The EU AI Act: why preparing early makes business sense
By Ulrike Michel-Schneider · 8 min read
The deadlines for high-risk AI have moved to 2027 and 2028 – but prohibitions and transparency duties already apply. Here is what the EU AI Act requires today, what changed in 2026, and how companies can turn early preparation into a real business advantage.
Key takeaways • Context decides, not the algorithm. Your obligations depend on the system's intended purpose, its setting and your role in the value chain. • Some rules already apply. Prohibitions have applied since February 2025 and transparency duties since August 2026. The AI Omnibus moved the main high-risk deadlines to 2 December 2027 and 2 August 2028. • Early preparation pays off when it improves the product: fewer late redesigns, less uncertainty for customers and governance you can reuse. • It is not a shortcut to compliance. A pledge or early effort does not replace a required conformity assessment. |
Why the question of control is back on the agenda
How can organisations keep effective control as AI systems gain capabilities and autonomy? Recent events at the frontier of AI have made this familiar question more urgent. In July 2026, OpenAI reported that models used in internal cybersecurity evaluations had circumvented isolation controls and accessed systems outside their assigned environment. It tightened safeguards in response and separately paused a long-running internal model after spotting unwanted behaviour that pre-deployment tests had missed (OpenAI). Anthropic, meanwhile, chose not to make its cyber-capable Claude Mythos Preview generally available while safeguards were still being developed (Anthropic).
None of this means commercial AI has escaped human control. It does show that testing, access limits, monitoring and the ability to intervene have to evolve with the technology. And these questions no longer concern only research labs: in 2025, 20% of EU enterprises with at least ten employees used AI, up from 13.5% a year earlier (Eurostat).
This is where the EU AI Act comes in. It sets enforceable, proportionate duties for specified AI practices, systems and general-purpose models on the European market, to protect health, safety and fundamental rights while supporting innovation. For companies, the practical question is not whether, but when to start.
Four risk levels – and why context matters
The Act takes a risk-based approach. What matters is not the algorithm in isolation, but what the system is meant to do, where it operates and what it could mean for people. The European Commission describes four broad levels of risk:
Risk level | What it covers | Examples | Applies from |
Unacceptable | Prohibited practices | Harmful manipulation, social scoring, emotion recognition at work or school (narrow exceptions) | Mostly since Feb 2025; new ban from Dec 2026 |
High | Uses that can seriously affect health, safety or fundamental rights | Recruitment, education, access to essential services, AI in regulated products | Annex III: 2 Dec 2027; Annex I: 2 Aug 2028 |
Limited (transparency) | People must know they are dealing with AI or synthetic content | Customer chatbots, AI-generated content | Since 2 Aug 2026 |
Minimal | Ordinary applications | Spam filters | No additional AI Act requirements |
Simplified overview based on the European Commission and Regulation (EU) 2026/1744. A legal assessment must use the Act's own definitions.
Two points are easy to miss. First, a sector label does not decide the class: a medical or HR tool is assessed by its intended purpose and the conditions in Article 6. Second, "minimal risk" does not mean "no obligations" – data protection and sector rules still apply, and customers will still ask whether the product works as claimed. General-purpose AI models are regulated separately; a company that builds a recruitment or medical application on top of one must assess the resulting system in its own context.
Your role matters as much as the risk class. The Act distinguishes providers, deployers, importers and distributors, each with different duties. An importer, for example, checks that the provider performed the conformity assessment; a distributor checks the CE marking and instructions. And a company that rebrands or substantially modifies a high-risk system may take on provider duties itself (Article 25).
What applies now – and what changed in 2026
Date | What applies |
1 Aug 2024 | AI Act enters into force |
2 Feb 2025 | Prohibited practices |
2 Aug 2025 | Obligations for providers of general-purpose AI models |
27 Jul 2026 | AI Omnibus – Regulation (EU) 2026/1744 – enters into force |
2 Aug 2026 | Transparency duties; enforcement of applicable provisions begins |
Dec 2026 | New prohibition on generating non-consensual sexualised content and CSAM; transition for machine-readable marking of AI outputs ends (2 Dec) |
2 Dec 2027 | High-risk requirements for Annex III uses (e.g. employment, education) |
2 Aug 2028 | High-risk requirements for AI in regulated products (Annex I) |
The biggest change for companies planning high-risk applications is the amended timetable. The original dates assumed that harmonised standards – which translate broad legal requirements into technical specifications – would be ready sooner. Their delay contributed to the AI Omnibus, which also broadens access to regulatory sandboxes and extends some simplified arrangements to small mid-cap companies.
Crucially, the later dates concern only the high-risk rules. Prohibitions and transparency duties are not paused. A single business may have one application already subject to transparency duties, another that could become high-risk later, and many internal tools with no additional requirements. That is why it needs an inventory of actual uses, not one generic label for all of its AI.
Legal classification is only the start
Readiness is also an organisational question. Interviewing 25 AI experts, Jöhnk and colleagues identified five dimensions of AI readiness: strategic alignment, resources, knowledge, culture and data. Mikalef and Gupta found that AI capability comes from combining technical, human and organisational resources – not from algorithms alone. A legal check detached from product teams and operations is unlikely to be enough.
Research on the Act itself points the same way. In a multiple case study, Wagner and colleagues found that existing regulation, AI maturity, company size and industry shaped how hard compliance felt in practice. The workload will differ greatly between a mature medtech supplier and a start-up launching its first AI product.
For each project, early classification should therefore be followed by a gap assessment:
• What evidence already exists?
• Who knows where the training and validation data came from?
• Which performance limits have been measured in the intended setting?
• Can users recognise an error and intervene?
• Are responsibilities with external model or software suppliers defined?
For high-risk systems, technical documentation must exist before the system goes on the market and must be kept up to date (Article 11, Annex IV). Reconstructing data sources, model versions and design rationale at the last minute is hard if nobody recorded them. Research proposals such as datasheets for datasets and life-cycle internal audits share one insight: documentation exposes assumptions while the team can still change them.
Documentation can expose assumptions while a team can still investigate and change them.
Take an AI tool that helps screen job applications. A late review might reveal too little evidence on how it behaves across applicant groups, or unclear guidance on how recruiters should read its recommendations. Caught during development, the team can adjust data, tests or human review – or narrow the intended use. Once the tool is embedded in a customer's workflow, every change is far more disruptive.
The same applies when you buy AI. A pilot that defines the target population, baseline process, success criteria and escalation route tells you far more than a demo judged on speed or average accuracy. This is where the supplier's documentation and the buyer's procedures have to meet.
What early movers are doing
IBM signed the European Commission's voluntary AI Pact in September 2024, committing to an AI governance strategy, mapping of high-risk systems and AI literacy for staff and clients. Its AI ethics leaders argue that companies should build transparent practices before the law requires them, to earn trust. Allianz began preparing for the Act in early 2024 and links governance, mapping of potentially high-risk applications and employee literacy to customer security and responsible innovation.
These are companies' own accounts of their intentions – not independent proof that their products comply. The pledges are voluntary and do not replace binding requirements. Their value depends on whether they lead to safer, more useful products and credible evidence for clients, regulators and staff.
Where the business value lies
1. Fewer late redesigns. Considering purpose, data provenance, testing and oversight from the first pilot reveals design gaps while you still have choices – especially where documentation and risk management are continuous duties.
2. Less uncertainty for customers. Buyers need to know what they can rely on and how incidents will be handled. Clear performance evidence makes procurement easier. As Glikson and Woolley show, the goal is appropriate trust grounded in what a system can and cannot do – not a badge.
3. Reusable capabilities. Evidence gathered for one use case improves testing, supplier questions and change management for the next. Akbarighatar describes responsible AI as organisational capabilities, which are harder to copy than a single compliance document.
4. Access to demanding customers. Buyers in healthcare, finance or the public sector may require evidence of intended use, limits and oversight before adopting a tool. A 2026 study of seven EU AI integrators by Soto-Acosta, Popa and Ros-Galvez found that anticipatory compliance can become an advantage – depending on a firm's existing maturity.
There is a flip side: compliance work costs money and specialist time. For a low-risk application or a weak value proposition, extensive paperwork may bring little return. The advantage is most credible when governance improves the product itself.
A practical roadmap for the transition period
1. Take inventory. For each AI application, record its purpose, the people affected, the provider and any underlying model, the internal owner and whether its output influences consequential decisions. Revisit the classification whenever the intended use changes.
2. Prioritise and define evidence. Focus on uses where errors matter most. Developers should record data provenance, model versions, validation conditions and oversight design; buyers should ask suppliers for instructions, known limitations and change notifications. Match the effort to the risk – a spam filter does not need a high-risk technical file.
3. Pilot with real users and revisit. Check whether the pilot actually improves the task, which errors persist and whether staff can catch them. Assign responsibility for monitoring, updates and escalation, and follow emerging harmonised standards.
4. Use the official tools. The Commission's AI Act Service Desk offers the AI Act Explorer, a Compliance Checker (beta) and a way to send questions to experts working with the EU AI Office.
The bottom line
The extended timetable is an opportunity to ask better questions earlier. It cannot guarantee trust or commercial success, and early work cannot replace a required conformity assessment. But it can help companies understand their products, keep the evidence behind design decisions and give customers a clearer basis for adoption. As AI becomes more common, being able to show both what a system does and where its limits lie may become a meaningful part of competing in the European market.
Building or buying AI for the European market? At UNICO, we help companies turn tech innovations into viable business. If you are mapping your AI use cases or preparing an AI product for launch |
This article provides general information and does not constitute legal advice. The applicable legal text, the facts of a specific use and any national or sectoral guidance remain decisive.
Sources
European Parliament and Council (2024). Regulation (EU) 2024/1689 – AI Act
European Parliament and Council (2026). Regulation (EU) 2026/1744 – Digital Omnibus on AI
European Commission (2026). AI Act: A risk-based approach · Implementation timeline · AI Pact · AI Pact pledgers' achievements · AI Act Single Information Platform
Eurostat (2025). 20% of EU enterprises use AI technologies
Wagner et al. (2026). AI Act high-risk AI compliance challenge and industry impact. Information and Software Technology, 194.
Jöhnk, Weißert & Wyrtki (2021). Ready or Not, AI Comes. Business & Information Systems Engineering, 63.
Mikalef & Gupta (2021). Artificial intelligence capability. Information & Management, 58(3).
Glikson & Woolley (2020). Human trust in artificial intelligence. Academy of Management Annals, 14(2).
Gebru et al. (2021). Datasheets for datasets. Communications of the ACM, 64(12).
Raji et al. (2020). Closing the AI accountability gap. Proceedings of FAT* 2020.
Akbarighatar (2025). Operationalizing responsible AI principles. AI and Ethics, 5.
Soto-Acosta, Popa & Ros-Galvez (2026). How AI integrators translate AI regulation into innovation. European Journal of Innovation Management, 29(6).
IBM (2024). IBM signs European Commission AI Pact · Montgomery & Rossi. AI policy in Europe
Allianz (2024, 2025). Allianz SE joins AI Pact · AI at Allianz
OpenAI (2026). The Hugging Face incident and the road ahead · Safety and alignment in an era of long-horizon models
Anthropic (2026). Project Glasswing
Comments