EU AI Act
The EU AI Act is coming. Will your AI stand up to it?
The Act is phasing in now. Transparency duties land in August 2026, and under the Digital Omnibus adopted in June 2026 the high-risk obligations for standalone systems now apply from December 2027. We help you understand whether you are in scope and build audit-ready AI governance in time, calmly and well ahead of the deadlines.
The transparency obligations are coming. Is your AI governance ready?
The EU AI Act phases in. Transparency duties apply from 2 August 2026, and under the Digital Omnibus adopted in June 2026 the high-risk obligations for standalone systems now apply from December 2027. We help you build audit-ready AI governance and prepare in good time.
Check your readinessWhat it is
A new bar for how organisations govern AI.
The EU AI Act is the first broad law setting rules for how AI is built and used. It takes a risk-based approach: a few uses are banned outright, a defined set are treated as high-risk and carry real obligations, and most everyday uses carry lighter, mainly transparency, duties.
For most organisations the practical question is not “are we an AI company”, but “where are we already using AI, and does any of it land in the high-risk category”. Answer that early and the rest becomes a manageable programme rather than a scramble.
The timeline
Phased obligations, with real duties landing from 2026.
- Feb 2025Prohibited practicesA short list of banned AI uses takes effect, alongside an AI-literacy duty for staff working with AI.
- Aug 2025General-purpose AIGovernance and transparency obligations begin for general-purpose AI models and the bodies overseeing them.
- Aug 2026Transparency dutiesTransparency obligations apply from 2 August 2026: telling people when they are dealing with AI or AI-generated content. This is the next live milestone.
- Dec 2026Watermarking & new prohibitionsWatermarking requirements for existing generative systems, and the additional prohibitions, apply from 2 December 2026.
- Dec 2027High-risk (standalone)Under the Digital Omnibus adopted in June 2026, the core obligations for standalone high-risk systems (Annex III: recruitment, credit, education, law enforcement) now apply from 2 December 2027.
- Aug 2028High-risk in productsHigh-risk obligations for AI embedded in regulated products (Annex I) apply from 2 August 2028.
Are you in scope?
More UK organisations are caught than expect to be.
You build or sell AI
If you develop AI systems or put your name on them, you may be a “provider” with the heaviest obligations.
You deploy AI
If you use AI in your operations or decisions, you may be a “deployer” with duties around oversight and use.
You serve the EU
A UK base is no exemption: if your AI affects people in the EU, you can be in scope. This is a UK question too.
Not sure where you sit? The 2-minute readiness check gives you a quick, honest read.
How to prepare
Discover, classify, govern, evidence.
- 01DiscoverFind where AI is already used across the business, including shadow-sm AI in teams and tools you did not procure.
- 02ClassifyWork out which uses are likely high-risk, and which fall outside scope, so effort goes where the obligations are.
- 03GovernStand up an AI management system (ISO 42001 maps neatly here), with a named owner, policy and acceptable use.
- 04EvidenceProduce the documentation, oversight and records the Act expects, kept current through continuous compliance.
Your readiness toolkit
Everything you need to get started.
A note on what this is and isn’t: we help you build audit-ready AI governance and prepare for the EU AI Act. ISO 42001 is a management-system standard and a strong commercial signal, but it is not, on its own, legal compliance with the Act, and we don’t present it as such. We’ll always be clear about where readiness ends and legal advice begins.
Get ahead of the EU AI Act timeline.
Tell us how AI shows up across your organisation. We’ll map a calm, costed path to audit-ready governance and EU AI Act readiness.
Book a call