EU AI Act Compliance: 12-Month Roadmap Through December 2027

1. Status of the EU AI Act 08/2026 + Digital Omnibus AI (Regulation (EU) 2026/1744)

Short answer: As at 16 August 2026, the general date of application of the AI Act — 2 August 2026 — has been reached: applicable from that date are, among other things, the transparency obligations under Art. 50. The fundamental rights impact assessment under Art. 27 and the remaining Annex III high-risk obligations, by contrast, sit in Chapter III Sections 1–3 and only apply from 2 December 2027; for Annex I products under Art. 6(1) the date is 2 August 2028 (Art. 113(3)(c) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026).

The AI Act (Regulation (EU) 2024/1689) has been in force since 1 August 2024. As an EU regulation it applies directly and in the same way in Germany and Austria — all articles and deadlines mentioned below are identical in both countries; only the competent authorities (Art. 70 AI Act: at least one notifying authority and one market surveillance authority per Member State) and the penalty regime within the framework of Art. 99(1) AI Act are regulated nationally. In Germany the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), insofar as sectoral authorities are not competent; as at the date of this article (17 August 2026) Austria has not designated a market surveillance authority under Art. 70 AI Act — the RTR AI service point is an information and advisory body without supervisory powers. Application is phased in accordance with Art. 113 AI Act.

The European Commission's Digital Omnibus proposal of 19 November 2025 has become Regulation (EU) 2026/1744; it has been in force since 27 July 2026 and recasts the Annex III and Annex I deadlines (dates in the table below, who is affected by which obligation in the FAQ). The high-risk obligations of Chapter III Sections 1–3 therefore apply to Annex III systems from 2 December 2027 and to Annex I systems from 2 August 2028; the general date of application of 2 August 2026 has been reached and remains. Check the consolidated version before any scheduling.

2. Phase 1 (NOW): AI literacy + prohibitions

Short answer: Phase 1 concerns Art. 4 and Art. 5 AI Act — both applicable since 2 February 2025 (Chapters I and II, Art. 113 AI Act); anyone starting only in August 2026 is not working through a lead time here, but through a backlog.

• Art. 4 AI literacy: providers and deployers take measures to support the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf; no specific level of AI literacy is owed (Art. 4(1) AI Act as amended by Regulation (EU) 2026/1744). Practice recommendation for the training: contents covering the definition of AI, risk classes, prohibited practices, transparency obligations and human oversight; a quiz and a certificate serve as evidence. The preliminary question is answered by Art. 3 no. 1 AI Act: an AI system is a machine-based system that is designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, from the input it receives, infers, for explicit or implicit objectives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.
• Art. 5 prohibitions: eight prohibited practices since 2 February 2025; a ninth — non-consensual sexualised deepfakes and depictions of child sexual abuse — is added by Regulation (EU) 2026/1744 from 2 December 2026 (Art. 5(1)(ba), (bb), (1a), (1b) AI Act as amended). The list of the eight existing practices with sources follows below. Fines of up to EUR 35 million / 7% (Art. 99(3) AI Act).

For screening purposes it is worth looking at the text of the regulation itself, because the prohibitions are narrower and cut differently than any short summary suggests. Art. 5(1) AI Act lists them in the following order:

Point (f) has an express workplace link (emotion recognition in the workplace and in education institutions); point (g) is also relevant in practice in the employment context. These are prohibitions, not high-risk classifications: Art. 5 prohibits placing on the market, putting into service and use as a matter of principle. For Art. 4 the opposite applies: the AI literacy obligation has no EU fine framework of its own (tiers and legal consequence in the FAQ).

3. Phase 2 (08/2026): transparency + FRIA (Art. 27 only from 2 December 2027)

Short answer: Since 2 August 2026 Art. 50 has applied: it requires machine-readable marking of AI-generated audio, video, image and text content, express deepfake disclosure and AI notices for chatbots. Art. 27 requires a FRIA — only from 2 December 2027 (Regulation (EU) 2026/1744) and only from public bodies, private entities performing public tasks and the deployers of the systems under Annex III no. 5 (b) (creditworthiness assessment) and (c) (life and health insurance scoring).

Art. 50 allocates the obligations by role — a pure deployer does not owe the same as the provider:

Of these four obligations, paragraphs 3 and 4 apply to the pure deployer; with a change of role under Art. 25 AI Act the chatbot notice and the machine-readable marking are added (Section 6).

In substance, Art. 27 AI Act requires a description of the AI use, of the persons affected, of the fundamental rights risks and of the safeguards. Precision pays off when identifying the FRIA addressees, because a great deal of effort ends up in the wrong place here: a private company that uses a high-risk AI in recruitment (Annex III no. 4) and belongs to none of the three groups named there does not fall within this group of addressees. What matters there are the deployer obligations under Art. 26(4), (6) and (7) AI Act — and, in data protection law, where applicable the data protection impact assessment under Art. 35 GDPR, which is required in particular for a systematic and extensive evaluation of personal aspects producing legal effects.

4. Phase 3 (Annex III high-risk AI from 2 December 2027)

Short answer: Under Regulation (EU) 2026/1744, in force since 27 July 2026, the full Annex III requirements apply from 2 December 2027; for Annex I systems under Art. 6(1) the date is 2 August 2028.

The classification question always comes first. Under Art. 6(2) AI Act, the systems listed in Annex III are considered high-risk; the exception in Art. 6(3) AI Act only applies if the system does not pose a significant risk to health, safety or fundamental rights — and it is excluded as soon as the system performs profiling of natural persons. The eight areas of Annex III and the individual test steps are covered by the Annex III classification workbook.

Who is subject to the individual requirements is decided by the role — Section 6 sets out the comparison of provider and deployer obligations. Deployers owe the input data relevance check (Art. 26(4) AI Act), retention of the logs for at least six months (Art. 26(6) AI Act), information of the workers (Art. 26(7) AI Act) and — within the narrow group of addressees of Art. 27 — the FRIA.

The EU database registration is regularly read too narrowly: the provider obligation under Art. 49(1) AI Act applies to all high-risk AI systems under Annex III with the exception of the systems under no. 2 (critical infrastructure) — it is limited neither to public bodies nor to Annex III no. 1. Under Art. 49(2) AI Act, providers that classify their system as not high-risk under Art. 6(3) also register; on the deployer side, the obligation under Art. 49(3) AI Act applies only to public authorities and to Union institutions, bodies, offices and agencies.

5. The AI system inventory — the starting point

Short answer: Every EU AI Act compliance effort starts with an AI system inventory. Six fields are recommended per system (a practical recommendation, not a statutorily prescribed list of fields): name and provider, use case, role (provider/deployer/both), risk class (prohibited under Art. 5 / high-risk under Annex III / GPAI / minimal), types of data processed including special categories, and those responsible for oversight and escalation.

The inventory is the starting point of this roadmap and the precondition for being able to assign the obligations of Sections 2 to 4 at all. Document the following per AI system:

1. Name + provider: ChatGPT/Microsoft Copilot/in-house solution. The provider is your counterpart for transparency and documentation questions; it also determines the role question in field 3.
2. Use case: marketing copy, HR screening, code generation. The use case, not the product, determines the classification: the same language model is minimally risky in marketing and an Annex III case in applicant ranking (Art. 6(2) AI Act).
3. Role: provider / deployer / both. What matters are Art. 3 no. 3 and no. 4 AI Act; keep the possible change under Art. 25 AI Act as a separate field, because it shifts the entire set of obligations (Section 6).
4. Risk class: prohibited (Art. 5) / high-risk (Annex III) / GPAI / minimal. The order of examination is a practical recommendation: first Art. 5, then Annex III, then the GPAI question under Art. 3 no. 63 AI Act — the background is the risk-based approach (recital 26).
5. Types of data: which personal data / special categories? Special categories under Art. 9(1) GDPR — such as health data or biometric data for unique identification — are subject to a general prohibition on processing with narrow exceptions and frequently trigger an impact assessment under Art. 35 GDPR.
6. Oversight: who monitors? What escalation? For high-risk systems, human oversight is a requirement in its own right (Art. 14 AI Act); as a deployer, information of the workers is added in the workplace context (Art. 26(7) AI Act).

Practical rhythm (recommendation, not a statutory deadline): update the inventory as events require rather than by the calendar — which events these are is set out in the FAQ at the end of this article.

6. Provider vs deployer

Short answer: Providers develop an AI system or place it on the market and bear the main obligations (conformity assessment, Annex IV technical documentation, EU database registration, risk management). Deployers use an AI system under their own authority — on the practitioner assessment of the first version (as at 2 May 2026), the role of most SMEs — and must ensure use in accordance with the instructions, check the relevance of input data, retain logs and, where applicable, carry out a FRIA. In the case of a substantial modification (Art. 25) the deployer moves into the provider role.

The classification as the rule or the exception is a practitioner assessment from the first version (as at 2 May 2026) and is not supported by collected market data. What matters in any event is the individual assessment per system — and in practice, when GPAI models are used, it tips into the provider role at three points: training your own model, substantial fine-tuning that changes the intended purpose, and wrappers with white-label branding and your own marketing.

For GPAI models, the provider role generally lies with the model manufacturer: the obligations under Art. 53 AI Act (technical documentation under Annex XI, information for downstream providers, copyright policy, summary of training data) and — only for models with systemic risk under Art. 51 AI Act (cumulative training compute above 10²⁵ FLOP) — under Art. 55 AI Act (model evaluation with adversarial testing, risk mitigation, incident reporting, cybersecurity) apply to the manufacturer, not to the SME using the model; they are enforced by the Commission through the EU AI Office (Art. 88(1) AI Act). If you check your suppliers' Code of Practice compliance in months 4-5, note its reach: under Art. 53(4) AI Act the Code of Practice serves to demonstrate compliance — a presumption of conformity is established only by a harmonised European standard. Details in the article on the GPAI provider obligations.

7. 12-month action plan

Short answer: The 12-month plan starts with the AI inventory, the Art. 5 screening and AI literacy training (months 1-2), followed by an acceptable use policy (M3), the GPAI compliance check (M4-5), the Art. 50 transparency workflow (M6), the FRIA for credit scoring/public tasks (M7), the risk management system under Art. 9 where you are a provider (M8-9), the Annex IV technical documentation (M10-11) and the audit simulation plus management briefing (M12); a cycle started on 16 August 2026 therefore ends in August 2027 — the December 2027 horizon follows from Regulation (EU) 2026/1744: the Annex III high-risk obligations apply from 2 December 2027.

The month column is a practical rhythm, not a statutory deadline — only the dates of the AI Act in the status column are binding.

(P) = practical step of this roadmap; only the dates in the 'Legal status' column are binding.

Anyone picking up the plan on 16 August 2026 therefore reads the order differently than readers of the first version did: months 1 to 7 concern obligations whose date of application has already been reached throughout. If Art. 4, Art. 5 and Art. 50 are still open, work on them in parallel rather than in sequence; the allocation to months then serves prioritisation, not scheduling.

Two dates from the AI Act fall in August 2027 — which ones is set out in the FAQ. Practical recommendation: do not plan the following months as a buffer, but as a second cycle — an effectiveness review of the evidence built up, and Annex I preparation if you manufacture AI systems under Art. 6(1) AI Act (a safety component of an Annex I product, or such a product itself).

8. Budget & effort

Short answer: The effort scales with the role: pure deployers in the SME segment are at around 0.2 FTE over 4 months, high-risk deployers at 0.5 FTE × 6 months, high-risk providers at 1 FTE × 12 months plus the conformity assessment and GPAI providers at 2-5 FTE × 12 months (experience values from the first version, as at 2 May 2026). The costs follow from this staffing effort and the role-dependent additional cost items in the table — training; for high-risk systems logging, technical documentation and, where applicable, a FRIA; for providers the conformity assessment.

The effort values (FTE) in this table are experience values from the first version (as at 2 May 2026) and are not supported by collected market data; the cost items have to be calculated for each company.

Which row applies to you is decided by four questions from the inventory: how many AI systems are recorded? Are you a provider under Art. 3 no. 3 AI Act for any of them, or do you move into that role under Art. 25? Does one of them fall under Annex III? Do you belong to the group of addressees of Art. 27 AI Act? The conformity assessment under Art. 43 AI Act distinguishes the 'high-risk provider' row from the deployer rows; the deployer obligations under Art. 26, by contrast, are predominantly process and documentation effort. The tiered fine framework of Art. 99 AI Act, together with the SME and start-up rule of Art. 99(6), is set out in the FAQ.

9. Germany and Austria: what is added nationally

Short answer: The AI Act applies directly and with identical wording in Germany and Austria; the only differences are the penalty regime within the framework of Art. 99(1) AI Act, the law alongside it (the German General Equal Treatment Act (AGG) and the Austrian Equal Treatment Act (GlBG) respectively) and the authorities to be designated nationally under Art. 70 AI Act.

Under Art. 70(1) AI Act, each Member State establishes at least one notifying authority and at least one market surveillance authority; the Member States designate one market surveillance authority as a single point of contact and make the contact details of the designated authorities publicly available (Art. 70(2) AI Act). In Germany the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) KI-MIG), insofar as sectoral authorities are not competent; as at the date of this article (17 August 2026) Austria has not designated a market surveillance authority under Art. 70 AI Act — the RTR AI service point is an information and advisory body without supervisory powers. In practice, the law alongside the AI Act is more relevant anyway — above all in HR use under Annex III no. 4, on practitioner assessment the most common SME high-risk case, and in the data protection law alongside it (German Federal Data Protection Act (BDSG); Austrian Data Protection Act (DSG)):

For the roadmap this means: the obligations in Sections 2 to 4 are identical in both countries; in addition, documentation of the selection procedure must be planned in both — in Germany because of the burden-of-proof rule in § 22 AGG, in Austria because of the credibility rule in the GlBG, in each case with an eye to the time limits for the person concerned set out in the table. Both strands run independently of the AI Act deadlines and also apply where a high-risk classification is ultimately rejected.