The EU AI Act is here: what enterprises deploying AI must have in place

If your AI touches anyone in the EU, the EU AI Act applies to you regardless of where you are based, and it carries the sharpest penalties in tech regulation: up to €35M or 7% of global turnover, higher than GDPR. General-purpose AI obligations have applied since August 2025 and transparency duties since August 2026. High-risk obligations for Annex III systems were deferred to December 2027 under the May 2026 Digital Omnibus agreement: relief on the deadline, not on the direction of travel.

The Act reaches any AI offered to EU users, wherever you are based. Preparing for conformity assessment from scratch can take 6–12 months, so "we will deal with it later" is already late for the next deadline.

Risk tier decides everything

The Act sorts systems by risk: prohibited practices (banned since February 2025), high-risk systems (the heavy compliance tier), limited-risk systems that carry transparency duties, and minimal-risk. Most enterprise deployments land in transparency or high-risk. The expensive mistake is misclassifying a high-risk use case as limited, because the obligations, from risk management to human oversight to logging, are not something you can retrofit the week before an audit.

What readiness actually requires

Readiness is not a policy document. It is a set of capabilities designed into the system, most of which overlap exactly with what makes an AI deployment trustworthy in the first place.

• An inventory and risk classification of every AI system you deploy or embed, kept current.
• Data governance, logging, and traceability: the same audit trail good agents need anyway.
• Human oversight designed in, with a documented ability to intervene and stop.
• Transparency: users are told when they are interacting with AI, and AI-generated content is disclosed.

The HOWF position

We build to the stricter standard by default, because the controls the AI Act demands (classification, logging, human oversight, transparency) are the same controls that keep an AI system in production instead of in an incident report. Design them in from the first commit and compliance is a report you can run, not a rebuild you have to fund. We help enterprises deploy AI that is defensible to a regulator and a customer at once.