A CTO's EU AI Act decisions are which of your systems count as high risk, who owns compliance, what logging and documentation to build, and when. The Commission lists high risk obligations for sensitive areas from 2 December 2027, so there is time, but not enough to start late.
What has changed on timing?
According to the European Commission, the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions. Prohibited practices and AI literacy applied from 2 February 2025. Governance and general purpose AI model obligations applied from 2 August 2025. After the AI Omnibus, which the Commission says entered into force on 27 July 2026, high risk rules for areas such as biometrics, critical infrastructure, education, employment, migration and border control apply from 2 December 2027, and rules for AI built into regulated products apply from 2 August 2028. Check the Commission page for changes.
Which decisions are the CTO's?
Classification. For each system, decide with legal whether it is prohibited, high risk, subject to transparency duties, or minimal. Getting this wrong in either direction costs money.
Role. Are you the provider that places a system on the market, a deployer that uses one, or both? If you build on third party models, clarify who carries which duties by contract.
Ownership. Name an accountable executive and a program lead across engineering, legal, security and product.
Engineering requirements. The Commission lists, for high risk systems, risk assessment and mitigation, high quality datasets, logging for traceability and detailed documentation. Each becomes work: data lineage, audit logs, technical files, and tests.
Sequencing. Decide which systems to bring into shape first, based on exposure and the earliest deadlines.
Budget. Include staff time for documentation, not only tooling.
A constructed example
A company has three AI features: a marketing copy generator, a resume screening module, and an internal code assistant. The CTO and counsel classify them. The generator may need transparency steps for generated content. The resume tool falls under employment, a high risk area the Commission lists, with a 2 December 2027 date. The code assistant is likely minimal. The CTO puts the resume tool first, assigning an owner, an audit logging epic, and a documentation sprint, and starts a register for the other two.
What should you build regardless of tier?
Three things pay off anyway: an inventory of AI systems with owners, logs that let you reconstruct what a system did, and written records of data sources and testing. They help with customer questionnaires, incident response and other frameworks.
How to act now
- Build the AI inventory.
- Classify each system with counsel.
- Confirm provider or deployer role.
- Review vendor contracts for AI duties.
- Start with the highest risk system.
- Add logging and documentation to the roadmap.
- Schedule a dates check each quarter.
- Brief the board in plain terms.
Safeguard's compliance automation can help organize controls and evidence; legal classification and compliance decisions remain yours.
What are the usual mistakes?
Waiting for perfect clarity is the biggest: the dates are staged, but evidence takes months to build. Another is assuming a vendor's model removes your obligations. A third is treating the Act as a legal-only matter; logging, data lineage and testing are engineering work with long lead times. Also avoid over classifying everything as high risk, which wastes effort, or under classifying to save it. Keep a decision record for each system explaining the reasoning, and revisit when features change. Finally, do not forget that other laws, such as data protection rules, apply alongside the Act.
Quick check
When do high risk rules apply?
For the sensitive areas listed by the Commission, from 2 December 2027. For AI in regulated products, from 2 August 2028.
Does using a third party model remove our duties?
Not automatically. Roles depend on what you build and deploy. Review with counsel and in your contracts.
Sources
Last reviewed: 18 October 2026.
