EU AI Act: A 12-Month Conformity Readiness Roadmap
High-risk obligations come into force August 2026. A practical roadmap covering Annex III classification, Article 9 to 15 controls, technical documentation, and conformity assessment.
The EU AI Act high-risk obligations come into force in August 2026. Organisations selling AI systems into the EU or operating EU customer journeys with AI must be ready, or face fines of up to 7 percent of global annual turnover.
The 12-month readiness path starts with classification. Annex III lists eight categories of high-risk AI: biometric identification, critical infrastructure, education and vocational training, employment and workforce management, essential services (including creditworthiness), law enforcement, migration, and administration of justice. If your AI system falls under any of these, you need to comply with Articles 9 to 15 covering risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy.
The roadmap: months 1 to 3 cover classification and gap assessment, months 4 to 6 cover risk management and data governance setup, months 7 to 9 cover technical documentation and human oversight controls, months 10 to 12 cover conformity assessment and CE marking preparation. The single most under-resourced step is technical documentation. Article 11 plus Annex IV requires comprehensive documentation including model architecture, training data provenance, performance metrics, and risk mitigation. Most organisations underestimate this by 3 to 4x.