Your 8-Step Path to AI Act Compliance
Complete implementation roadmap for achieving AI Act compliance. From risk classification to post-market monitoring, this guide walks you through every requirement with practical timelines and expert guidance.
AI Act Implementation Timeline
The AI Act applies in stages. The prohibitions apply since 2 February 2025 and the rules for general-purpose AI models since 2 August 2025; the requirements for high-risk AI systems apply from 2 December 2027 (Annex III) and 2 August 2028 (products under Annex I).
Entry into force
The AI Act enters into force. Its rules apply in stages, from the dates below.
Art. 113, first paragraph
Prohibitions and AI literacy
The general provisions, including AI literacy, and the prohibited AI practices of Article 5 apply.
Art. 113, third paragraph, point (a)
General-purpose AI models and governance
The obligations for providers of general-purpose AI models apply, together with the rules on governance, notified bodies and penalties. The fines for providers of general-purpose AI models follow on 2 August 2026.
Art. 113, third paragraph, point (b)
Most other rules, including transparency
The AI Act applies in general from this date, including the transparency obligations of Article 50.
Art. 113, second paragraph
New prohibitions and marking of synthetic content
The prohibitions on AI systems that generate non-consensual sexual deepfakes or child sexual abuse material apply. Providers of systems that generate synthetic audio, images, video or text and were placed on the market before 2 August 2026 must meet Article 50(2), the marking of that content.
Art. 113, third paragraph, point (a); Art. 111(4)
General-purpose AI models already on the market
Providers of general-purpose AI models placed on the market before 2 August 2025 must comply.
Art. 111(3)
High-risk AI systems in Annex III
The requirements and obligations for the high-risk AI systems listed in Annex III apply, for example in employment, education, credit scoring and law enforcement.
Art. 113, third paragraph, point (c)(i)
High-risk AI in products under Annex I
The same rules apply to AI systems that are high-risk as products, or safety components of products, covered by the Union legislation in Annex I, such as machinery, toys and medical devices.
Art. 113, third paragraph, point (c)(ii)
High-risk AI systems of public authorities
High-risk AI systems placed on the market before their rules applied fall under the AI Act only after a significant change in their design; those intended for use by public authorities must comply by this date.
Art. 111(2)
Complete AI Act Implementation Roadmap
Follow these 8 proven steps to achieve full AI Act compliance. Each step builds on the previous one, ensuring you create a comprehensive AI governance program that protects fundamental rights and meets regulatory requirements.
1. Classify Your AI System Risk Level
Determine which of the four risk categories applies to your AI system
Key Actions
- Review prohibited AI practices (social scoring, subliminal manipulation, etc.)
- Check if your AI system appears on the high-risk applications list
- Assess if your system requires transparency disclosures
- Document your risk classification with supporting rationale
Available Tools
Real Examples
2. Establish AI Governance Framework
Set up organizational structures for AI oversight and accountability
Key Actions
- Designate AI governance roles and responsibilities
- Create AI risk management policies and procedures
- Establish AI system inventory and lifecycle tracking
- Implement human oversight mechanisms for AI decisions
Available Tools
Real Examples
3. Implement High-Risk AI Requirements
Apply strict compliance measures for high-risk AI systems
Key Actions
- Establish quality management system for AI development
- Implement robust testing and validation procedures
- Create comprehensive technical documentation
- Set up post-market monitoring and incident reporting
Available Tools
Real Examples
4. Ensure AI Transparency and Explainability
Make AI decision-making processes transparent to users and stakeholders
Key Actions
- Implement clear disclosure when users interact with AI
- Create explanations for AI decisions affecting individuals
- Develop user-friendly AI system information
- Establish processes for handling user questions about AI
Available Tools
Real Examples
5. Implement AI Data Governance
Ensure training data quality, bias mitigation, and privacy protection
Key Actions
- Establish data quality and bias assessment procedures
- Implement privacy-preserving data handling practices
- Create data lineage and provenance tracking
- Set up ongoing data monitoring and refresh processes
Available Tools
Real Examples
6. Complete Conformity Assessment
Demonstrate compliance through formal assessment and documentation
Key Actions
- Conduct internal conformity assessment procedures
- Prepare EU declaration of conformity
- Affix CE marking to high-risk AI systems
- Submit required notifications to authorities
Available Tools
Real Examples
7. Establish Post-Market Monitoring
Monitor AI system performance and report incidents to authorities
Key Actions
- Set up continuous performance monitoring systems
- Implement incident detection and reporting procedures
- Establish corrective action and system update processes
- Create regular compliance review and audit schedules
Available Tools
Real Examples
8. Maintain Ongoing Compliance
Keep up with evolving requirements and maintain compliance over time
Key Actions
- Monitor regulatory updates and guidance documents
- Update AI systems and documentation as requirements evolve
- Conduct regular compliance assessments and gap analyses
- Maintain relationships with regulators and industry groups
Available Tools
Real Examples
AI Act Quick Reference
Key risk levels, deadlines, and penalties at a glance
AI Risk Levels
- • Prohibited: Completely banned (social scoring)
- • High-risk: Strict requirements (hiring, healthcare)
- • Limited-risk: Transparency only (chatbots)
- • Minimal-risk: No requirements (games)
Key Deadlines
- • 2 Feb 2025: Prohibited AI practices
- • 2 Aug 2025: General-purpose AI models
- • 2 Aug 2026: Transparency (Article 50)
- • 2 Dec 2027: High-risk AI, Annex III
- • 2 Aug 2028: High-risk AI in Annex I products
Maximum Penalties
- • Prohibited AI: €35M or 7% revenue
- • High-risk AI: €15M or 3% revenue
- • Product bans and recalls
- • Criminal liability possible
Supporting Tools and Resources
Everything you need to implement and maintain AI Act compliance