Why AI Act readiness isn’t as hard as it looks — and why the deadline just moved

The EU AI Act reads like a wall of obligations. It isn’t, once you break it down — it maps onto a standard audit plan almost cleanly: inventory your AI systems, classify by risk tier, check governance and documentation against the tier, remediate the gaps. The same discipline most risk functions already run for other regulations.

Worth flagging a recent development for anyone tracking this: the original 2 August 2026 deadline for high-risk system obligations has been pushed back. The “Digital Omnibus” (Regulation (EU) 2026/1744), in force since 27 July 2026, moved it to 2 December 2027 — over a year’s extra runway.

That’s genuinely useful breathing room. But it doesn’t change the hard part, which was never the deadline — it’s that most organisations still don’t have a clean inventory of where AI is actually being used, including the AI nobody officially signed off on. That work doesn’t get easier by waiting, and the prohibited-practice rules are already in force regardless of the extension.

Where would your own AI inventory fall short if someone asked for it tomorrow?