EU AI Act compliance is a live obligation, even though the biggest deadline has moved. The world’s first comprehensive AI law entered into force in August 2024. Its prohibitions, AI literacy duties, general-purpose AI rules and transparency obligations already apply. However, the EU’s Digital Omnibus, in force since July 2026, moved the high-risk AI system obligations from August 2026 to December 2027 for stand-alone systems and August 2028 for AI built into regulated products. That extra time helps, because many enterprises are not ready: an appliedAI study found that 40% of enterprise AI systems had an unclear risk classification. This guide explains what applies now, what moved, where the compliance gaps are and how CIOs and compliance leaders should use the time.
What EU AI Act Compliance Requires
EU AI Act compliance works through a risk-based system: the more harm an AI system could cause, the stricter the rules. Organizations that provide or deploy high-risk AI systems need several requirements in place by the new deadlines.
First, providers must run a quality management system and keep full technical documentation on system design, development and testing. Second, high-risk systems need a conformity assessment before they go on the EU market. Third, high-risk systems must be registered in the EU database. Ongoing duties also include post-market monitoring, incident reporting and human oversight.
The law reaches beyond the EU, much like GDPR. Any organization, wherever it is based, must comply if its AI systems are used in the EU or their outputs are used there. So a US company that uses AI for loan approvals for European customers is in scope, even if its models run on servers outside Europe.
The EU AI Act treats a system as high-risk when it affects fundamental rights or safety. Key categories include AI used in hiring and employment, credit scoring and lending, medical device diagnostics, biometric identification, critical infrastructure, education and vocational assessment, and law enforcement. If you use AI in any of these areas in the EU market, those systems fall under the full compliance framework.
The EU AI Act Compliance Gap: Why Most Enterprises Are Not Ready
Despite more than two years since the law entered into force, many enterprises still have large compliance gaps. The gap is organizational as well as technical. Many companies have not given anyone clear ownership of AI compliance, and coordination between legal, IT, data science and business teams is still weak.
AI deployment is also moving faster than governance. Organizations add new AI systems faster than compliance teams can assess them. As a result, the list of unclassified AI systems often grows each quarter instead of shrinking.
EU AI Act Compliance Penalties: The Financial Exposure
EU AI Act fines are higher than GDPR’s maximum penalties. So organizations need to understand the tiered enforcement framework and their financial exposure.
| Violation Type | Maximum Fine | Examples |
|---|---|---|
| Prohibited AI practices | EUR 35M or 7% of global turnover | ✓ Social scoring, manipulative AI, real-time biometric surveillance |
| High-risk and other obligations | EUR 15M or 3% of global turnover | ◐ Missing conformity assessments, inadequate documentation |
| Incorrect information to authorities | EUR 7.5M or 1% of global turnover | ◐ Inaccurate or misleading compliance reports |
To put that in perspective, 7% of global revenue would cost the largest technology companies billions. Authorities also weigh severity, duration, intent and the steps taken to reduce harm when setting penalties. As a result, organizations that can show proactive compliance may be treated more favorably than those caught unprepared.
Fines are only part of the story, however. Organizations without conformity assessments may lose business, because public buyers and critical infrastructure operators increasingly ask for AI Act compliance up front. So non-compliance becomes a barrier to market access, not just a regulatory penalty.
The Digital Omnibus, published as Regulation (EU) 2026/1744 and in force since 27 July 2026, moved the high-risk deadlines. Stand-alone high-risk systems listed in Annex III, such as those used for hiring or credit scoring, now face obligations from 2 December 2027. High-risk AI built into regulated products under Annex I, such as medical devices and machinery, follows from 2 August 2028. Systems already on the market before those dates are generally covered only if they are substantially modified afterwards. The extra time is not a reason to pause, though, because conformity assessments and documentation take months to prepare.
Talk to an ExpertUnsure which of your AI systems are high-risk? Classify them with us.
The EU AI Act Compliance Timeline: What Has Already Taken Effect
EU AI Act compliance is a phased rollout, not a single event. Knowing what already applies helps you see where you stand.
Five Priorities for Achieving EU AI Act Compliance
Based on the compliance gaps, the penalty framework and the new timeline, here are five priorities for CIOs and compliance leaders:
- Build a full AI inventory now: You cannot classify what you cannot see, so catalog every AI system you develop, deploy or use in the EU market. Include AI built into third-party vendor tools, which organizations often miss.
- Classify every system by risk level: Decide whether each AI system is prohibited, high-risk, limited risk or minimal risk under the Act. Since 40% of systems in appliedAI’s study had unclear classifications, resolve the ambiguity now instead of during an investigation.
- Invest in AI-native governance tools: Traditional GRC tools lack AI-specific features, so budget for platforms that cover AI inventory, continuous model monitoring, bias detection and automated compliance documentation.
- Prepare conformity assessments for high-risk systems: High-risk systems need a conformity assessment before they go on the market, so start now for any system that affects hiring, credit, medical diagnosis or critical infrastructure.
- Use the extra time, do not spend it waiting: The Digital Omnibus moved the high-risk deadlines to December 2027 and August 2028, but transparency rules already apply. Organizations that prepare early will also be in a better position if enforcement starts strictly.
The Bottom Line
Key Takeaway EU AI Act compliance is already a live obligation: prohibitions, AI literacy, general-purpose AI rules and transparency duties apply now, with fines of up to EUR 35 million or 7% of global turnover. High-risk obligations moved to December 2027 and August 2028 under the Digital Omnibus. Yet many enterprises still lack AI inventories, have unclear risk classifications and rely on GRC tools that cannot handle AI-specific risks. So build the inventory, classify every system and prepare conformity assessments while there is time.
Looking Ahead: EU AI Act Compliance Beyond 2026
EU AI Act compliance is an ongoing commitment that will deepen over the coming years. As enforcement grows, the first regulatory actions and court decisions will set practical precedents for how the law applies. Gartner also expects AI governance spending to pass $1 billion by 2030 as regulation spreads to 75% of the world’s economies.
Agentic AI also brings compliance questions the original framework did not fully foresee. Autonomous agents that decide and act without human oversight create new kinds of risk that may need extra guidance or updates. Meanwhile, other countries are writing their own AI rules, so the global landscape keeps fragmenting.
For CIOs and compliance leaders, the message is clear. EU AI Act compliance is the floor, not the ceiling, and the regulation will keep changing as AI advances. Organizations that treat governance as a strategic capability instead of a regulatory burden will build the trust needed to scale AI responsibly in the world’s largest regulated market.
Our SolutionEnterprise AI Adoption and AI Readiness
Frequently Asked Questions
References
- AI Act Risk-Based Framework, High-Risk Obligations, Penalty Tiers, Extraterritorial Scope: European Commission — AI Act: Shaping Europe’s Digital Future
- Penalty Tiers and High-Risk Context: AI2Work — EU AI Act High-Risk Deadline: What August 2026 Means for Business
- Phased Enforcement Timeline, GPAI Obligations, National Authority Designations, Penalty Enforcement: DLA Piper — Latest Wave of Obligations Under the EU AI Act Take Effect
- Digital Omnibus: High-Risk Deadlines Moved to December 2027 and August 2028: AI Act Explorer — Digital Omnibus on AI
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.