The Annex III high-risk deadline moved from August 2026 to December 2027, and most organisations read that as sixteen months of breathing room. It is not. Transparency duties under Article 50 became applicable in August 2026 and bind you now, prohibitions have been live since February 2025, and the conformity file a regulator eventually asks for is built from records of how the system has been run. You cannot generate operating history in the final quarter.
The AI Act is the loudest instrument but rarely the first one to bite. These three reach your AI systems today, through contracts, sector supervision and existing data law.
The certifiable AI management system, and increasingly the thing enterprise customers ask for in procurement rather than waiting for a regulator. It is a management standard, so it asks who owns each system, how decisions are recorded and how the whole thing is reviewed, which is the same evidence an AI Act conformity file needs.
The de facto expectation in US federal and enterprise contracting, organised around govern, map, measure and manage. It is voluntary and unenforceable on its own, which is exactly why it appears in contracts instead, where it becomes a commitment you can be held to commercially rather than by a supervisory authority.
Financial services, healthcare and critical infrastructure regulators already have powers over the decisions your AI systems influence, through existing operational resilience and data protection law. They do not need AI-specific rules to ask how a decision was reached, and GDPR Article 22 has covered automated decisions for years.
Provider, deployer and importer carry different duties, and most organisations are more than one at once. Fine-tune a model past a threshold and you become a provider.
Event logging, data provenance at ingestion and post-market monitoring as a time series. These are worth little on day one and everything in two years, so start them now.
Article 50 binds chatbots, generated content and emotion recognition today. Disclosure and machine-readable marking are cheap to add now and awkward to retrofit later.
Make model cards, oversight records and monitoring output fall out of the pipeline automatically. Hand-written artefacts go stale between the writing and the audit.
No. It moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028, but left prohibitions, general-purpose model duties and Article 50 transparency exactly where they were. Three of those are already in force, so pausing means missing live obligations while you wait for a deferred one.
Less, but not none, and the line is easier to cross than most teams expect. Deployers carry human oversight, input data and monitoring duties. Put your own name on a bought system, or fine-tune one past a substantial modification threshold, and you take on provider obligations for it.
It is not a conformity presumption, but it is the most useful thing you can hold. The management system it certifies produces the ownership records, review cadence and documentation discipline that a conformity file draws on, so certified organisations start from evidence rather than from nothing.
The things that only have value once they have been running: event log retention, data provenance captured at ingestion rather than reconstructed later, post-market monitoring as a time series, and oversight records that capture where a human disagreed with the system.
This paper covers the duties and the evidence that satisfies them. AI Governance: An Engineering Reference is the control catalogue that produces that evidence, with numbered controls and the artefact that proves each one. Read this for what is required, that one for what to build.
CISOs, general counsel and heads of risk who have to answer what happens if an authority or a customer's auditor asks this quarter. It assumes you already know the AI Act exists and now need the dates, the roles and the evidence list.
Drop your details and we'll send AI Governance Under Regulation straight to your inbox - no spam, unsubscribe anytime.
Talk through what your systems would need to produce if a supervisory authority asked this quarter. A working session with our engineering leads, not a sales pitch. SECTION 7 - FAQ - 5 to 8 questions
Talk to our engineers