How to Prepare for the EU AI Act in 2026

What this is

The EU AI Act phases in through 2026 and 2027, with general-purpose AI (GPAI) provisions live since August 2025, prohibited-practice provisions since February 2025, and high-risk system provisions starting August 2026. This guide walks through what your company needs to do this year. It is informational, not legal advice; engage counsel for material decisions.

Step 1: Determine If the Act Applies to You

The Act applies if you:

• Place an AI system on the EU market (regardless of where you are based).
• Put an AI system into service in the EU.
• Use AI outputs that affect persons in the EU (even if the system is hosted elsewhere).
• Are a deployer of an AI system in the EU.

If yes to any: you are in scope. Many US and UK brands underestimate their scope because they sell to EU customers without realising they are "placing on the EU market".

Step 2: Classify Your AI Systems

Most companies have a mix. The biggest compliance burden falls on high-risk systems and on GPAI providers.

Step 3: For High-Risk Systems, Build the Documentation

High-risk AI systems require:

1. Risk management system covering the AI lifecycle.
2. Data governance documenting training, validation, and testing data.
3. Technical documentation detailing system design, performance, and limitations.
4. Logging automatic event-logging during operation.
5. Transparency and user information deployers can understand and use.
6. Human oversight design supporting effective human review.
7. Accuracy, robustness, and cybersecurity appropriate to the risk.
8. Quality management system for the provider.
9. Conformity assessment before placing on the market.
10. Registration in the EU database for high-risk systems.

Start with a gap analysis against this list. Most companies have parts in place but no consolidated documentation.

Step 4: For Limited-Risk Systems, Build the Transparency Layer

• Chatbots disclosed as AI to users at the start of interaction.
• AI-generated images / audio / video labelled where required.
• Emotion-recognition or biometric categorisation disclosed.
• Deepfakes labelled in line with the Act's transparency requirements.

Step 5: For GPAI Providers, Meet the Provider Obligations

• Maintain technical documentation describing the model and training process.
• Provide information to downstream providers integrating the model.
• Have policies for copyright compliance.
• Publish a sufficiently detailed summary of training data.
• For "systemic risk" models (above a compute threshold): additional risk assessment, red-teaming, incident reporting, and cybersecurity.

Step 6: Governance and Process

1. Designate a named AI governance owner (often the CTO, CISO, or Chief AI Officer).
2. Run quarterly AI inventory reviews.
3. Assign each in-scope system to a risk category and owner.
4. Stand up an internal AI Act committee with Legal, Engineering, Product, and Security.
5. Train staff who develop or deploy AI on the Act's basic requirements.

Step 7: Vendor Management

If you rely on third-party AI (LLM APIs, AI SaaS, GPAI models), update procurement to require:

• The provider's AI Act compliance posture.
• The provider's technical documentation under NDA.
• Allocation of responsibility in the contract (provider vs deployer vs distributor).
• Incident notification obligations from the provider.
• Right to audit or access compliance documentation.

Step 8: Plan for the Timeline

Common Mistakes

1. Assuming you are out of scope because you are based outside the EU.
2. Classifying high-risk systems as limited-risk to avoid the heavier obligations.
3. Treating GPAI provider obligations as the model vendor's problem only — deployers still have obligations.
4. No designated governance owner.
5. Vendor contracts that don't allocate AI Act responsibility.
6. Missing the staff AI literacy obligation (already in force since Feb 2025).