An AI Act plan built from a single deadline is likely to be incomplete. The European Commission's current framework describes staged application, different risk categories, and distinct duties across the AI value chain. Its October 2026 material also reflects changes that make older summaries unreliable.
Start with the system and your role
Record the intended purpose, affected people, operating jurisdictions, and whether your organization provides or deploys the system. Buying a general-purpose model does not answer how the resulting application should be classified. A writing assistant and a recruitment-screening system can use similar technology while presenting very different legal questions.
Separate current duties from future work
The Commission says GPAI rules became effective in August 2025 and transparency rules in August 2026. Its current overview identifies December 2, 2027 for the high-risk requirements discussed there, with separate treatment for certain product-related systems. Have counsel confirm the exact timetable and transitional provisions for your deployment.
Do not postpone privacy, security, consumer-protection, or sector-specific obligations while waiting for an AI Act milestone. Those requirements may apply independently.
Turn the assessment into evidence
Create an obligation register showing the requirement, responsible role, owner, control, evidence, and review date. Link disclosure tests, supplier documents, oversight arrangements, and incident procedures to the relevant entry.
For quality management, review what EN 18286 actually covers before making conformity claims. A harmonised standard addressing one article is not a universal compliance certificate. This article is operational guidance, not legal advice; use the current official sources to scope a qualified legal assessment.
Sources & further reading
Reviewed October 26, 2026. Product availability and regulatory guidance can change. Vendor performance claims are not independent Rovio AI benchmarks.
Found this useful? Share it.