EU AI Act Compliance Roadmap: Deadlines, Risk Tiers & Enterprise Action Plan
Artificial intelligence (AI) has moved from boardroom experiment to boardroom risk. With the EU AI Act now in force, every enterprise that builds, buys, or deploys AI is entering a new era of accountability.
This is the world’s first comprehensive AI law: a regulation that mandates risk classification, documentation, oversight, and transparency across the entire AI lifecycle.
For executives, the Act is more than a compliance checklist. It sets a global benchmark, shaping markets far beyond Europe through the so-called “Brussels Effect.” Non-EU companies whose systems or outputs are used within the Union must comply, and penalties climb as high as €35 million or 7% of turnover.
This guide unpacks the AI Act in practical terms. It explains how the risk tiers work, which obligations apply to each role in the AI value chain, the deadlines you cannot miss, and most importantly, how to turn regulatory requirements into an actionable enterprise roadmap.
Why the EU AI Act Matters
On 12 July 2024, the AI Act was published in the EU’s Official Journal, entering into force the following August. It is the first comprehensive AI law globally, applying not only to EU entities but also to any provider, deployer, importer, distributor, or authorised representative whose AI systems or outputs are used within the Union.
In practice, this means non-EU firms are directly in scope. Providers established abroad must appoint an authorised representative within the EU to ensure accountability, as confirmed in European Commission guidance.
The Act sits alongside the GDPR and the Digital Services Act. Recital 10 explicitly reaffirms the primacy of the GDPR for personal data, ensuring continuity of rights. Recital 118 links AI governance with platform regulation under the DSA, while Recital 136 highlights risks to democracy from AI-generated disinformation.
Legal analysts, including Goodwin Procter LLP, note that these recitals position the Act within a broader EU digital-regulation framework. Importantly, the AI Act is fundamentally a product-safety law, whereas the GDPR is a rights-based law. Together, they ensure AI systems are both technically safe and respectful of individual freedoms.
For enterprises, the key takeaway is that this regulation is not abstract policy but now a binding law with global reach, setting the baseline for how AI must be developed, deployed, and governed.
Risk-Based Framework and Definitions
At the heart of the AI Act is a risk-based approach. Instead of treating all AI systems equally, the law calibrates obligations by the level of risk they pose to individuals and society. Knowing where your AI falls in this framework is the essential first step in planning compliance.
Unacceptable Risk
Certain applications are banned outright from 2 February 2025. Article 5 prohibits placing on the market AI that uses manipulative subliminal techniques or exploits vulnerabilities based on age or disability.
The ban also covers government-led social scoring, predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in classrooms or workplaces, and biometric categorisation of sensitive traits.
High-Risk Systems
Annex III of the EU AI Act lists categories of AI considered high-risk. These include safety-related applications in critical infrastructure, education and vocational training, employment and worker management, access to essential services such as credit and insurance, law enforcement, migration and border control, and judicial decision-making.
High-risk AI must comply with strict obligations, including risk management and data governance. The European Commission highlights these in Articles 9 and 10 of the Act, making them non-negotiable for providers. Deployers using high-risk AI in credit or insurance must also conduct a Fundamental Rights Impact Assessment (FRIA) before deployment, as emphasised in an analysis by privacy platform Securiti.
Limited-Risk Systems
Limited-risk AI systems are subject to transparency obligations. Users must be informed when they interact with AI, and AI-generated content or deepfakes must be labelled, according to Commission guidance.
Minimal-Risk Systems
Minimal-risk systems, such as spam filters, remain largely unregulated. The Act encourages voluntary adherence to ethical guidelines.
Key Definitions
- AI system: A machine-based system that infers from input data to generate outputs such as predictions, recommendations, or decisions.
- Provider: Any natural or legal person, or public authority, that develops or markets an AI system under its own name.
- Deployer: Any natural or legal person, or public authority, that uses an AI system under its authority, except for personal non-professional use.
- Importer: An EU-based entity placing a non-EU AI system on the EU market.
- Distributor: An entity making an AI system available in the EU supply chain without altering its properties.
- GPAI model: A general-purpose model trained with significant compute power (≥10^23 FLOP) and adaptable across domains. Systemic-risk GPAI models (defined at ≥10^25 FLOP) face additional obligations, as Commission documents make clear.
EU AI Act Timeline and Deadlines
Timeline and Deadlines
Compliance under the AI Act does not arrive all at once. The law unfolds through a phased timeline of obligations that stretch from 2024 through 2030. Enterprises must align their internal programmes with these deadlines to avoid last-minute compliance scrambles.
- 12 July 2024: Regulation published in the Official Journal.
- 1 August 2024: Act enters into force.
- 2 November 2024: Member States designate national regulators.
- 2 February 2025: Ban on prohibited practices; AI literacy requirements for public sector begin.
- 2 May 2025: Codes of practice for high-risk systems due.
- 2 August 2025: Obligations for GPAI models begin; the AI Office and AI Board become operational.
- 2 August 2026: Majority of obligations apply, including high-risk provider and deployer requirements and FRIA duties. DLA Piper, an international law firm, has described this as the real inflection point for most enterprises.
- 2 August 2027: Extended transitional deadlines for embedded high-risk AI, such as medical devices.
- December 2026: Revised Product Liability Directive must be transposed by Member States, introducing liability for AI software.
- 2030: EU large-scale IT systems must fully comply.
White & Case, a global law firm, has called this rollout the most ambitious sequencing of regulatory deadlines ever applied to AI, warning enterprises that regulators will expect measurable progress at each stage.
Obligations by Role
The AI Act assigns duties differently depending on an organisation’s role in the AI value chain. Understanding these distinctions ensures that accountability lands where it belongs.
Providers
Providers must establish comprehensive risk management systems, ensure data quality, maintain technical documentation, keep logs, and provide transparency and oversight mechanisms. High-risk providers must conduct conformity assessments, draft EU declarations of conformity, affix CE markings, register systems in the EU database, and report serious incidents within 15 days.
GPAI providers must also publish summaries of training data, implement copyright-compliance policies, and share safe-use information with downstream providers. Providers established outside the EU must appoint authorised representatives within the Union.
Deployers
Deployers must adhere to provider instructions, monitor system performance, ensure data relevance, and assign trained human overseers. They must notify employees before deploying high-risk AI in the workplace, inform affected individuals, retain logs for six months, report incidents within 15 days, and conduct FRIAs in credit and insurance contexts. WilmerHale, a US law firm, highlights that failure to meet these duties can create liability across multiple EU regimes.
Importers
Importers must verify conformity, CE markings, and documentation. They must display their contact details, keep records for ten years, and cooperate with regulators.
Distributors
Distributors must check that CE markings and documentation are present, maintain proper storage conditions, and take corrective measures if non-compliance arises.
GPAI Providers
General-purpose model developers must publish technical documentation, inform downstream users of model capabilities and limitations, summarise training data sources, and implement copyright-compliance policies. Systemic-risk GPAI models require adversarial testing, model evaluation, and systemic risk reporting. A voluntary Code of Practice guides compliance in transparency, copyright, and safety/security.
In short, every participant in the AI lifecycle carries weight. Enterprises need to know which roles they play and when they act as more than one role simultaneously.
Fundamental Rights Impact Assessments (FRIA)
FRIAs are where compliance collides with rights. They are designed to identify and mitigate risks to individuals’ fundamental freedoms before systems go live. For enterprises, this means every high-risk deployment in sensitive contexts must undergo scrutiny that goes beyond technical checks.
FRIAs are mandatory for deployers using high-risk AI in biometric identification, education, employment, essential services, law enforcement, migration, or justice. Critical infrastructure systems are exempt. Each FRIA must describe the process, frequency of use, affected categories of individuals, risks, oversight measures, and mitigation strategies.
These assessments complement GDPR’s Data Protection Impact Assessments, ensuring data protection and human rights risks are jointly assessed. Securiti notes that organisations treating the FRIA as a box-ticking exercise risk reputational as well as regulatory damage.
For business leaders, the FRIA is not a formality. It is a reputational safeguard, and failures here will be highly visible to regulators, courts, and the public.
Penalties, Enforcement, and Governance
The AI Act is backed by penalties that can reshape balance sheets. This makes compliance not just a legal risk, but a financial and strategic one.
- Up to €35 million or 7% of global turnover for prohibited practices.
- Up to €15 million or 3% for non-compliance with obligations.
- Up to €7.5 million or 1% for supplying false or misleading information.
Enforcement will be carried out by national authorities, designated by November 2024, and coordinated through the EU’s new AI Office and AI Board, both operational as of 2 August 2025. A Scientific Panel of independent experts advises on systemic-risk GPAI models. Member States must also establish complaint mechanisms and whistle-blowing channels.
As DLA Piper’s analysis highlights, enforcement will not only be national. The AI Office creates an EU-wide layer of oversight that enterprises must be prepared to engage with
Interplay With Other EU Regulations
The AI Act is not a standalone law. It is part of a dense regulatory web, and enterprises must plan for overlapping regimes.
- GDPR: Governs data rights; AI Act governs system safety. The AI Act operates without prejudice to the GDPR.
- DSA/DMA: Introduce platform transparency and fair competition. Overlaps appear around algorithmic transparency and documentation. Goodwin Procter LLP points to Recital 118 and 136 as key bridges between the AI Act and platform rules.
- NIS2/DORA: Impose resilience and cybersecurity requirements, aligning closely with AI Act obligations on robustness and incident reporting.
- Revised Product Liability Directive: Expands strict liability to cover AI software, effective December 2026.
Irish law firm William Fry has advised that these overlapping regimes must be managed holistically, as enterprises that silo them risk duplication of effort and regulatory blind spots.
Enterprises, then, must view compliance holistically. Overlaps are inevitable, but coordinated planning can turn this from a burden into a competitive advantage.
Enterprise Action Plan
Phase 1: Inventory & Gap Assessment (0–60 days)
This opening phase is about gaining visibility and accountability. Enterprises cannot prepare for audits or meet regulatory deadlines without knowing exactly what AI they use and how it maps to obligations. Visibility, classification, and literacy form the foundation.
Key actions:
- Catalogue all AI systems and GPAI models developed, procured, or integrated, including embedded SaaS features.
- Classify each into the Act’s four risk tiers (unacceptable, high-risk, limited-risk, minimal-risk).
- Identify whether any models meet GPAI or systemic-risk thresholds (≥10^23 or ≥10^25 FLOP) and log their training data sources and compute.
- Map input and output data flows for GDPR compliance, verifying lawful bases and checking data minimisation against model requirements.
- Run a full gap analysis: compare existing controls with provider and deployer obligations (risk management, documentation, logging, oversight, transparency, cybersecurity).
- Benchmark against industry surveys. In a 2024 report, Arthur Cox, an Irish law firm, found that only 20% of firms have AI risk or procurement policies, and just 25% offer AI literacy training.
- Assign accountability: appoint an AI compliance officer, integrate with the DPO, and secure board-level sponsorship.
- Launch AI literacy programmes for executives and staff to meet early literacy requirements effective February 2025.
- Begin FRIA scoping for high-risk applications in education, employment, essential services, law enforcement, migration, or justice.
Neglecting these steps risks rushed compliance and exposure to early enforcement once prohibited practices and GPAI rules take effect.
Phase 2: Design & Implement Controls (60–180 days)
With visibility in place, the next phase focuses on embedding obligations into enterprise controls. This period is critical for developing documentation, oversight, and technical robustness before high-risk requirements bite.
Key actions:
- Establish formal risk-management and quality-management systems, covering dataset curation, bias checks, and provenance tracking.
- Produce detailed technical documentation for each system, covering purpose, architecture, training data, evaluation, testing, and cybersecurity.
- Implement robust logging to record operations, maintaining logs for six months (deployers) or ten years (providers).
- Prepare transparency materials and safe-use guidelines for deployers and downstream providers.
- Assign trained human overseers for high-risk systems with escalation and override authority.
- Carry out conformity assessments for high-risk systems, prepare EU declarations, affix CE marks, and register systems in the EU database.
- Update procurement and vendor contracts to mandate AI Act compliance, including data quality, transparency, oversight, and incident reporting clauses.
- Conduct FRIAs for high-risk deployments and integrate with GDPR DPIAs to streamline compliance.
- Establish incident reporting protocols to notify competent authorities within 15 days and conduct red-teaming exercises to test resilience.
This phase translates obligations into practical governance. Failure to act here leads directly to exposure once broad high-risk obligations become enforceable in August 2026.
Phase 3: Continuous Monitoring & Literacy (180+ days)
Compliance is ongoing. The final phase institutionalises monitoring, auditing, and policy refresh cycles to sustain long-term adherence and demonstrate a culture of responsible AI.
Key actions:
- Implement post-market monitoring to track AI system performance and collect real-world operational data.
- Conduct continuous risk assessments and update documentation when new risks emerge.
- Schedule regular internal audits and engage external assessments to confirm adherence to obligations.
- Maintain AI literacy and training programmes for staff, senior management, and boards.
- Review third-party and vendor models annually; treat retrained or modified models as new systems requiring conformity checks.
- Update governance and policy frameworks in line with AI Office and AI Board guidance, evolving standards, and new EU laws such as the Data Act or Cyber Resilience Act.
This phase cements compliance into enterprise culture, protecting reputation and establishing competitive differentiation based on trust and transparency.
EU AI Act Readiness: From Risk to Opportunity
The EU AI Act represents a watershed moment in global AI regulation. It is the world’s first serious attempt to make AI safe, transparent, and accountable, and it will shape global markets far beyond Europe. For enterprises, the choice is clear: treat compliance as a burden, or use it as a springboard for trust, resilience, and long-term advantage.
The deadlines are not far away. Prohibited practices are banned from February 2025, GPAI obligations apply from August 2025, and the bulk of high-risk requirements bite from 2026. Surveys from Arthur Cox and EY show most organisations are far behind, with fewer than a quarter offering AI literacy training or having procurement policies in place. That gap is both a compliance risk and a competitive opportunity.
Non-EU companies cannot ignore this. If your systems or outputs reach the EU, you are directly in scope.
At Hyperios, we help enterprises move from uncertainty to clarity. Now is the time to map your systems, raise literacy across your teams, and embed governance that will stand up to scrutiny. Explore our AI governance services or book a discovery call to start building compliance into your strategy today.
.
