To prepare for the EU AI Act yourself, inventory every AI system, decide whether you are a provider or a deployer, classify each system by risk tier, switch off anything prohibited, build AI literacy and transparency measures, and for high risk systems prepare the documented controls the Act lists. Track the application dates, which have changed.
What are the dates?
From the tracker at artificialintelligenceact.eu, last updated 31 August 2026 when we fetched it on 18 October 2026: prohibitions and AI literacy apply from 2 February 2025; general purpose AI model rules from 2 August 2025; the remainder of the Act from 2 August 2026; providers of generative AI systems already on the market have until 2 December 2026 for Article 50(2); high risk obligations for Annex III systems start 2 December 2027 and for Annex I systems 2 August 2028. These dates have been moving. Confirm them against the official text before you set a deadline.
Step 1: inventory
List every AI system you build, sell, embed or use, including chatbots, scoring tools, code assistants and vendor features. Record purpose, users, the people affected, the data and the supplier.
Step 2: decide your role
The Act treats providers, who develop or place a system on the market, differently from deployers, who use one. Many companies are both. Providers carry the heavier duties. A deployer who changes a system's purpose can take on provider duties, so check that for each system.
Step 3: check the prohibited list
Article 5 bans practices such as manipulative or deceptive techniques that distort behaviour, exploiting vulnerabilities, social scoring that leads to detrimental treatment, untargeted scraping to build facial recognition databases, emotion inference in workplaces and schools except for medical or safety reasons, and other listed uses. If any system looks close, stop and take advice.
Step 4: classify risk
The summary lists four tiers: unacceptable, high, limited and minimal. High risk covers safety components of products under the Annex I laws and the Annex III use cases: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and justice. A provider who decides an Annex III system is not high risk must document that assessment before placing it on the market. Write each classification down with the reason.
Step 5: AI literacy
Article 4 requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and others who use AI on their behalf. It scales with knowledge, context and who is affected. Run role based training and keep attendance and content records.
Step 6: transparency
Under Article 50, people must know when they are interacting with AI such as a chatbot, and deepfakes must be disclosed. Add clear notices to your interfaces and keep screenshots with dates.
Step 7: high risk obligations
For high risk systems, the summary lists for providers: a lifecycle risk management system, data governance for training, validation and test data, technical documentation and logging, instructions for use, human oversight by design, accuracy, robustness and cybersecurity, a quality management system, conformity assessment, a declaration of conformity and CE marking, and registration in the EU database. Deployers have fewer obligations. This is the long pole, so start with documentation and logging.
Step 8: general purpose AI
If you provide a general purpose model, the duties include technical documentation, information for downstream providers, a copyright policy and a training content summary. A voluntary Code of Practice, published 10 July 2025, helps show compliance. Using someone else's model makes you a downstream user, so ask the provider for what they must supply.
Mistakes to avoid
- Assuming the Act applies only to EU companies. The summary says it reaches third country deployers whose output is used in the EU.
- Guessing the tier. Document the reasoning.
- Ignoring vendor AI features.
- Treating the Act as a one time project.
What to do
- Build the inventory and role map.
- Screen against the prohibited list and record the result.
- Classify each system and write the reason.
- Start AI literacy training and a record of it.
- Add transparency notices where users face AI.
- Draft the high risk documentation set for any Annex III or Annex I system.
- Ask legal counsel to confirm role, classification and dates.
Quick check
Does the Act apply to us if we only use AI tools?
Deployers have duties, such as AI literacy and, for high risk use, a smaller set than providers. Check the role and tier for each tool.
Is there a certification for the Act?
High risk systems go through conformity assessment and CE marking as the Act defines. Other systems have no certificate, so keep your own records.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the documentation and logging an AI Act program needs can be gathered from connected systems and code instead of screenshots. Technical evidence from scans, SBOMs and reachability helps document the software components behind each AI system, and the cybersecurity expectations for high risk systems. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and keep evidence ready. It does not give legal advice or determine your risk tier. Book a call.
Sources
- EU AI Act implementation timeline, fetched 18 October 2026.
- EU AI Act high level summary, fetched 18 October 2026.
- Article 4, AI literacy, fetched 18 October 2026.
This is general information, not legal advice.
Last reviewed: 18 October 2026.
