At a glance
- The Act applies in stages; prohibited practices, general-purpose AI duties, transparency requirements, and high-risk obligations do not share one effective date.
- The 2026 AI Omnibus changed parts of the timetable, so static implementation spreadsheets can become stale without an authority and version ledger.
- Provider, deployer, importer, distributor, and downstream-provider obligations should remain distinct in the evidence model.
- Logging, technical documentation, data governance, human oversight, robustness, and post-market evidence require different sources and reviewers.
August 2026 is a milestone, not the finish line
The European Commission states that the AI Act entered into force in 2024 and applies through a staged calendar. Prohibited-practice and AI-literacy provisions began earlier, general-purpose AI obligations applied from August 2025, and Commission enforcement powers for applicable provisions began in August 2026.
The transparency layer also enters the operating present in August 2026. After the AI Omnibus, the high-risk timetable extends to December 2, 2027 for specified Annex III uses and August 2, 2028 for systems embedded in regulated products. Teams therefore need a calendar tied to the exact system and obligation, not a single launch-day checklist.
Classification creates the evidence plan
The first operational question is not 'Are we compliant?' It is: what is the system, what role does the organization play, where is it offered or used, which risk category applies, and which dependencies include general-purpose models or third-party components? Those facts decide which duties and dates matter.
A governed platform should retain the classification decision, source law and guidance, assumptions, reviewer, effective period, and later changes. If the system's purpose, user population, market, or model supply chain changes, the obligation set should be re-evaluated rather than silently carried forward.
Evidence is broader than a model card
High-risk obligations span risk management, data governance, technical documentation, logging, information for deployers, human oversight, accuracy, robustness, and cybersecurity. Transparency obligations and general-purpose AI duties add different records. No single artifact can prove that entire operating system.
The reusable layer is a controlled evidence graph: system inventory, role and classification, data lineage, model and version records, evaluation results, logs, incident and monitoring records, human-oversight design, notices, decisions, and released documentation. Each artifact can support multiple obligations while retaining its scope and limitations.
Change intelligence should create work, not rewrite history
When legislation, Commission guidance, harmonised standards, or a system classification changes, the platform should identify the affected obligation and mapped artifacts, create a review queue, and preserve the prior decision. It should not overwrite the earlier record as though the new rule had always applied.
That change discipline gives counsel, engineers, compliance teams, and assessors one inspectable basis for what was required at a point in time, what changed, which evidence remains reusable, and what must be refreshed or created.
Put it into practice
- Classify every AI system and organizational role against the current official text and guidance.
- Create an obligation calendar with applicability, effective date, owner, evidence contract, and reviewer.
- Separate general-purpose AI, transparency, high-risk, and product-embedded requirements rather than blending them.
- Version classification decisions and re-open them after material product, market, data, or model changes.
- Treat regulatory updates as impact projections over controls and evidence, never as silent status changes.
For the executive team
The EU AI Act is now an operating calendar with different duties for different systems and actors.
The strongest program turns that calendar into owned, source-linked evidence work and preserves the decisions that determine applicability.
One percentage hides the hard part. A versioned obligation-and-evidence graph makes it governable.
Primary sources
- AI Act regulatory framework and application timeline · European Commission
- The enforcement framework of the AI Act · European Commission
- AI Omnibus enters into force · European Commission