EU AI Act Implementation

EU AI Act Implementation: Take Your AI Governance to the December 2027 Deadline

A register and a policy are the start, not the finish. By 2 December 2027 you need to know which of your AI is high-risk, what data it touches, what your suppliers are doing, and have the evidence to show it is controlled.

Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.

Book an EU AI Act scoping call Get the Board Checklist

The AI governance path: step 4 of 5

Start here if: You have the basics, but your AI isn't classified under the Act and you can't evidence control of your high-risk uses.

See the whole path →

Who has to comply

Who does the EU AI Act apply to?

It follows the market, not the head office. What matters is whether your AI, or what it produces, reaches the EU, and what role you play in supplying or using it.

Your situation	Does it apply?
An EU company using AI in its business	Yes. You are the deployer of that AI.
A UK or US company selling an AI product, or a product or service with AI built in, to EU customers	Yes. You are the provider. For high-risk AI you must also appoint an authorised representative in the EU.
A UK or US company whose AI output is used in the EU, for example screening EU job applicants or scoring EU customers from London or New York	Yes, for that system, even if nothing is hosted in the EU.
A UK or US group with an EU subsidiary or office	Yes, for the AI used by or for the EU business.
A company that buys an AI tool, such as an HR or finance platform, and uses it on EU staff or customers	Yes. The vendor is the provider. You are the deployer, with duties of your own.
A company that puts its own name on a high-risk AI system built by someone else, substantially modifies one, or changes a system's purpose so it becomes high-risk	Yes, as the provider, with the heavier obligations that follow.
A company bringing a non-EU AI system into the EU, or reselling one there	Yes, as importer or distributor. You must check the provider has met its obligations.
A UK or US company with no EU customers, staff or operations, whose AI output is not used in the EU	Generally no. Check again before you enter the EU market. Your own country's data protection, employment and consumer laws still apply to your AI.

The full guide: the four roles, what applies now and in 2027, which sectors are caught, and who is out of scope.

What it is

Built on Foundations, finished by the deadline

EU AI Act Implementation takes the register, owners, policy and training from AI Governance Foundations and completes the work the EU AI Act expects: classification, data and supplier review, an evidence file and remediation of risky use.

If you have not done Foundations, the programme starts with it. If you have had an EU AI Act Readiness Assessment, it starts from those findings.

Why the board should care

Why December 2027 needs a plan now

Some duties already apply

Banned practices and AI literacy obligations are already in force. The high-risk deadline is 2 December 2027.

High-risk AI hides in suppliers

Hiring, performance, credit and insurance tools inside HR, CRM and finance platforms are the usual blind spot.

Evidence wins contracts

EU customers and procurement teams will ask what you use, how it is classified and how it is controlled.

Who this is for

UK and US organisations that sell into the EU, employ people there or have an EU subsidiary
Organisations that have completed AI Governance Foundations and need the next step
Businesses using AI in HR, finance, credit, insurance or customer service
Boards that want a dated plan to the deadline rather than a list of concerns

What it solves

A register that exists but has never been classified under the Act
No view of what personal, client or confidential data touches AI
Supplier AI that nobody has questioned or contracted for
Good intentions with no evidence behind them
Risky uses of AI that are known about but not yet fixed

The ten steps

From register to ready, in ten steps

Steps 1, 3, 6, 7 and 10 are laid in AI Governance Foundations. This programme extends them and completes the rest.

1. Build an AI register

AI tools, supplier AI, internal use cases and AI features inside existing systems.

2. Classify risk

Each use placed as minimal, transparency, possible high-risk, or prohibited, with the reasoning written down.

3. Assign ownership

Board sponsor, operational owner, technical owner and data or privacy owner for each use.

4. Review data use

What personal, client, confidential or sensitive data touches AI, and whether that use is controlled.

5. Check suppliers

Microsoft, CRM, HR, finance and SaaS platforms, chatbots, agents and analytics tools.

6. Put policy in place

Acceptable use, data handling, approval routes and prohibited uses.

7. Train staff

Different training for executives, managers and general staff.

8. Create evidence

Attendance logs, risk assessments, approvals, review dates and supplier notes, kept in one place.

9. Remediate risky use

Disable, restrict, contractually control or redesign uses that are not safe.

10. Review annually

Keep the register and risk assessment alive, not a one-off document.

Where it sits

The fourth step on the AI governance path

Foundations puts the controls in place. EU AI Act Implementation takes them to the deadline. ISO 42001 certifies the whole system.

Before

AI Governance Foundations: register, basic risk assessment, AI use policy, training and annual review.

AI Governance Foundations →

This programme

Classification, data and supplier review, evidence and remediation, with dates to 2 December 2027.

After

ISO/IEC 42001 formalises it into an AI management system an independent body can certify.

ISO 42001 readiness →

What you get

What you have by December 2027

Every use of AI classified under the EU AI Act, with your role and the reasoning recorded
A data use review for AI that touches personal, client or confidential data
Supplier AI reviewed, with the questions asked, the answers recorded and contract actions agreed
An evidence file: risk assessments, approvals, training records, review dates and supplier notes
A remediation plan for risky uses, with owners and dates, and progress reported to the board

How it works

Baseline

Start from Foundations or your readiness assessment, and confirm the register is complete.
Classify and review

Classify each use, review data and suppliers, and agree what needs to change.
Evidence and remediate

Build the evidence file and fix, restrict or redesign risky uses.
Report to the deadline

Quarterly board reporting against a dated plan to 2 December 2027, then the annual review.

Free board download

EU AI Act Board Checklist

An EU AI Act PDF for your board: a 15-minute self-check with five actions to take before December 2027, a score for each, and what your result means. Take it to your next board meeting.

Five board actions with 19 evidence-based checks
A simple score: On track, Gaps to close or Exposure unknown
Every EU AI Act date, marked in force or coming

FAQ

Frequently asked questions

How is this different from the EU AI Act Readiness Assessment?

The readiness assessment tells you where you stand and what to do. EU AI Act Implementation does the work: classification, data and supplier review, evidence and remediation, through to the deadline.

Do we need AI Governance Foundations first?

Yes. The programme builds on the register, owners, policy and training that AI Governance Foundations puts in place. If they are missing, we start there.

Is this instead of ISO 42001?

No. It sits before ISO/IEC 42001. The EU AI Act is law; ISO 42001 is a voluntary standard. Everything built here carries into an AI management system. See ISO 42001 readiness.

Is this legal advice?

No. It is governance and delivery support. Where a specific system needs a legal opinion, we say so, so your lawyers can focus on the decisions that need them.

What does it cost?

A fixed fee, confirmed on the scoping call once we know how many uses of AI and suppliers are in scope.

Next step

Talk to us about EU AI Act Implementation

Tell us where you use AI, where you trade and what governance you already have. We will reply personally with a plan to the deadline, usually within one working day.

Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.

AIPEX provides governance and strategy advice, not legal advice. Information on this page reflects the EU AI Act as amended by Regulation (EU) 2026/1744. AIPEX is not a certification body.