AI strategy and EU AI Act readiness
EU AI Act readiness, ahead of December 2027.
In July the Digital Omnibus moved the high risk deadline for Annex III systems from August 2026 to 2 December 2027. Prohibited practices, AI literacy and transparency duties already apply. We find every AI system you run, classify it, and build governance into delivery so the deadline arrives as a formality.
EU AI Act, key dates
2 Feb 2025
Prohibited practices and AI literacy apply
2 Aug 2025
General purpose AI model obligations apply
2 Aug 2026
Transparency duties under Article 50 apply
2 Dec 2026
New prohibitions, and marking for generative systems already on the market
2 Dec 2027
High risk requirements for Annex III systems, moved from August 2026
2 Aug 2028
High risk requirements for Annex I product systems
A readiness programme that leaves working controls behind
Inventory
Every AI system you build, buy or have switched on inside a SaaS tool, with an owner for each.
Classification
A risk tier for each system under the Act, with reasoning a regulator can follow.
Gap plan
What is missing, who owns it and by when, sequenced against the dates that apply to you.
Governance in delivery
Evaluation, logging, human oversight and documentation built into how AI gets shipped.
Use case portfolio
Candidate use cases ranked by value and feasibility, so compliance and value are decided together.
Governance that lives in the pipeline.
A policy deck gets read once. Controls built into how AI is shipped get used every week: evaluation before release, logs that show what the system did, and a named person who signs off. That is what an auditor will ask to see, and it is also what makes AI safe to scale.
Rakesh took GenAI into production at Freshfields, a regulated legal environment where hallucination risk was existential, across 2,500 lawyers in 28 offices. The same discipline runs through every build we do.
We are not a law firm. Where a legal opinion is needed, we work alongside your counsel.
Questions
What changed with the Digital Omnibus?
Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved high risk requirements for Annex III systems, such as AI used in hiring, credit and education, from 2 August 2026 to 2 December 2027, and for Annex I product systems to 2 August 2028. It also extended simplified rules to more mid sized companies and added new prohibitions from 2 December 2026.
Does the Act apply if we only use AI tools rather than build them?
Yes. Deployers have obligations too, and some already apply: AI literacy measures since February 2025 and transparency duties since August 2026. If you use AI in hiring, credit or other Annex III areas, the high risk deployer duties will follow.
Is this legal advice?
No. We are delivery specialists, not a law firm. We build the inventory, classification and governance, and work alongside your counsel where a legal opinion is needed.
How are engagements priced?
Fixed scope and a fixed price, agreed after a scoping call.
Know what you run. Then prove it.
Thirty minutes to map where you stand: which systems you run, which dates apply, and what to do first. If you are further along than you think, you will hear that too.