EU AI Act readiness
EU AI Act readiness, built into how AI systems run
The EU AI Act sets obligations by role and risk. Meeting them depends on records most companies do not keep yet: which AI systems exist, who owns them, how people oversee them, and what changed.
Sentient builds the inventory, ownership, controls, and evidence those obligations rely on. Regulatory status shown as of October 2026.
01
- Role
- Risk
- Record
What readiness means
Obligations attach to systems and roles. Start with both.
The EU AI Act, Regulation (EU) 2024/1689, is a risk-based law. What a company must do depends on its role for each AI system, usually provider or deployer, and on the system's category: prohibited, high-risk, subject to transparency duties, or a general-purpose AI model.
Readiness is operational. It means knowing every system in scope, recording each classification decision, assigning owners, and keeping the documentation, oversight, and monitoring records the obligations call for.
Sentient builds that governance into the tools, workflows, and processes teams already use, so controls, approvals, evidence, and review come out of the work itself instead of extra tasks.
Questions to answer for each system
- Is it an AI system under the Act?
- Are we its provider, deployer, or both?
- Which risk category applies?
- Who owns the system and its records?
- Which changes would alter its classification?
Role and risk classification
02
- 2024
- 2026
- 2028
When EU AI Act obligations apply
The application timeline, as amended in July 2026
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It replaced the original high-risk dates with fixed later ones. Status as of October 2026.
01
1 August 2024
Entry into force
The AI Act entered into force. Its obligations apply in stages.
02
2 February 2025
Prohibitions and AI literacy
Prohibited AI practices apply. Article 4, as amended in July 2026, requires providers and deployers to take measures to support the AI literacy of their staff.
03
2 August 2025
General-purpose AI models
Obligations for providers of general-purpose AI models apply. The Commission's powers to enforce them, including fines, apply from 2 August 2026.
04
2 August 2026
Transparency and general application
Article 50 transparency duties apply, such as telling people they are interacting with AI and labeling deepfakes. Generative AI systems on the market before this date have until 2 December 2026 for machine-readable marking.
05
2 December 2027
High-risk, Annex III
Obligations apply to the high-risk use cases in Annex III, including biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, and border management.
06
2 August 2028
High-risk, Annex I
Obligations apply to AI systems that are safety components of products covered by EU product safety legislation.
03
- Inventory
- Classify
- Own
Inventory, classification, and ownership
Know which systems you have and what role you play
Every later obligation depends on this first record being complete and current.
01
AI system inventory
A current list of AI systems you build, buy, or embed in products, with purpose, users, data, and the markets where outputs are used.
Systems and dependencies
02
Role determination
Whether you place each system on the market under your name, use it under your authority, or both. Substantially modifying a high-risk system can make a deployer its provider.
Provider or deployer
03
Risk classification
A recorded decision on each system's category, with the reasoning. A provider that concludes an Annex III system is not high-risk must document that assessment.
Prohibited, high-risk, transparency, GPAI
04
Ownership and accountability
A named owner for each system, with defined authority boundaries for approving use, changes, and suspension.
Decision rights
05
Third-party dependencies
Which models, vendors, and components each system relies on, and what documentation and instructions those providers supply.
AI vendor risk
06
Change traceability
A record of model, data, and purpose changes, and whether each change calls for a new classification or conformity review.
Substantial modification
04
- Document
- Oversee
- Monitor
Obligations and operating records
What the Act requires, and what the record should show
Most of these duties attach to high-risk systems from December 2027. Building the records takes longer than reading the articles.
What the Act requires
What the operating record shows
What the Act requires
A risk management system for each high-risk AI system, run across its lifecycle (Article 9).
What the operating record shows
A risk register tied to the system, reviewed on a set cadence and whenever the system changes.
What the Act requires
Technical documentation drawn up before the system is placed on the market and kept up to date (Article 11 and Annex IV).
What the operating record shows
Versioned documentation with a named owner, updated as part of each release.
What the Act requires
Automatic logging, with deployers keeping logs under their control for at least six months (Articles 12 and 26).
What the operating record shows
Defined log sources, retention periods, and an owner who can produce the logs on request.
What the Act requires
Human oversight designed in by providers and assigned by deployers to people with competence, training, and authority (Articles 14 and 26).
What the operating record shows
Named reviewers, the points where human review can change or stop an outcome, and a record of their decisions.
What the Act requires
Post-market monitoring and reporting of serious incidents to market surveillance authorities (Articles 72 and 73).
What the operating record shows
A monitoring plan, an escalation path with named decision makers, and an incident record showing who acted and when.
What the Act requires
Measures to support the AI literacy of staff and others operating AI systems (Article 4).
What the operating record shows
Role-based guidance and training records for the people who build, operate, and review each system.
Sentient defines these controls and builds the records around them. Your own systems enforce the controls; Sentient is not the enforcement platform.
05
- Question
- Answer
Questions, answered
EU AI Act questions, answered
When do EU AI Act obligations apply?
In phases. Prohibitions and AI literacy have applied since 2 February 2025, general-purpose AI model obligations since 2 August 2025, and transparency duties since 2 August 2026. Since the Digital Omnibus on AI, high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in regulated products.
Does the EU AI Act apply to U.S. companies?
It can. The Act covers providers that place AI systems or general-purpose AI models on the EU market wherever they are established, and providers and deployers outside the EU when the output of their AI system is used in the EU. Whether a specific system is in scope is a question for counsel.
AI governance consultingWhat does EU AI Act readiness involve?
An inventory of AI systems, a recorded role and risk classification for each, named owners, human oversight that can change outcomes, and current records of documentation, changes, monitoring, and incidents. Readiness means those records exist before an authority, customer, or auditor asks for them.
AI governance implementationDoes ISO/IEC 42001 certification mean EU AI Act compliance?
No. An ISO/IEC 42001 management system or a NIST AI RMF program can supply much of the structure the Act expects, such as ownership, risk processes, and documentation. Neither one establishes conformity with the AI Act on its own.
ISO/IEC 42001 readinessCan Sentient certify EU AI Act compliance?
No. Sentient does not audit, certify, or manufacture assurance, and it does not give legal opinions. It builds the operating records and controls that counsel, notified bodies, and independent reviewers examine.
AI diligence and assurance readiness
06
- Source
- Status
Sources and status
Primary sources for the dates on this page
Regulatory status as of October 2026. Implementing guidance and harmonised standards are still being published.
- Regulation (EU) 2024/1689, the Artificial Intelligence Act
Official Journal of the European Union, 12 July 2024. Entered into force 1 August 2024. EUR-Lex.
- Regulation (EU) 2026/1744, the Digital Omnibus on AI
Adopted 8 July 2026, published 24 July 2026, in force 27 July 2026. Sets the new high-risk dates and the amended Article 4. EUR-Lex.
- Consolidated text of the AI Act, version of 27 July 2026
Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. EUR-Lex.
- Council of the EU: final approval of the Digital Omnibus on AI
Press release, 29 June 2026. Confirms the fixed dates of 2 December 2027 and 2 August 2028.
- European Commission: AI Act regulatory framework
Commission overview of the AI Act, its implementation, and AI Office guidance.
Legal note
Sentient is not a law firm and does not give legal opinions. It builds the operating records, controls, and evidence that compliance programs and counsel rely on. For interpretation of the AI Act as it applies to your systems, consult qualified counsel.
07
- Discuss
- Design
- Implement
- Operate
Be ready before they ask
Build the operating structure before the next customer, investor, insurer, partner, or buyer demands proof.
Sentient builds the governance structure companies need to show how AI is owned, controlled, reviewed, evidenced, and operated. Talk to Sentient about what your customers, investors, insurers, partners, or buyers will expect to see.