EU AI Act Compliance: What Applies Now and What Lands in December 2027

Regulation (EU) 2024/1689

The prohibitions already bite and the GPAI rules already apply. The expensive part, high-risk conformity under Annex III, lands on 2 December 2027. That is roughly fourteen months to classify what you run, build the evidence and keep it current.

The Act sorts systems into four tiers. Unacceptable risk is banned outright: social scoring by public authorities, manipulative techniques that exploit vulnerability, and a short list of others. High risk is permitted but heavily regulated, and this is where the cost lives. Limited risk carries transparency duties only, which usually means telling a person they are dealing with an AI. Minimal risk carries nothing.

Classification runs through Article 6 and the two annexes. Annex I covers AI that is a safety component of a product already regulated under EU product law. Annex III is the list most software companies care about: biometrics, critical infrastructure, education, employment and worker management, access to essential services including credit scoring and insurance pricing, law enforcement, migration, and the administration of justice.

The Act entered into force in August 2024 and applies in stages. These dates were checked against the official implementation timeline in September 2026, because the schedule has been widely misreported.

Sources: Regulation (EU) 2024/1689 and the published implementation timeline, checked September 2026.

The Act splits duties between the provider, who develops a system or puts it on the market under their own name, and the deployer, who uses it under their own authority. Most companies assume that buying a tool makes the vendor responsible. It shifts the heaviest obligations, but it does not clear you.

Deployers of Annex III systems still have to use the system according to instructions, assign competent human oversight, keep the logs the system generates, and monitor for issues. Where the deployer is a public body, or is using the system for creditworthiness or life and health insurance pricing, they also owe a fundamental rights impact assessment under Article 27.

Strip away the commentary and a high-risk system has to demonstrate six things. A conformity assessment under Article 43 walks through them in order, and each one has to be evidenced rather than asserted.

1. Risk management across the lifecycle, Article 9

   A continuous, documented process. Identify foreseeable risks including reasonably foreseeable misuse, mitigate, test, and revisit. A one-off risk workshop does not satisfy this.

2. Data and data governance, Article 10

   Training, validation and testing sets have to be relevant, representative and as far as possible free of errors. You need documented provenance and an examination of possible biases. This is where most programmes stall, because nobody wrote anything down while the model was being built.

3. Technical documentation, Article 11

   Assembled before the system goes on the market and kept current. Annex IV sets out what it contains.

4. Record keeping, Article 12

   Automatic logging over the lifetime of the system, sufficient to trace how a given output came about.

5. Transparency and instructions for use, Article 13

   Deployers have to be able to interpret and use the output. Capabilities, limitations and known failure modes go in writing.

6. Human oversight, Article 14

   Designed in, not bolted on. A named person with the authority and the information to intervene or stop the system.

Two further duties run after launch: post-market monitoring under Article 72, which is a documented plan with measures you actually track, and serious incident reporting under Article 73, which runs on a clock and will be the worst possible time to design a process from scratch.

Three bands, each expressed as the higher of a fixed sum or a percentage of total worldwide annual turnover.

Up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices. Up to 15 million euros or 3 percent for breaching most other obligations, including the high-risk requirements. Up to 7.5 million euros or 1 percent for supplying incorrect, incomplete or misleading information to authorities or notified bodies.

The penalty that actually lands first is commercial. An enterprise buyer asks for your AI classification and your Article 11 file, and you have neither. The deal does not die loudly, it just stops moving.

From procurement reviews across 14 countries

Neither standard makes you AI Act compliant, and anyone who tells you otherwise is selling something. What they do is give you a management system and a vocabulary that a large part of the Act maps onto.

ISO/IEC 42001 is an AI management system standard, structured like ISO 27001: scope, policy, risk process, controls, internal audit, management review. Venvera publishes a crosswalk showing 10 of 53 domains appearing in both ISO 42001 and the AI Act, covering impact assessment, system requirements, design and development documentation, verification and validation, technical documentation, event logging, data governance, data quality, data provenance, and information for users. That overlap is real and worth exploiting if you are doing both.

NIST AI RMF is voluntary and US-origin, organised around Govern, Map, Measure and Manage. It is useful for structuring internal practice and it reads well to American customers, but it carries no legal weight in the EU.

Every AI Act programme splits into two problems that need different things. The first is judgement: deciding whether a system is high risk, whether an Article 6 exemption applies, what the residual risk is and who accepts it, how to word a fundamental rights impact assessment so it survives scrutiny. The second is bookkeeping at scale: holding the register, assembling the Article 11 file, tracking conformity across six areas for every system, running monitoring and keeping the incident clock visible.

Treating these as one problem is why so many programmes fail. Hire only consultants and you get a defensible classification and a very good PDF that is stale within a quarter, because nothing updates it when the model is retrained or a new use case ships. Buy only a platform and you get tidy dashboards built on classification decisions nobody senior ever defended, which is worse, because it looks finished.

What Atlant Security does

We do the judgement half. Classifying each system against Article 6 and the annexes, and writing the reasoning down so it can be defended later. Deciding whether the narrow-procedural-task exemption genuinely applies. Facilitating the fundamental rights impact assessment with the people who actually understand the affected population. Designing the human oversight so it is a real control rather than a screenshot. Preparing the team for the conversation with an authority or a notified body. That is 200+ security assessments across 14 countries since 2013, now applied to AI systems.

What Venvera does

It is the system of record underneath. Venvera's EU AI Act build sorts systems into risk tiers against the Annex I and Annex III criteria, tracks conformity across the six categories, assembles the Article 11 technical documentation and the EU Declaration of Conformity, provides structured templates and scoring for the Article 27 fundamental rights impact assessment, holds dataset documentation with bias assessment for Article 10, runs post-market monitoring against thresholds you set, and keeps serious incident classification and reporting templates ready before you need them. It carries the ISO 42001 crosswalk, so the overlap between the two programmes is claimed rather than redone.

It also does the part people forget: third-party risk. Most companies do not build the models they depend on. The vendor questionnaires, the contractual terms and the evidence that your AI suppliers are doing their part all have to live somewhere, and that somewhere should not be a shared drive.

1. Inventory every AI system, including the ones nobody calls AI

   Models you built, models you bought, features inside SaaS you already use, and anything a team stood up without telling anyone. You cannot classify what you have not listed.

2. Classify each one and write down why

   Tier, provider or deployer role, Annex I or Annex III, and any exemption you are relying on with the reasoning. This is the document that gets argued over later.

3. Deal with prohibitions first

   They are already in force. If anything in the inventory touches a banned practice, that is this week, not next year.

4. Pick the two or three high-risk systems that matter

   Build the Article 11 file and the risk management process for those properly, rather than starting a thin version everywhere.

5. Stand up the register before the documentation

   Decide where this lives permanently, and put the classification decisions straight into it. Documentation that starts life in a document is documentation that will be out of date by the time it is reviewed.

Does the AI Act apply to us if we are not in the EU?

If you place an AI system on the EU market, or the output is used in the EU, yes. It follows the market rather than the establishment, the same way the GDPR does.

We only use ChatGPT and a few SaaS features. Are we in scope?

Probably as a deployer, and probably at limited risk, which mostly means transparency. The answer changes fast if you use those tools for recruitment screening, creditworthiness, or anything else in Annex III.

Is ISO 42001 enough?

No. It is a management system standard, not a conformity route. It gives you real structure and roughly ten overlapping domains, but the AI Act obligations are discharged on your own evidence.

Do we need a notified body?

For most Annex III systems, no: conformity assessment is internal. Annex I systems and some biometric cases involve a notified body. Determine which one you are in before budgeting.

How long does a high-risk programme take?

For a company with two or three high-risk systems and no existing management system, plan six to nine months to be genuinely ready, not the fortnight before December 2027.

What is the single most common mistake?

Classifying on instinct and never writing the reasoning down. When the question comes back eighteen months later, nobody remembers why the system was called limited risk, and the absence of a record is itself the finding.

Fourteen months, not four years

Get the classification right first, then make the evidence someone else's job

We will inventory and classify your AI systems, write the reasoning so it survives a review, and design the oversight and impact assessments. Then it goes into a platform that keeps it current instead of a folder that does not. 200+ security assessments across 14 countries since 2013.