Compliance guide
The EU AI Act
for enterprise AI.
A path you can actually follow: what you must do as a deployer, which deadlines apply, what an evidence trail looks like, and where a well-designed architecture takes evidence work off your desk. As of October 2026 · not legal advice.
Deadlines at a glance
| What applies from that date | |
|---|---|
| February 2, 2025 | The Article 4 AI literacy obligation and the Article 5 ban on prohibited practices apply. |
| August 2, 2025 | Obligations for general-purpose AI models apply. |
| August 2, 2026 | Transparency obligations under Article 50 apply. Providers of generative systems already on the market before that date have until December 2, 2026, to mark synthetic content. |
| December 2, 2027 | Obligations for high-risk AI systems under Annex III apply. Systems under Annex I, which are tied into product safety law, follow on August 2, 2028. |
Six steps to compliance
The path we followed in our own readiness assessments. Realistic time frame: about four weeks.
Inventory your AI
List every AI system in use, including the ones hidden as a module inside an existing application: Copilot, ChatGPT Team, smart filters in the mailbox.
Classify by risk
Classify each system: prohibited practice (Article 5), high-risk (Article 6 with Annexes I and III), transparency obligations (Article 50), or minimal risk. The classification drives everything that follows.
Build AI literacy under Article 4
Take measures that build the AI literacy of everyone who works with AI, and document them. Since the 2026 amendment, Article 4 requires such measures but no specific level of literacy.
Set up the evidence trail
For every request, record who, what, which model, which data source, and which outcome. In the SIMOSphere AI Lab, we tested a tamper-evident log for exactly this.
Meet transparency obligations
Tell people when they interact with an AI system directly, and label synthetic media.
Document conformity
Per high-risk system: declaration of conformity, risk management, technical documentation, and post-market monitoring.
What a good architecture takes off your desk
Evidence trail per request
Who, what, which model, which data source, and which outcome. Traceable and stored in line with the GDPR.
Risk-class tagging
Tag each workflow with its risk class and flag requests that touch a high-risk area under Annex III.
Model cards
Every model in use documented with provider, knowledge cutoff, and sub-processors.
Data residency commitment
EU only or on your own premises, with a sub-processor list anyone can inspect.
AI literacy under Article 4
Training that builds real competence and documents it. Offered by the SIMO GmbH academy.
EU AI Act readiness assessment
Inventory, risk classification, documented AI literacy measures, and a prioritized action plan, delivered by SIMO GmbH’s consultants.
Common questions
- Is my company a deployer under the EU AI Act?
- Yes, as soon as your company uses an AI system under its own authority in a professional context, including systems you bought, such as ChatGPT or Copilot. Purely personal, non-professional use is out of scope. Deployer status brings the Article 4 AI literacy obligation, risk classification, and, in some cases, transparency and documentation obligations.
- Which deadlines matter now?
- The ban on prohibited practices and the Article 4 AI literacy obligation have applied since February 2, 2025, and the obligations for general-purpose AI models since August 2, 2025. Transparency obligations under Article 50 have applied since August 2, 2026. Regulation (EU) 2026/1744, in force since July 27, 2026, moved the high-risk dates: obligations for systems under Annex III apply from December 2, 2027, and for systems under Annex I from August 2, 2028.
- What counts as a high-risk system under the EU AI Act?
- Annex III names eight areas, among them biometrics, critical infrastructure, education, employment including hiring decisions and performance review, essential public and private services such as creditworthiness and insurance pricing, law enforcement, and migration. AI used in recruiting often falls into this category.
- How does an EU AI Act readiness assessment at SIMO work?
- The assessment takes one day. We agree on its scope beforehand in a free initial call (45 minutes). You receive a risk classification per system, documentation of your AI literacy measures, documentation templates, and a prioritized action plan.
A note on legal status
This guide is not legal advice. It summarizes what we learned in assessment projects between the fourth quarter of 2024 and the second quarter of 2026, and reflects the Regulation as amended by Regulation (EU) 2026/1744, as of October 2026.
Only the competent national supervisory authority and the European Commission’s AI Office can interpret the regulation with binding effect.
Consulting by SIMO GmbH
From the Lab to consulting.
SIMO does not judge options on vendor claims alone. Assumptions that can be tested technically are examined in the SIMOSphere AI Lab. SIMO GmbH works with your executive team to assess whether an approach that proves viable in the Lab makes sense for your company, and supports the implementation: independent of vendors, with a fixed scope and a decision after every phase.
Decision Readiness Check: 12 questions, about 3 minutes, instant result. Initial call: 45 minutes, free of charge, by video. Engagements begin with the BISA baseline assessment or the BEIA enterprise assessment. All on simo-online.com.