The most common EU AI Act mistakes are treating the Act as someone else's problem, guessing your risk tier, forgetting vendor AI, trusting old dates, skipping AI literacy and transparency, and writing documents after the fact. Each has a direct fix, and most take days, not months.
1. Assuming it applies only to European companies
The high level summary we read on 18 October 2026 says the Act applies to EU based deployers and to third country deployers whose system output is used in the EU. If you sell to or serve people in the EU, check your position. Fix: list where your AI outputs reach EU users and customers.
2. Not knowing your role
Providers and deployers have different duties, and many companies are both. A team that buys a model and builds a product on it may be a provider of the product. Fix: write the role for each system and the reason, and ask counsel to review borderline cases.
3. Guessing the risk tier
Teams label everything minimal risk, or label everything high risk and panic. The summary lists four tiers and names Annex III areas, such as employment, education, essential services and biometrics. A provider who concludes an Annex III system is not high risk must document that assessment before placing it on the market. Fix: classify each system with a short written reason and keep it.
4. Missing AI you did not build
Vendor features turn on in software you already pay for: meeting summaries, support bots, scoring modules. Fix: sweep spend, admin consoles and code dependencies for AI, and add each to the inventory with an owner.
5. Working from stale dates
The tracker at artificialintelligenceact.eu, updated 31 August 2026, lists: prohibitions and AI literacy from 2 February 2025; general purpose AI duties from 2 August 2025; most of the rest from 2 August 2026; Article 50(2) for generative systems already on the market by 2 December 2026; Annex III high risk from 2 December 2027; Annex I high risk from 2 August 2028. Posts and slides from earlier years may show other dates for high risk systems. Fix: write the date and the source next to every deadline in your plan, and recheck against the official text each quarter.
6. Skipping the duties that already apply
Article 4 on AI literacy and the prohibitions have applied since 2 February 2025 according to the tracker. Many teams wait for high risk dates and miss these. The Article 4 duty is to take measures, to the best extent, for a sufficient level of AI literacy among staff and others using AI for you, adjusted to their knowledge and the context. Fix: run role based training now and keep records. Also check the Article 50 transparency notices, which the page lists as applying from 2 August 2026.
7. Writing documentation after the fact
For high risk systems the summary lists technical documentation, logging, risk management, data governance and a quality management system. Reconstructing these after the system ships produces gaps, because the training data decisions and test results are gone. Fix: add documentation steps to your build process now, with a template and an owner.
A note on general purpose models
If you build a general purpose model, duties include technical documentation, information for downstream providers, a copyright policy and a training content summary. If you use one, ask your provider for what they owe you, and record the request and the reply. The page mentions a voluntary Code of Practice from July 2025.
What to do
- Map where your AI outputs reach EU users.
- Write each system's role and risk tier with a reason.
- Sweep for vendor and shadow AI.
- Put dated sources next to every deadline.
- Start AI literacy training and transparency notices.
- Add documentation and logging steps to the build process for high risk work.
- Ask counsel to check borderline calls.
Quick check
What is the first thing to do?
Build the inventory. Role, tier and duties all depend on knowing which AI systems you build, sell and use.
Are the dates final?
The tracker we read lists the dates above, and the high risk dates have moved before. Confirm in the official text.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so records such as logs of what changed and when can be gathered from connected systems and code instead of screenshots and kept ready. Technical evidence from scans, SBOMs and reachability shows which model libraries and dependencies your software contains, which helps catch AI you did not know you shipped. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare. It does not give legal advice or classify your risk tier. Book a call.
Sources
- EU AI Act implementation timeline, fetched 18 October 2026.
- EU AI Act high level summary, fetched 18 October 2026.
- Article 4, AI literacy, fetched 18 October 2026.
This is general information, not legal advice.
Last reviewed: 18 October 2026.
