Editor's note — September 12, 2026: Corrected the obsolete blanket countdown and fine framing; removed an unsourced threat percentage. The historic slug and publication date are preserved.
The take
The EU AI Act has different timelines and requirements by system category and role. Boards should ask for a documented applicability assessment rather than rely on a generic high-risk countdown.
The European Commission's current timetable distinguishes specified Annex III high-risk uses, with rules applying December 2, 2027, from high-risk systems embedded in regulated products, with rules applying August 2, 2028. Other provisions have separate dates and may already apply.
What management should bring to the review
An inventory of relevant systems, the applicable entity and jurisdiction, the role of the organization, the relevant category and date, and a named owner for evidence and remediation. Counsel should confirm applicability and any transitional provisions.
My operating recommendation is to build controls around the workflow: data governance, access, human review, monitoring and incident response. A deadline does not establish that every system is high-risk or that every violation carries the same maximum fine.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.
Reviewed October 20, 2026: There is no single EU AI Act deadline for every system. Under the amended timetable, specified Annex III high-risk requirements apply from December 2, 2027, and Annex I product-related high-risk requirements from August 2, 2028, subject to relevant exceptions and transitional provisions. Other obligations already apply: the original prohibited practices and AI literacy from February 2, 2025; governance and GPAI-model obligations from August 2, 2025; and general application, including relevant transparency obligations, from August 2, 2026. The later high-risk dates reflect enacted amendments, not merely a pending proposal. Providers and deployers have different responsibilities. Boards should ask management for a system-by-system applicability assessment, named control owners and evidence of readiness. A self-assessment is not legal advice or proof of compliance. Obtain qualified advice for the specific system, use and organizational role. Sources: European Commission overview and Regulation (EU) 2026/1744.