The Clock Is Ticking
The EU AI Act's general-purpose AI provisions take full effect in August 2026. That is six months from now. Based on what we are seeing across European and multinational enterprises, the vast majority are nowhere near ready.
This is not a GDPR replay where companies had two years of warning and still scrambled at the end. This is worse. The AI Act is more technically complex, the scope is broader, and the penalties are steeper: up to 7% of global revenue for the most serious violations.
What Most Companies Are Getting Wrong
- They think it only applies to high-risk AI. Wrong. The Act has requirements for all AI systems, including transparency obligations for any system that interacts with people. If your chatbot does not clearly identify itself as AI, you have a compliance gap.
- They are treating it as a legal problem. Compliance requires technical changes: documentation of training data, risk assessments, human oversight mechanisms, bias testing. Your legal team cannot write a policy that creates these capabilities. You need engineering resources.
- They have not inventoried their AI systems. Most companies do not have a complete catalog of where they use AI. Shadow AI, where teams deploy models without IT involvement, is rampant. You cannot comply with regulations for systems you do not know exist.
The Six-Month Sprint
If you are starting your AI Act compliance program now, here is a realistic plan:
- Months 1-2: Inventory and classify. Find every AI system in your organization. Classify each one under the Act's risk categories. This alone will take longer than you think.
- Months 2-3: Gap analysis. For each system, map current practices against the Act's requirements. Identify gaps in documentation, testing, monitoring, and governance.
- Months 3-5: Remediate. Close the gaps. This means building technical infrastructure for AI monitoring, creating documentation frameworks, implementing bias testing pipelines, and establishing human oversight protocols.
- Month 6: Validate and document. Test your compliance posture, prepare your technical documentation, and ensure your governance processes are operational.
The Opportunity Hidden in Compliance
Here is the contrarian view: the EU AI Act is actually good for serious AI companies. It raises the bar for AI quality, documentation, and governance in ways that weed out careless deployments. Companies that build compliant AI systems will have better products, fewer failures, and more customer trust.
The cost of compliance is real, but the cost of non-compliance, both in penalties and in broken AI systems, is far higher. Start now.