EU AI Act Compliance: 12-Month Roadmap Through December 2027

1. Status of the EU AI Act 05/2026 + Digital Omnibus Proposal

The AI Act (Regulation (EU) 2024/1689) has been in force since 01 August 2024. Application is phased. The European Commission presented the Digital Omnibus proposal on 19 November 2025 — as of 02 May 2026 the trilogue is ongoing and a postponement of the high-risk deadlines has NOT been adopted. The following applies:

2. Phase 1 (NOW): AI Literacy + Prohibitions

In force since 02 February 2025 — no transition period remaining.

• Article 4 AI Literacy: training for all persons who come into contact with AI. Content: AI definition, risk classes, prohibited practices, transparency obligations, human oversight. With quiz and certificate.
• Article 5 Prohibitions: 8 main categories — manipulation, exploitation of vulnerabilities, social scoring, real-time biometrics in public spaces, predictive policing, image databases through untargeted scraping, emotion recognition in the workplace, biometric categorisation. Fines up to EUR 35 million / 7 %.

3. Phase 2 (08/2026): Transparency + FRIA

Short answer: from 02 August 2026, two central obligations apply: Article 50 requires machine-readable labelling of AI-generated audio, video, image and text content, explicit deepfake disclosure as well as AI notices for chatbots. Article 27 requires a FRIA for public bodies and private actors with public tasks — in particular credit scoring (Annex III No. 5b) and life/health insurance scoring (No. 5c).

From 02 August 2026:

• Article 50 Transparency: AI-generated audio/video/image/text must be identifiable as AI-generated (machine-readable). Deepfakes: explicitly disclosed. Chatbots: AI notice.
• Article 27 FRIA: for public bodies + private actors with public tasks (credit scoring under Annex III No. 5b, life/health insurance scoring under 5c). Content: description of AI use, affected persons, risks to fundamental rights, safeguards.

4. Phase 3 (High-Risk AI Annex III from 02 August 2026)

From 02 August 2026 (legally binding; Digital Omnibus proposal of 19 November 2025: postponement to 02 December 2027 — trilogue ongoing, not yet adopted):

• Risk management system (Article 9)
• Data governance concept (Article 10)
• Technical documentation Annex IV (Article 11)
• Logging concept (Article 12)
• Transparency towards deployers (Article 13)
• Human oversight (Article 14)
• Accuracy / robustness / cybersecurity (Article 15)
• QMS manual (Article 17, providers only)
• Conformity assessment (Article 43)
• EU database registration (Article 49)
• Post-market monitoring (Article 72)
• Incident response (Article 73)

5. AI System Inventory — the Starting Point

Short answer: every EU AI Act compliance effort starts with an AI system inventory. Per system, six fields must be captured: name and provider, use case, role (provider/deployer/both), risk class (prohibited under Article 5 / high-risk under Annex III / GPAI / minimal), data categories processed including special categories, as well as those responsible for oversight and escalation.

Document the following per AI system:

1. Name + provider: ChatGPT/Microsoft Copilot/in-house solution
2. Use case: marketing copy, HR screening, code generation
3. Role: provider / deployer / both
4. Risk class: prohibited (Article 5) / high-risk (Annex III) / GPAI / minimal
5. Data categories: which personal data / special categories?
6. Oversight: who monitors? Which escalation path?

6. Provider vs. Deployer

Short answer: providers develop or place an AI system on the market and bear the principal obligations (conformity assessment, technical documentation Annex IV, EU database registration, risk management); around 10 % of SMEs are providers. Deployers use an AI system under their own responsibility (~90 % of SMEs) and must ensure intended use, review input data relevance, retain logs and, where applicable, carry out a FRIA. In the event of a substantial modification (Article 25), the deployer transitions into the provider role.

7. 12-Month Action Plan

Short answer: the 12-month plan starts with the AI inventory, Article 5 screening and AI Literacy training (months 1-2), followed by an Acceptable Use Policy (M3), GPAI compliance review (M4-5), Article 50 transparency workflow (M6), FRIA for credit scoring/public tasks (M7), risk management system under Article 9 if you are a provider (M8-9), technical documentation Annex IV (M10-11) and audit simulation plus managing director briefing on 12/2027 readiness (M12).

8. Budget & Effort

Short answer: effort scales with role: pure deployers in the SME segment are at around 0.2 FTE over 4 months (EUR 5,000-20,000 plus training), high-risk deployers at 0.5 FTE × 6 months (additional EUR 15,000-40,000), high-risk providers at 1 FTE × 12 months including conformity assessment (EUR 50,000-200,000) and GPAI providers at 2-5 FTE × 12 months (EUR 250,000-1,000,000).