EU AI Act 2025: Your Complete Compliance Roadmap

The Clock is Ticking

If your organization uses AI in the European Union, the EU AI Act is no longer a future concern—it's today's reality. If you also run a voluntary risk framework, our NIST AI RMF vs the EU AI Act comparison shows how the two fit together.

The Act became applicable on 2 August 2026, and the AI Office and national authorities are now responsible for enforcing it. The AI Omnibus, in force since 27 July 2026, moved the high-risk deadlines to 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products. That is more time, not a reprieve — and compliance is often the very gap that decides how you get a stalled AI pilot to production in the first place.

Implementation Timeline: What's Already in Force

Phase 1: February 2, 2025 (Active)

The first wave of obligations is already in effect:

• AI Literacy Requirements: Organizations must ensure staff have sufficient AI literacy to deploy and use AI systems responsibly
• Prohibited AI Practices: Certain AI practices are now banned, including social scoring systems and real-time remote biometric identification in publicly accessible spaces for law enforcement (with limited exceptions)

Phase 2: August 2, 2025 (Active)

The governance framework is now operational:

• AI Office: The EU's central authority for AI Act enforcement is operational
• AI Board: Coordination body for member states is active
• National Competent Authorities: Member states had to designate their enforcement bodies and adopt their national rules on penalties
• GPAI Model Obligations: Providers of general-purpose AI models must now comply with technical documentation and copyright requirements
• Penalty Framework: Articles 99 and 100 on fines and enforcement are now applicable

Phase 3: August 2, 2026 (Active)

The Act became applicable, with the exceptions listed in Phase 4:

• Transparency Rules: Article 50 requirements for AI system disclosure apply
• Enforcement: The AI Office and national authorities are responsible for supervising and enforcing the Act, including for general-purpose AI models, prohibitions, transparency rules and AI literacy
• High-Risk AI Systems: Not yet — the AI Omnibus moved these dates (see Phase 4)

Phase 4: December 2026 to August 2028 (Coming, as amended by the AI Omnibus)

• 2 December 2026: A new prohibition applies to AI systems that generate non-consensual sexual deepfakes and child sexual abuse material; providers of generative systems already on the market before 2 August 2026 must meet the Article 50(2) marking obligation
• 2 August 2027: GPAI models placed on the market before August 2025 must comply, and each member state must have at least one AI regulatory sandbox operational
• 2 December 2027: High-risk rules apply to AI systems in Annex III categories (access to essential services, education, employment, law enforcement, etc.)
• 2 August 2028: High-risk rules apply to AI embedded in products covered by Annex I, such as lifts or toys

Penalty Structure: The Cost of Non-Compliance

The EU AI Act has teeth. Here's what organizations face:

For SMEs, including start-ups, fines are capped at the lower of the two options. But for larger enterprises, these penalties can be substantial.

Regulators already fine AI providers under existing law. In May 2025, Italy's data protection authority announced a €5 million fine against Luka Inc., the company behind the Replika chatbot, under the GDPR rather than the AI Act. Data protection enforcement against AI services does not wait for the AI Act's own deadlines.

What Shadow AI Means for Compliance

Here's the uncomfortable truth: Shadow AI automatically creates compliance gaps.

If employees are using ChatGPT, Claude, Copilot, or other AI tools without organizational oversight, your enterprise is likely violating multiple EU AI Act requirements:

1. AI Literacy Failure: If you don't know what AI tools employees use, you can't ensure they have proper training
2. Documentation Gaps: Unapproved AI usage means no technical documentation, no risk assessments
3. Transparency Violations: You can't disclose AI usage to affected parties if you don't know it's happening
4. Data Protection Risks: Shadow AI often involves processing personal data without appropriate safeguards

WalkMe's 2025 survey found that 78% of employees use AI tools not provided by their employer, while Cyera's 2025 report found that only 13% of enterprises have strong visibility into how AI is being used.

Your Compliance Roadmap

Immediate Actions (This Month)

1. Conduct an AI Inventory: Identify all AI systems in use—both approved and unapproved
2. Assess Risk Categories: Classify each AI system according to the Act's risk framework
3. Review AI Literacy: Evaluate staff training needs and current knowledge levels
4. Check Prohibited Uses: Ensure no prohibited AI practices are occurring

Short-Term (Next 3 Months)

1. Establish Governance: Designate AI governance responsibilities within your organization
2. Create Documentation: Begin technical documentation for high-risk AI systems
3. Develop Policies: Implement approved AI usage policies and communicate them
4. Deploy Monitoring: Establish visibility into AI tool usage across the organization

Medium-Term (Before the High-Risk Deadlines)

1. Complete Risk Assessments: Finalize assessments for all high-risk AI systems before 2 December 2027 (Annex III) or 2 August 2028 (Annex I)
2. Implement Controls: Deploy appropriate safeguards for each risk category
3. Prepare for Audits: Ensure documentation and evidence are audit-ready
4. Train Continuously: Maintain ongoing AI literacy programs

The QAIZEN Approach

At QAIZEN, we help organizations navigate EU AI Act compliance through our Digital Goldsmith methodology:

Precision: We provide exact gap analysis, not generic checklists. Every organization's AI landscape is different.

Craftsmanship: Our compliance roadmaps are tailored to your industry, size, and specific AI usage patterns.

Lasting Value: We build governance frameworks that scale with your AI adoption, not one-time fixes.

Take the First Step

Compliance starts with visibility. If you don't know what AI tools are being used in your organization, you can't begin the compliance journey.

Our Shadow AI Audit gives you in 5 minutes:

• A governance score with a letter grade from A to F
• A regulatory compliance score, alongside AI visibility, governance, data protection and incident response
• The risks your answers reveal, ranked by severity
• A personalized 90-day governance roadmap, generated on request

Free. Anonymous. Instant results.

The high-risk deadlines moved, but the obligations did not go away. Start now.