Key takeaways
- Start with an inventory of every AI system in use, including AI features inside software you already buy, because you cannot classify what you have not listed.
- Each system gets a role (provider, deployer, importer, distributor) and a risk class, and the controls follow from those two answers.
- Prohibited practices, AI literacy and Article 50 transparency already apply; Annex III high-risk duties apply from 2 December 2027 and Annex I from 2 August 2028 under Regulation (EU) 2026/1744.
- Most of the work for a deployer sits in procurement and operations: contracts, human oversight, log retention and a way to handle incidents.
What changed in 2026, and why it does not mean you can wait
For each AI system, assign an owner, your legal role, a risk classification and an evidence file. Use the 12 steps below to coordinate legal, security, procurement and operations. The amended high-risk dates are 2 December 2027 for Annex III and 2 August 2028 for Annex I product systems. Existing prohibitions, AI literacy and applicable transparency duties already need attention.
The 12-step checklist
- Name an owner and a small steering group: legal, the data protection officer, security, product and procurement. One person answers for the programme.
- Build the AI inventory: every system, who owns it, what it does, what data it touches and whether it is built in-house or bought. Include AI features inside tools you already license and tools staff use without approval.
- Screen for prohibited practices in Article 5 first, because they are enforceable now and carry the highest fines.
- Assign your role for each system: provider, deployer, importer or distributor. Commissioning a custom system and running it under your own name can make you the provider.
- Classify each system: prohibited, high-risk (Article 6 and Annex III), transparency-only (Article 50) or minimal risk. Record the reasoning, not just the answer.
- Set up AI literacy under Article 4: training that fits the role, the context and the people affected, with a record of who completed it.
- Rework vendor contracts and procurement questions (see the table below).
- For each high-risk system you deploy, apply the Article 26 duties: use it as instructed, assign competent human oversight, check input data, monitor, keep logs for at least six months and inform workers and affected people.
- For each high-risk system you provide, build the Chapter III controls: risk management, data governance, technical documentation, logging, instructions for use, human oversight, accuracy and cybersecurity, a quality management system, conformity assessment and post-market monitoring.
- Implement Article 50 transparency: tell people when they are talking to an AI, mark generated content, and label deepfakes.
- Join up with GDPR: a data protection impact assessment where the processing is high-risk, and a fundamental rights impact assessment under Article 27 where it applies.
- Create the evidence file and a review cycle: one folder per system, an incident process and a calendar of the dates above.
Steps 1 to 6 apply to every organisation that uses AI, whatever its role. Steps 7 and 8 are the core work for a deployer, step 9 is for providers, and steps 10 to 12 tie everything together. If you only buy and use AI tools, you can skip step 9 and still have a complete programme.
What to ask vendors before you sign
| Ask the vendor for | Why it matters |
|---|---|
| The intended purpose and instructions for use, in writing | You must use a high-risk system as instructed (Article 26), so you need the instructions to follow. |
| Access to logs generated by the system | You must keep logs under your control for at least six months. |
| Where data is stored and processed, and whether it is used to train models | GDPR processor terms, data residency and confidentiality. |
| Notice of material model or system changes | A substantial modification can change the risk class or who the provider is. |
| Incident and vulnerability notification terms | Serious incidents must be reported, and you need the facts quickly. |
| For high-risk systems: the declaration of conformity and registration details | Evidence the provider has done its own work. |
| Sub-processors and hosting location | Needed for your records and for any transfer analysis. |
Who owns what
| Task | Usual owner | Evidence to keep |
|---|---|---|
| AI inventory and classification | Programme owner with business units | Inventory table with role, class and reasoning |
| Prohibited-practice screening | Legal | Dated sign-off per system |
| Vendor assessment and contract clauses | Procurement and legal | Questionnaire answers and signed terms |
| Human oversight design | Product and operations | Named oversight roles, training records, override procedure |
| Logging and monitoring | Engineering and security | Log retention settings, review records |
| Impact assessments | Data protection officer | DPIA, and FRIA where required |
| Training | HR or compliance | Attendance records, role-based curricula |
What to do in the first 90 days
- Weeks 1 to 3: owner named, steering group meeting, first inventory draft from IT, procurement and each department.
- Weeks 4 to 6: prohibited-practice screen, role and risk class for each system, high-risk candidates flagged.
- Weeks 7 to 9: vendor questionnaires out, contract template updated, AI literacy plan approved.
- Weeks 10 to 13: Article 50 notices live where needed, oversight roles assigned for high-risk uses, evidence folders created and a review date set.
Share your AI inventory and deployment requirements. We can help your teams define the architecture, access controls, logs and technical evidence for each system.
Discuss your enterprise AI architectureFAQ
What is the first thing an enterprise should do for the EU AI Act?
Build an inventory of every AI system in use, including features inside software you already buy. Roles, risk classes and controls all depend on knowing what you have.
Did the Digital Omnibus cancel the high-risk rules?
No. It deferred them: Annex III systems now to 2 December 2027 and Annex I products to 2 August 2028. The prohibitions, AI literacy and transparency duties are not deferred, apart from a grace period for the Article 50(2) marking duty on systems already on the market.
Do we need a separate fundamental rights impact assessment?
Only if Article 27 applies to you, which covers public bodies, private entities providing public services and deployers of certain credit and insurance systems. Where you also need a GDPR impact assessment, the two can be run together.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 4, 5, 6, 26, 27, 50 and Chapter III, Official Journal of the EU
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the EU, 24 July 2026
- European Commission, FAQ on transparency obligations under Article 50 of the AI Act
- AI Act Service Desk, Article 26: obligations of deployers of high-risk AI systems
About the author
Artem Synytskyi · Co-founder · AI
Artem runs AI at ESADEX, building LLM, RAG and speech-to-text systems for regulated environments.