# EU AI Act readiness

> The EU AI Act regulates AI systems placed on the EU market or used in the EU, with obligations based on risk tier and on whether you are a provider or deployer. It can apply to US companies. CyberAccord classifies your AI systems, analyzes gaps against your obligations and delivers a prioritized roadmap, coordinated with your legal counsel.

Source: https://www.cyberaccord.com/compliance/eu-ai-act · Last reviewed: 2026-10-21

If you build or use AI that reaches the EU market, the EU AI Act applies in phases, and some obligations are already in force. We help you classify your systems, understand your obligations and build a roadmap to meet them.

## Key facts

- **Who it applies to:** Providers and deployers of AI systems on the EU market, wherever they are based
- **Already in force:** Prohibited practices, AI literacy, general-purpose AI model rules and most transparency duties
- **High-risk (Annex III):** Obligations apply from December 2, 2027, following 2026 amendments
- **High-risk (Annex I products):** Obligations apply from August 2, 2028

## Does the EU AI Act apply to us?

The Act applies to providers that place AI systems or general-purpose AI models on the EU market, to deployers that use AI systems in the EU, and to providers and deployers outside the EU when their AI system's output is used in the EU. A US company with EU customers or users can be in scope.

Your role matters. Providers, who develop an AI system or have one developed and market it under their own name, carry most of the obligations. Deployers, who use an AI system in their own operations, have a shorter but real list. One company can be both.

## How are AI systems classified by risk?

The Act sorts AI systems by the risk they pose, and your obligations follow from the tier. Getting classification right is the most important early step, because it determines everything that comes after.

- Prohibited practices, such as certain manipulative techniques and social scoring, are banned
- High-risk systems, such as AI used in hiring, credit decisions or as safety components of regulated products, face requirements for risk management, data governance, documentation, human oversight and conformity assessment
- Limited-risk systems, such as chatbots and generated content, carry transparency duties
- Minimal-risk systems carry no specific new obligations beyond general duties such as AI literacy

## What is the timeline as of October 2026?

The Act entered into force on August 1, 2024 and applies in phases. Prohibited practices and AI literacy obligations have applied since February 2, 2025. Obligations for general-purpose AI models have applied since August 2, 2025. Most remaining provisions, including the main transparency duties, have applied since August 2, 2026.

High-risk obligations moved. Amendments adopted in 2026 as part of the EU's digital omnibus package, in force since July 2026, set December 2, 2027 for stand-alone high-risk systems listed in Annex III and August 2, 2028 for high-risk AI embedded in products covered by Annex I. The delay gives you more time to prepare, not a reason to wait, since documentation and risk management take time to build.

## What we do

We inventory your AI systems, determine whether you act as provider, deployer or both, and map each system to its risk tier with reasoning you can defend. We then analyze gaps against your obligations and deliver a prioritized roadmap.

Our work draws on established AI governance frameworks, including the NIST AI Risk Management Framework and ISO/IEC 42001. Classification under the Act can involve legal interpretation, so we coordinate with your counsel throughout.

## What you get

- AI system inventory
- Provider and deployer role determination for each system
- Risk-tier classification with documented reasoning
- Gap analysis against applicable obligations
- AI literacy program recommendations for staff who operate AI
- Prioritized compliance roadmap tied to the Act's dates

## How it works

1. **Classify and scope.** We inventory your AI systems, determine your role for each and map them to the Act's risk tiers.
2. **Gap analysis.** We compare your current governance, documentation and controls with the obligations that apply to you.
3. **Prioritized roadmap.** We deliver a roadmap ordered by deadline and risk, so the work already in force comes first.

## Frequently asked questions

### We are not based in the EU. Does this apply to us?

It can. The Act applies to providers placing AI on the EU market and to providers and deployers outside the EU when their system's output is used in the EU. The classification step clarifies your exposure.

### How do we know if our system is high-risk?

High-risk systems are those listed in Annex III, such as AI used in employment, credit or essential services, and AI that is a safety component of products covered by Annex I. Some Annex III systems can fall outside high-risk if they meet specific conditions. We map each system against the categories and document the reasoning.

### Were the high-risk deadlines delayed?

Yes. Amendments that entered into force in July 2026 moved Annex III high-risk obligations to December 2, 2027 and Annex I product-related obligations to August 2, 2028. Prohibited practices, AI literacy, general-purpose AI rules and most transparency duties were not delayed.

### What is the difference between a provider and a deployer?

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority in a professional context. Providers carry the heavier obligations, but deployers of high-risk systems have duties too, such as human oversight and monitoring.

### Isn't this a legal question?

It is both legal and technical. We handle the governance, technical and documentation readiness and work with your legal counsel on interpretation, so nothing falls into the gap between the two.

### Does AI security testing help with the AI Act?

Yes. High-risk systems must meet accuracy, robustness and cybersecurity requirements, and testing your AI applications for issues such as prompt injection and data leakage gives you evidence for that work.

## Related

- [AI Security Testing](https://www.cyberaccord.com/services/security-testing/ai-security-testing): Adversarial testing of LLM features, RAG pipelines, and AI agents for prompt injection, data leakage, and tool abuse.
- [Data Privacy](https://www.cyberaccord.com/compliance/data-privacy): Data privacy compliance for GDPR and CCPA/CPRA, including data mapping, gap assessment, security controls and Data Protection Impact Assessments.
- [ISO 27001](https://www.cyberaccord.com/compliance/iso-27001): ISO/IEC 27001:2022 readiness: ISMS design, risk assessment, Annex A controls and preparation for an accredited certification audit.
- [Security Advisory](https://www.cyberaccord.com/services/advisory): Security policies, controls assessments, awareness training, risk management, vCISO leadership, and help with security questionnaires.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com
- Office: 8990 Kirby Dr, Suite 220, Houston, TX 77054