EU AI Act readiness

EU AI Act Readiness for Boards: Know Your Exposure Before December 2027

Most boards cannot say which AI systems their business uses, which of them are high-risk under the EU AI Act, or who owns them. Some obligations already apply. The high-risk deadline is 2 December 2027.

Correct as of 25 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.

Request an EU AI Act Readiness Assessment Get the Board Checklist

The AI governance path: step 1 of 5

Start here if: You don't know where AI is being used in your business, or whether the EU AI Act applies to you.

See the whole path →

Who has to comply

Who does the EU AI Act apply to?

It follows the market, not the head office. What matters is whether your AI, or what it produces, reaches the EU, and what role you play in supplying or using it.

Your situation	Does it apply?
An EU company using AI in its business	Yes. You are the deployer of that AI.
A UK or US company selling an AI product, or a product or service with AI built in, to EU customers	Yes. You are the provider. For high-risk AI you must also appoint an authorised representative in the EU.
A UK or US company whose AI output is used in the EU, for example screening EU job applicants or scoring EU customers from London or New York	Yes, for that system, even if nothing is hosted in the EU.
A UK or US group with an EU subsidiary or office	Yes, for the AI used by or for the EU business.
A company that buys an AI tool, such as an HR or finance platform, and uses it on EU staff or customers	Yes. The vendor is the provider. You are the deployer, with duties of your own.
A company that puts its own name on a high-risk AI system built by someone else, substantially modifies one, or changes a system's purpose so it becomes high-risk	Yes, as the provider, with the heavier obligations that follow.
A company bringing a non-EU AI system into the EU, or reselling one there	Yes, as importer or distributor. You must check the provider has met its obligations.
A UK or US company with no EU customers, staff or operations, whose AI output is not used in the EU	Generally no. Check again before you enter the EU market. Your own country's data protection, employment and consumer laws still apply to your AI.

The full guide: the four roles, what applies now and in 2027, which sectors are caught, and who is out of scope.

Why the board should care

This is a revenue question as much as a compliance one

Penalties set on global turnover

Up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices, and up to EUR 15 million or 3% for many other breaches.

EU contracts

Customers and procurement teams will ask for evidence of compliance. Being able to show it wins work.

Hidden high-risk AI

Hiring, performance, credit and insurance tools inside vendor platforms are the usual blind spot.

Who this is for

UK and US companies that sell into the EU, employ people there or have an EU subsidiary
Boards and audit or risk committees that need an independent view of AI exposure
Executive teams using AI in HR, finance, credit, insurance or customer service
Businesses that build AI features into products sold to EU customers

What it solves

No single list of the AI in use across the business and its vendors
Uncertainty about whether you are a provider, a deployer, or both
Obligations already in force that nobody has checked
No owner, budget or timeline for the high-risk systems due by December 2027

What you get

A board-ready view of your exposure and a plan to close it

An inventory of AI systems in use, including AI inside vendor software
Each system classified by risk tier (unacceptable, high, limited or minimal) and by your role as provider, deployer, importer or distributor
A gap review against the obligations that already apply: banned practices, Article 50 transparency and AI literacy
A prioritised plan for each high-risk system, with owners, vendor actions and dates to December 2027
A short board paper and a quarterly reporting format the board can keep using

How it works

Discover

Structured interviews with the people who buy, build and use AI, plus a review of key vendor platforms.
Classify

Every system placed in a risk tier, with your role (provider, deployer, importer or distributor) recorded and the reasoning written down.
Prioritise

Gaps ranked by exposure and commercial impact, with owners and dates.
Report

Findings presented to the board or committee, with a plan it can govern against.

Free board download

EU AI Act Board Checklist

An EU AI Act PDF for your board: a 15-minute self-check with five actions to take before December 2027, a score for each, and what your result means. Take it to your next board meeting.

Five board actions with 19 evidence-based checks
A simple score: On track, Gaps to close or Exposure unknown
Every EU AI Act date, marked in force or coming

FAQ

Frequently asked questions

What is an EU AI Act readiness assessment?

A structured review of the AI your business uses and supplies, which classifies each system under the EU AI Act, checks the obligations that already apply, and produces a plan for the high-risk deadline of 2 December 2027.

Do we need this if we only buy AI rather than build it?

Usually, yes. Businesses that use AI are deployers under the Act and carry their own duties for high-risk systems, including human oversight, monitoring, keeping logs and informing workers. Much high-risk AI sits inside HR and finance platforms bought from vendors.

Does the EU AI Act apply to UK and US companies?

Yes, if they place an AI system on the EU market or the output of their AI system is used in the EU. It follows the market, not the head office, much as GDPR does.

Is this legal advice?

No. The assessment gives the board a clear commercial and governance view of its AI exposure and a plan. Where a specific system needs a legal opinion, we say so, so your lawyers can focus on the decisions that need them.

What happens after the assessment?

EU AI Act Implementation does the work the assessment identifies, building on AI Governance Foundations, through to the December 2027 deadline.

How is this different from the free Board Checklist?

The checklist tells the board what to ask. The assessment answers those questions for your business, system by system, and turns the answers into a plan with owners and dates.

Next step

Request an EU AI Act Readiness Assessment

Tell us where you use AI and where you trade. We will reply personally with how the assessment would work for your business.

Correct as of 25 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 25 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.

AIPEX provides governance and strategy advice, not legal advice. Information on this page reflects the EU AI Act as amended by Regulation (EU) 2026/1744.