The EU AI Act in 2026: a five-step readiness plan for boards

The EU AI Act is not a future regulation. Article 5 prohibitions on unacceptable-risk AI took effect in February 2025. General-purpose AI model obligations followed in August 2025. The cornerstone obligations — for the high-risk systems that account for most enterprise exposure — apply from 2 August 2026.

Boards we work with are at very different states of readiness. The most-prepared have an AI inventory, a classification map, named accountability, and a remediation roadmap. The least-prepared believe — incorrectly — that the Act does not apply to them. The most common error is the same: assuming "we don't do high-risk AI" without an inventory to test the assumption.

The five-step plan

1. Inventory every AI system in use. Most enterprises undercount by a factor of five to ten. Shadow tools, SaaS features quietly upgraded with AI, models embedded by suppliers, training-data agents in customer-service platforms — all count. Run discovery through procurement records, identity logs, and a survey across functions. Build a single register. Without it, the rest of the plan is guesswork.
2. Classify per Article 6 and Annex III. For each system, determine whether it falls into prohibited use, high-risk, limited-risk, or minimal-risk. The Annex III categories that catch most enterprises are: employment and worker management (recruitment screening, performance evaluation), creditworthiness and credit scoring, access to essential services, and law enforcement uses. Document the classification rationale — supervisors will ask for it.
3. Identify your role for each system. You may be a provider (you put the system on the market under your name), a deployer (you use a third-party system in a professional capacity), or both for different systems. Obligations differ materially. Most enterprises are deployers in some places and providers in others, and the distinction is rarely well-mapped.
4. Build the governance scaffolding. For high-risk systems you must establish: a risk-management process; data governance (training, validation, test data quality); technical documentation; logging; transparency information to deployers; human oversight; accuracy, robustness, and cybersecurity. None of these can be implemented in a sprint. Start now on the systems you know are high-risk. Run a parallel work-stream on the inventory to find the ones you do not yet know about.
5. Run a mock conformity assessment six months out. Treat February 2026 as the dress rehearsal for August 2026. A mock assessment, with the same evidence package a notified body or regulator would expect, surfaces gaps while you still have time to close them. The teams that wait until July 2026 to test their evidence will not pass.

The questions a board should be asking this quarter

• Do we have a single, authoritative inventory of every AI system in use across the group?
• Has someone formally classified each system under Article 6 and Annex III?
• For high-risk systems, is there a named accountable executive with budget and a milestone plan?
• What is our role — provider, deployer, importer, distributor — for each material system, and is it documented?
• When is the mock conformity assessment scheduled, and who is running it?

Boards that treated GDPR as a tick-box exercise spent the following decade managing avoidable enforcement actions. The EU AI Act is GDPR-scale on penalties and broader on scope. The decisions made in the next four quarters will be expensive to revisit.

For the executive sponsor

The single most valuable artefact to commission this quarter is the AI inventory, with classification and role mapped. It takes two to four weeks. Everything else — governance design, technical documentation, conformity assessment — depends on it.

Most enterprises we work with begin with the inventory and discover they have between three and seven high-risk systems they did not know they had. That is the starting line, not the destination.