRC Teams Prepare for the EU AI Act?
7-Step Compliance Preparation Checklist
- Inventory all AI systems: Document every AI system your organization uses or develops. Include third-party AI vendors, custom models, and integrated AI features. Map data flows and dependencies.
- Classify by risk tier: For each system, determine its risk classification based on the EU AI Act criteria. Document your classification rationale. High-risk systems are your priority.
- Assess current governance: Review existing GRC frameworks, documentation, and control environments. Identify gaps between current state and EU AI Act requirements.
- Establish data governance: Implement data quality standards, lineage tracking, bias detection mechanisms, and documentation of training/testing datasets. High-risk systems require rigorous data governance.
- Define human oversight protocols: Create clear procedures for human review and intervention in high-risk AI decisions. Document roles, responsibilities, and escalation paths.
- Build technical documentation: Prepare technical documentation for high-risk systems including model architecture, performance metrics, limitations, and test results. This must be audit-ready.
- Establish monitoring and audit cycles: Plan for continuous monitoring, internal audits, and readiness assessments. Assign accountability within your GRC team.
The organizations that move fastest will have the highest confidence heading into December 2027. Delay increases risk of non-compliance, regulatory action, and reputational damage. For a detailed phase-by-phase implementation roadmap with resource estimates and timelines, see our [mid-market EU AI Act compliance guide.
of security leaders say their organizations are unprepared for AI regulation compliance. (Source: 2025 State of AI Security Survey)
maximum fine for unacceptable-risk AI violations—plus reputational damage, customer trust loss, and operational disruption.
until full enforcement. Organizations must audit, classify, and implement governance frameworks immediately.
The Role of GRC Platforms in EU AI Act Compliance
Traditional GRC frameworks weren’t designed for AI governance. EU AI Act compliance requires new capabilities: AI system inventory and classification, continuous risk assessment, data governance tracking, and compliance monitoring.
A modern GRC platform designed for AI governance can accelerate your compliance timeline. The best platforms provide:
- AI system registry: Centralized inventory of all AI systems with classification, ownership, and compliance status
- Risk assessment automation: Guided workflows that map your systems to EU AI Act risk tiers
- Compliance monitoring: Real-time dashboards showing compliance gaps and remediation status
- Documentation management: Secure repository for technical documentation, training datasets, and test results
- Audit readiness: Pre-built audit templates and evidence collection for regulatory inspections
The right tooling isn’t a luxury—it’s the difference between a successful compliance transition and a regulatory violation.
What High-Risk AI Systems Must Comply With
If your organization operates high-risk AI systems, the December 2, 2027 deadline means these specific requirements must be met:
| Requirement | What It Means |
|---|---|
| Risk Management System | Documented process for identifying, assessing, and mitigating risks throughout the AI system lifecycle |
| Data Governance | Controls ensuring training and testing data is adequate, representative, and free from bias |
| Technical Documentation | Complete specifications including system design, performance metrics, limitations, and test results |
| Human Oversight | Clear protocols for human review of AI decisions, especially in high-stakes scenarios |
| Accuracy & Robustness | Testing and documentation showing the system performs reliably and doesn’t degrade under adversarial conditions |
| Cybersecurity | Controls protecting the AI system from tampering, manipulation, and unauthorized access |
| Post-market Monitoring | Ongoing monitoring, logging, and incident reporting after deployment |
Each requirement must be evidenced in your compliance documentation. Regulators will audit these during inspections.
Frequently Asked Questions About EU AI Act Compliance
Moving Forward: Your 90-Day Action Plan
With the high-risk deadline set for December 2, 2027, your action plan can be thorough, but the documentation and testing work still takes quarters, not weeks. For a broader overview of the EU AI Act’s risk categories and what they mean for security teams, see our [EU AI Act compliance guide for GRC teams].
Weeks 1-2: Rapid Assessment
Conduct a comprehensive inventory of all AI systems. Classify each system by risk tier. Identify gaps in documentation and governance. This is the foundation for everything else.
Weeks 3-6: Gap Closure
Begin implementing missing controls. Start with high-risk systems. Develop technical documentation. Establish data governance protocols. Create human oversight procedures.
Weeks 7-10: Testing and Refinement
Conduct internal audits against EU AI Act requirements. Test your monitoring and reporting systems. Refine documentation based on gaps discovered during testing.
Weeks 11-12: Final Readiness
Complete final testing. Prepare for potential regulatory inspection. Ensure your GRC team is trained and ready to demonstrate compliance. Document your remediation timeline and any systems that require phase-out.
Ready to accelerate your EU AI Act compliance? A guided demo of Compyl’s GRC platform shows how to inventory, classify, and monitor AI systems at scale. Request a demo today to see how your organization can achieve compliance confidence before the December 2027 deadline.
Key Takeaways
The EU AI Act is the most significant AI regulation globally, and its high-risk deadline of December 2, 2027 is closer than it looks. Here’s what GRC and security teams need to act on:
- The EU AI Act’s high-risk obligations apply from December 2, 2027. This applies to any organization offering AI systems to EU customers, regardless of headquarters location.
- Risk classification drives requirements. Unacceptable-risk systems are banned. High-risk systems require strict governance. Transparency is required for limited-risk systems.
- High-risk compliance demands risk management systems, data governance, technical documentation, human oversight, and continuous monitoring.
- Penalties are material: up to €35 million or 7% of global annual turnover for unacceptable-risk violations.
- Your GRC framework must evolve to incorporate AI governance. Traditional frameworks are insufficient.
- Organizations that begin preparation now will achieve compliance confidence. Those that delay increase regulatory risk and reputational exposure.
The path to compliance is clear, but it requires immediate action. Start with an audit, classify your systems, and implement governance frameworks; our comparison of the EU AI Act vs ISO 42001 explains how a certifiable management system supports that work. The organizations that treat EU AI Act compliance as an urgent priority will emerge as trusted leaders in responsible AI deployment.
For a deeper exploration of how AI governance fits into your broader security and compliance strategy, explore our resources on AI risk management and regulatory readiness.
