The EU AI Act applies in stages, with obligations depending on whether you provide or deploy an AI system and on its risk class. DevOps owns the practical parts: logging for traceability, version control of systems, incident handling and keeping documentation current. Dates have moved before, so check the Commission page.
Which dates matter?
Using the Commission's overview and a public implementation timeline last updated 31 August 2026: prohibitions 1 to 8 applied from February 2025; rules for general purpose AI models from August 2025; most remaining provisions from 2 August 2026; and a ninth prohibition, on AI that generates non-consensual intimate imagery and child abuse material, from December 2026 after the AI Omnibus. The Commission says high risk obligations start on 2 December 2027.
The transparency rules take effect in August 2026. Providers whose generative systems were already on the market before 2 August 2026 have until 2 December 2026 to meet the content marking duty in Article 50(2), according to the timeline.
What does the Act ask of high risk systems?
The Commission lists these obligations before a high risk system goes to market: risk assessment and mitigation, dataset quality, logging of activity to ensure traceability, detailed documentation, clear information to the deployer, human oversight, and robustness, cybersecurity and accuracy.
Engineers recognize several of those. Logging, versioning, access control and testing are normal practice. What changes is that you must be able to show them for a defined system, tied to its intended purpose.
What should DevOps do before the lawyers finish?
Do not wait for a final classification. Some groundwork pays off under any outcome. Build an inventory of AI systems with owners. Decide what a trace of a decision looks like, and where it is stored. Make sure a system's model version, configuration and data sources can be reconstructed for a given date.
Logs raise a tension with privacy law. A trace that records full user inputs may itself hold personal data, so set retention and access rules with your privacy lead.
A constructed example
A recruiting software vendor adds a resume ranking feature, which falls into the employment category the Commission names as high risk. DevOps is asked, "Can you show why candidate 4,112 was ranked below candidate 4,113 last March?" The answer needs the model version, prompt or feature set, input snapshot and output score from that date. If any is missing, the system cannot meet the traceability aim. Capturing them costs far less at build time than later.
What to do
- Ask legal whether you are a provider, a deployer or both for each AI system.
- Classify each system against the Commission's risk categories and record the reasoning.
- Put the key dates into a shared calendar, and recheck the Commission page quarterly.
- Define a trace record for decisions: model version, configuration, inputs, outputs, timestamp.
- Set retention and access for traces with your privacy lead.
- Document intended purpose, limits and a human override path for each system.
- Add AI incidents to your incident runbook, including who decides on reporting.
Safeguard's policies and gates and compliance automation can help hold the evidence together. They do not decide your legal role.
Quick check
When do high risk obligations start?
The Commission states 2 December 2027 for high risk AI systems. Check its page, because dates have changed during the Omnibus process.
Is logging required for every AI system?
The Commission lists logging for traceability as an obligation for high risk systems. Lower risk systems face different duties, such as transparency.
Sources
- European Commission, regulatory framework for AI
- EU AI Act implementation timeline, last updated 31 August 2026
Last reviewed: 18 October 2026.
