AI Insight Lab — The Deployment MemoJune 2, 2026

The EU AI Act Compliance Deadline

Ten weeks to August 2, 2026. What your enterprise is not doing — and what it must.

The Deployment Memo — AI Insight Lab | June 2, 2026

Background

What the EU AI Act requires, when it applies, and who it applies to.

01 — Background

The Act, the timeline, and the deployer gap.

•EU AI Act (Regulation 2024/1689) became law August 1, 2024. High-risk AI system obligations take effect August 2, 2026.
•Two distinct obligation sets: providers (who build AI) and deployers (who use it). Vendor compliance does not satisfy deployer obligations.
•Annex III high-risk categories include: employment/HR AI, credit and insurance scoring, educational assessment, biometric systems, critical infrastructure AI.
•Deployer obligations: conformity assessment, human oversight assignment, operational logging, incident reporting (72-hour window), transparency to affected individuals.
•Enforcement is live: national supervisory authorities operational since August 2025. Maximum fines: €15M or 3% of global turnover.
•Industry surveys: fewer than 20% of large EU-based enterprises completed an Annex III inventory as of late 2025.

Decision Required

The question your board must answer before August 2.

02 — Decision Required

Are you a deployer of high-risk AI — and are you compliant?

If your organisation uses AI in hiring, performance management, credit decisions, insurance underwriting, or benefits assessment — you are almost certainly a high-risk AI deployer under Annex III.

The compliance question is not whether your vendor is compliant. It is whether your organisation has: inventoried its AI systems against Annex III, assigned qualified human oversight, established logging and incident reporting, and documented the conformity basis for each in-scope system.

Unanswered question: which function owns this, with what authority — and have they started?

03 — Options

Four positions your organisation can take.

Option A

Treat August 2 as a soft target

Build compliance iteratively post-deadline. Bet on enforcement focus on egregious cases in 2026. Requires a credible documented programme.

Option B

Suspend unclassified AI systems

Operational hold pending classification review. Eliminates new risk accumulation; disrupts embedded AI workflows.

Option CRecommended

30-day inventory and compliance sprint

Cross-functional inventory now. Prioritise employment and credit AI. Build documentation, oversight, and incident reporting before August 2.

Option D

Apply EU AI Act standards globally

Use Annex III as the single global framework. Higher upfront cost; avoids dual-framework overhead as UK, US state laws follow.

04 — Recommendation

Option C now, Option D as the target state.

✓Start the inventory within two weeks. Push a structured Annex III questionnaire to HR, finance, IT, operations, and customer service.
✓Prioritise employment AI and credit/insurance AI — highest enforcement priority, highest fundamental-rights exposure.
✓For each in-scope system: get vendor conformity documentation; assign a named human oversight owner; establish log retrieval; document the compliance basis.
✓Build the 72-hour incident reporting workflow now — most enterprises do not have one for AI-specific failures.
✓Decision on global scope: the EU AI Act, UK AI Bill, and US state employment AI laws are converging. One governance framework now is cheaper than three later.

05 — Risks

What the board needs to know.

1.Shadow IT and function-adopted SaaS

The highest-risk AI tools are likely ones IT does not know about — HR, finance, and sales SaaS adopted without procurement or legal review. The inventory must reach every function.

2.Vendor compliance ≠ deployer compliance

A vendor's EU AI Act documentation does not satisfy your organisation's independent obligations. Human oversight, logging, and incident reporting must be yours.

3.72-hour incident reporting with no infrastructure

Most enterprises cannot currently detect an AI-specific serious incident, determine reportability, and notify the national supervisory authority in 72 hours. This requires a dedicated workflow.

4.Employment AI is the first enforcement priority

German, French, and Dutch supervisory authorities have signalled that recruitment and performance AI is an early enforcement target. If you use AI in hiring or performance management, you are in the first wave.

06 — Questions

Six questions for your governance review.

1.Who owns the Annex III AI system inventory — and does that function have access to every business unit's deployed tools?
2.For each high-risk AI system: is a named, qualified human oversight owner formally assigned, with documented authority to intervene?
3.Does your organisation have an AI incident detection and 72-hour reporting workflow ready for August 2?
4.For employment AI: can you demonstrate human oversight in a way that would satisfy a supervisory authority inquiry today?
5.Which function owns EU AI Act compliance — with what authority to halt or remediate non-compliant deployments?
6.Have you decided whether to apply EU AI Act standards globally — and documented that decision with risk acceptance for any non-EU scope?

AI Insight Lab

The Deployment Memo

One enterprise AI deployment, dissected every Tuesday. Written for executives who have to decide, not just read.

Subscribe at aiinsightlab.cloud — free during beta.

The Act, the timeline, and the deployer gap.

•EU AI Act (Regulation 2024/1689) became law August 1, 2024. High-risk AI system obligations take effect August 2, 2026.

•Two distinct obligation sets: providers (who build AI) and deployers (who use it). Vendor compliance does not satisfy deployer obligations.

•Annex III high-risk categories include: employment/HR AI, credit and insurance scoring, educational assessment, biometric systems, critical infrastructure AI.

•Deployer obligations: conformity assessment, human oversight assignment, operational logging, incident reporting (72-hour window), transparency to affected individuals.

•Enforcement is live: national supervisory authorities operational since August 2025. Maximum fines: €15M or 3% of global turnover.

•Industry surveys: fewer than 20% of large EU-based enterprises completed an Annex III inventory as of late 2025.

Are you a deployer of high-risk AI — and are you compliant?

If your organisation uses AI in hiring, performance management, credit decisions, insurance underwriting, or benefits assessment — you are almost certainly a high-risk AI deployer under Annex III.

Unanswered question: which function owns this, with what authority — and have they started?

Four positions your organisation can take.

Option A

Treat August 2 as a soft target

Build compliance iteratively post-deadline. Bet on enforcement focus on egregious cases in 2026. Requires a credible documented programme.

Option B

Suspend unclassified AI systems

Operational hold pending classification review. Eliminates new risk accumulation; disrupts embedded AI workflows.

Option CRecommended

30-day inventory and compliance sprint

Cross-functional inventory now. Prioritise employment and credit AI. Build documentation, oversight, and incident reporting before August 2.

Option D

Apply EU AI Act standards globally

Use Annex III as the single global framework. Higher upfront cost; avoids dual-framework overhead as UK, US state laws follow.

Option C now, Option D as the target state.

✓Start the inventory within two weeks. Push a structured Annex III questionnaire to HR, finance, IT, operations, and customer service.

✓Prioritise employment AI and credit/insurance AI — highest enforcement priority, highest fundamental-rights exposure.

✓For each in-scope system: get vendor conformity documentation; assign a named human oversight owner; establish log retrieval; document the compliance basis.

✓Build the 72-hour incident reporting workflow now — most enterprises do not have one for AI-specific failures.

✓Decision on global scope: the EU AI Act, UK AI Bill, and US state employment AI laws are converging. One governance framework now is cheaper than three later.

What the board needs to know.

1.Shadow IT and function-adopted SaaS

The highest-risk AI tools are likely ones IT does not know about — HR, finance, and sales SaaS adopted without procurement or legal review. The inventory must reach every function.

2.Vendor compliance ≠ deployer compliance

A vendor's EU AI Act documentation does not satisfy your organisation's independent obligations. Human oversight, logging, and incident reporting must be yours.

3.72-hour incident reporting with no infrastructure

Most enterprises cannot currently detect an AI-specific serious incident, determine reportability, and notify the national supervisory authority in 72 hours. This requires a dedicated workflow.

4.Employment AI is the first enforcement priority

Six questions for your governance review.

1.Who owns the Annex III AI system inventory — and does that function have access to every business unit's deployed tools?

2.For each high-risk AI system: is a named, qualified human oversight owner formally assigned, with documented authority to intervene?

3.Does your organisation have an AI incident detection and 72-hour reporting workflow ready for August 2?

4.For employment AI: can you demonstrate human oversight in a way that would satisfy a supervisory authority inquiry today?

5.Which function owns EU AI Act compliance — with what authority to halt or remediate non-compliant deployments?

6.Have you decided whether to apply EU AI Act standards globally — and documented that decision with risk acceptance for any non-EU scope?