How to prepare your business for the EU AI Act.

Most clients call us once they’ve discovered their legal team has been quietly assembling an EU AI Act question list for the past six months. By that point everyone has already absorbed the headlines — 7% global turnover fines, the 2 August 2026 high-risk deadline (status note below), Annex IV, prohibited practices — and the remaining question is the only one that matters: where do we actually start?

Quick note on the moving deadline: the EU "Digital Omnibus" political agreement reached on 7 May 2026 will, once formally adopted (expected June–July 2026), defer the high-risk Annex III deadline from 2 August 2026 to 2 December 2027. Until Official Journal publication of the amending regulation, the August 2026 deadline remains the law. We keep our live EU AI Act timeline page updated within 48 hours of any OJ change.

Here is the six-step sequence we run in our AI Readiness Assessment and in larger Governance engagements. It is deliberately ordered: each step makes the next one cheaper.

1. AI System Inventory (week 1–2)

You cannot classify what you cannot see. The first task is always a complete catalogue of every AI system inside the organisation — including the ones nobody bothered to mention. In our engagements this means:

• Built systems — whatever your engineering team has shipped that uses an LLM, a classical ML model, or a deterministic decision rule that someone might still call "AI" under the Act’s definition.
• Bought systems — every SaaS tool with "AI", "smart", or "automated" in its marketing, plus the ones that don’t advertise it but do it anyway (your HR platform, your CRM’s lead scorer, your IT-ticket router).
• Shadow systems — the Copilot licences nobody approved, the ChatGPT plus subscriptions on company cards, the n8n workflows somebody built last quarter.

This is the step where our ComplianceLint scanner does most of the heavy lifting in source repositories. The shadow-systems part still needs humans — usually a procurement export plus a couple of interviews.

Output: a spreadsheet or Notion database with system name, owner, data sources, third-party dependencies, and business purpose.

2. Risk classification (week 2–3)

With the inventory in hand, each system maps against the four EU AI Act risk tiers:

• Prohibited (Art. 5) — rare, but if you have one, you have a serious problem.
• High-risk (Annex III) — HR, credit, education, biometrics, law enforcement, critical infrastructure, and a few others. This is where the 2 August 2026 deadline currently lives (May 2026 Digital Omnibus may defer to 2 December 2027 once formally adopted — see our EU AI Act page).
• Limited risk (Art. 50) — transparency obligations (chatbots disclose, deepfakes label).
• Minimal risk — the residual category. No specific obligations beyond Article 4 literacy.

This step is where most internal "AI is everywhere, we’re doomed" panic resolves. Typical Mittelstand: 1–3 high-risk systems, a handful of limited-risk chatbots, the rest minimal-risk. The Annex IV pack (next step) only applies to the high-risk ones.

Output: classification table with cited reasoning per system.

3. Annex IV technical documentation pack (week 3–10)

For every high-risk system, Annex IV requires nine chapters of mandatory technical documentation: general description, system elements, monitoring, performance metrics, risk management, lifecycle change log, harmonised standards used, conformity declaration, and post-market monitoring plan. We deliver this as a modular Markdown / Word / JSON pack you can update without rewriting.

For a single high-risk system the pack takes roughly 8–12 weeks if your engineering team is responsive. For multiple systems, plan 10–14 weeks for a bundle — we work in parallel where we can.

4. Article 4 AI literacy program (week 4–8)

Article 4 is already enforceable — in force since February 2, 2025. Every staff member and operator using AI on your behalf needs documented training. Most organisations get this wrong by either ignoring it or by buying generic SCORM modules nobody watches.

What works:

• 4-tier curriculum — all-staff baseline (15 minutes), power users (45 minutes), technical staff (2 hours), leadership (1 hour briefing).
• Role-targeted content — what HR needs to know about AI in recruitment is different from what a developer needs.
• Documented completion — auditors will ask for evidence per person per role per date.
• Refresh cycle — at least annually, and on any material change to your AI estate.

5. ISO/IEC 42001 alignment (optional but increasingly expected)

ISO/IEC 42001 (2023) is the first international AI management system standard. Voluntary, but procurement and auditors are starting to ask. We don’t typically push clients to full certification — we align your processes so you could pass an audit if you wanted to. The alignment work overlaps significantly with Annex IV documentation, so doing both in the same engagement is more efficient than doing them sequentially.

6. Conformity declaration + evidence room (final 2–3 weeks)

The legal output. A signed Declaration of Conformity per high-risk system, plus an evidence room — a structured archive of policies, sampling reports, human-oversight decision records, validation logs, training datasheets, model cards. The principle: any future auditor, including yourself in two years when you’ve forgotten the details, should be able to reconstruct what you did and why.

Realistic timelines

• Single high-risk system, mature engineering team: 8–12 weeks end-to-end.
• Multiple systems, mid-sized Mittelstand: 14–20 weeks.
• Pure Article 4 literacy program rollout: 6–8 weeks design + ongoing delivery.

Where Kisum fits

This is the work we do every day. Most of it lives in our AI Governance Package and AI Readiness Assessment offerings , and for the EU AI Act specifically we publish a dedicated EU AI Act Consulting page with three packaged paths. If any of the above looks like a question you’re currently sitting on, the next step is a email exchange.

Email us