How to Prepare for EU AI Act Deadlines

If you are wondering how to prepare for EU AI Act deadlines when the dates keep shifting, the honest answer is to build the compliance work now and treat the calendar as the thing that moves.

Our earlier post covered the deadlines and the proposed Digital Omnibus changes that could defer some high-risk obligations. Whatever the final dates turn out to be, the groundwork is identical: know your AI systems, know your role, and be able to show your homework. This guide takes you through it in four practical steps.

What You Need Before You Start

Assemble a small working group: someone from legal or compliance, someone from engineering, someone who owns the product, and an executive sponsor who can unblock decisions. You also need access to your software inventory, your vendor contracts, and a list of every place your company uses AI, including tools employees adopted on their own.

Bookmark the official sources so you work from the text and not from hearsay: the European Commission’s AI regulatory framework page and the searchable AI Act Explorer. Because the timeline is under legislative discussion, check the current status of the Omnibus proposal before you commit to dates. This article is general information, not legal advice, so involve counsel for your specific situation.

Step 1: Inventory Your AI Systems and Classify the Risk

Start with a spreadsheet. List every AI system you build, buy or embed: chatbots, recommendation engines, CV screening, fraud detection, credit scoring, document analysis, code assistants. For each, record the purpose, the vendor, the data it uses, who is affected, and which EU markets it touches.

Then classify each one against the Act’s risk tiers. Some practices are prohibited outright, such as certain manipulative techniques and social scoring. High-risk systems include uses in areas like employment, education, essential services, and credit. Limited-risk systems, such as chatbots, mainly carry transparency duties. Many systems are minimal risk and face few obligations. Be honest here. Companies tend to under-classify the tools that make decisions about people, and that is where regulators will look first.

Remember the Act reaches beyond Europe. If your system’s output is used in the EU, you may be in scope even if your servers are elsewhere.

Step 2: Define Your Role and Set Up Governance

Obligations depend on whether you are a provider (you develop the system or put it on the market under your name), a deployer (you use it in your operations), an importer, or a distributor. One company can be several at once. A SaaS firm that builds a hiring tool is a provider, and its customer who uses it is a deployer.

Write the role down for every system, then assign an accountable owner. Create a lightweight AI governance policy that covers approval before a new AI tool is adopted, who signs off on risk classification, and how incidents are reported. Do not forget AI literacy. The Act expects people who operate AI systems to have a sufficient level of understanding, so schedule short, role-specific training and keep attendance records.

Review your contracts too. If you buy AI from a vendor, ask for their conformity documentation, their training data summaries where relevant, and a commitment to notify you of changes. If you sell AI, expect your customers to ask you the same.

Step 3: Build the Documentation and Controls for High-Risk Systems

For anything classified as high-risk, this is the heavy part, and it is where an early start pays off. Plan for these building blocks: a risk management process that runs through the whole lifecycle, data governance covering quality and bias checks for training and test data, technical documentation, automatic logging, clear instructions for users, human oversight measures, and appropriate accuracy, robustness and cybersecurity.

You do not need to invent the method from scratch. The NIST AI Risk Management Framework and ISO/IEC 42001 for AI management systems give you structures that map well onto the Act’s requirements. Pick one, adapt it, and keep the evidence in a single place.

Engineers should treat this like any other quality discipline. Version your models and datasets, log decisions, write test plans, and make sure a human can actually intervene, not just in theory. If you are building new systems, bake these controls in now. Retrofitting them later costs several times more.

Step 4: Build a Timeline That Survives Date Changes

Because the high-risk dates have been the subject of proposed delay, build a plan with three layers. First, things that apply now or already applied: prohibited practices, AI literacy, and obligations for general-purpose AI model providers. Make sure those are done. Second, the preparatory work that is needed whatever the final date is: inventory, classification, governance and documentation. Third, a review checkpoint every quarter, where legal confirms the current status of the rules and you adjust the schedule.

Assign owners and dates to each task, track them in your normal project tool, and report progress to leadership. Fines under the Act can be severe, reaching up to 35 million euros or 7 percent of worldwide turnover for the most serious breaches, so this deserves a place on the risk register.

Common Mistakes to Avoid

Waiting for final dates. A delay in obligations is not a delay in customer questions. Enterprise buyers and procurement teams already ask for AI governance evidence.

Ignoring shadow AI. Staff using unapproved tools with company data create exposure you have not classified. Survey the teams and offer approved alternatives.

Treating it as a legal-only project. Compliance lives in the code, the data pipelines and the product design. Without engineering ownership, the paperwork will not match reality.

Key Takeaways

• Inventory first: You cannot classify or document what you have not listed.
• Know your role: Provider and deployer duties differ, and you may be both.
• Use existing frameworks: NIST AI RMF and ISO/IEC 42001 save time.
• Plan for movement: Do the date-independent work now and review the timeline quarterly.
• Verify with counsel: Rules and proposals change, so confirm the latest position.

Need Expert Help?

If this feels like a lot to manage alone, TecniForge can handle the heavy lifting. Our team specializes in custom software development and AI integration. Get in touch with our experts.

Also read: EU AI Act deadlines and dates, our earlier coverage on why this matters today.

Here is a challenge you can finish this week: list every AI tool your company uses, and put a risk tier next to each one. The gaps you find will tell you where to start.