You can get ready for the EU AI Act in twelve weeks by inventorying every AI system, classifying risk, deciding your role as provider or deployer, closing the duties that already apply, and planning documentation for any high risk system. Dates shifted after the AI Omnibus, so start by checking the current timeline.
What are the dates today?
The European Commission's AI Act page, last updated 3 August 2026, gives this timeline: entry into force on 1 August 2024, prohibited practices and AI literacy from 2 February 2025, governance and general purpose AI obligations from 2 August 2025, transparency rules from August 2026, high risk rules for Annex III uses from 2 December 2027, and for AI embedded in regulated products from 2 August 2028. It describes the AI Omnibus, which entered into force on 27 July 2026, as the change that extended the high risk timelines. Confirm again at the start of your project.
Weeks 1 to 2: inventory
List every AI system you build, buy, embed or let staff use, including chatbots, scoring tools, code assistants and AI features inside software. For each, record owner, vendor, purpose, data, users and whether people in the EU are affected. Include systems that are trial or shadow use. Output: an inventory with an accountable owner per row.
Weeks 3 to 4: classify
Sort each system into the Commission's categories: prohibited, high risk, transparency risk or minimal. Prohibited practices include social scoring and emotion recognition in workplaces and education, among others the page lists. High risk covers uses such as critical infrastructure, education, employment, credit scoring, law enforcement, migration and justice. Chatbots and generated content fall under transparency duties. Write a short rationale per system, and get legal review for any borderline case.
Weeks 5 to 6: roles and literacy
Decide for each system whether you are a provider, a deployer, or both, since duties differ. Then close the duties already in force. AI literacy has applied since 2 February 2025: define who uses AI, what they need to know, deliver training and keep attendance and content records. Remove or redesign any system that touches a prohibited practice.
Weeks 7 to 8: transparency
For chatbots, make sure users are told they are interacting with a machine. For generative systems, plan how content is made identifiable, and label deepfakes as the page describes. Review product screens, scripts and exports. Capture before and after screenshots as evidence of the change you made.
Weeks 9 to 10: high risk readiness
If any system is high risk, the Commission page lists provider obligations: risk management, data quality, logging, documentation, human oversight, and resilience and cybersecurity. Start a gap list against each. Write a documentation outline, decide how logs are kept, define the human oversight role and test points for resilience. Your date for full compliance may be December 2027 or August 2028, but design choices made now are cheaper than rework.
Weeks 11 to 12: governance and monitoring
Set up an AI governance owner, a review cadence, a change check for new AI use, and a post deployment monitoring plan. Set up incident handling, including who reports serious incidents; read the Act's incident article for the exact deadlines, since the Commission page does not list them. Present a summary to leadership with the inventory, classifications, gaps and costs, and keep minutes.
What to do
- Check the current timeline and write the dates into your plan.
- Build the inventory in two weeks and assign owners.
- Classify each system and record the reasoning.
- Decide provider or deployer roles.
- Deliver and record AI literacy training.
- Fix chatbot and generated content disclosures.
- Start gap lists for any high risk system.
- Create governance, change checks and an incident procedure.
- Brief leadership and schedule quarterly reviews.
Quick check
Is AI literacy already required?
Per the Commission's page, AI literacy obligations have applied since 2 February 2025.
When do high risk rules for Annex III uses apply?
2 December 2027 according to the Commission page, after the AI Omnibus. Check for later changes.
How Safeguard helps automate this
The inventory and the evidence behind it are where the calendar slips. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews, which frees your team for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, showing which AI libraries and model packages you actually ship. The agent can open tested fix pull requests, but it is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare evidence; it does not classify your systems for regulators or certify conformity. See the mapping demo below or book a call.
Open the framework mapping demo
Sources
Last reviewed: 18 October 2026.
