EU AI Act

Every date that matters, from the June 2024 adoption through the 2 August 2026 general application to the Annex I deadline in 2027. Includes what to prioritise in the weeks you have left.

The obligations in the order you should tackle them. Work out your role, inventory and classify your systems, drop the banned ones, then build the paperwork high-risk and GPAI providers owe.

The tier that carries the engineering work. How Annex I and Annex III classification works, all eight high-risk domains, the Article 6(3) derogation, and the provider and deployer checklists.

The eight practices banned outright under Article 5, with the legal test and exceptions for each. Includes the two that catch ordinary HR and personalisation software.

The Act in plain English with no legal jargon. What counts as an AI system, why there are four risk tiers, and how to tell in ten minutes which one your product falls into.

Point it at a GitHub repo and get an inventory of every AI SDK, model, agent config, and MCP server in it, plus ranked static risks. The inventory step the Act asks for, done in about a minute.

How to run the controls the Act assumes you already have: policy on what agents may touch, human sign-off on risky actions, and an audit trail that answers questions after the fact.

You cannot classify a system nobody registered. Find the models, copilots, and agents already running across your engineering org before an auditor asks for the list.