100 Days Out: The EU AI Act Compliance Window for Enterprise Deployers
Update, 31 August 2026. This article was published on 20 April 2026, when 2 August 2026 was still the operative deadline for high-risk AI systems. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved Chapter III, Sections 1 to 3 to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in products under Annex I. References in this article to high-risk obligations taking effect on 2 August 2026 are therefore superseded. The Article 50 transparency obligations and the Chapter IX market surveillance regime were not deferred and have applied since 2 August 2026. The priorities set out below still hold. The dates in the body do not. Current position: EU AI Act Readiness and AI Governance.
August 2, 2026 is 104 days away. On that date, the high-risk provisions of the EU AI Act come into force. The readiness data coming out of Europe suggests most enterprises will reach the deadline late, which makes the useful conversation today about prioritization: what to move on now, what to defer with a clear reason, and what to accept will slip.
A report published by Vision Compliance in April 2026 puts the corporate readiness figure for the EU AI Act at 22%. Across financial services, healthcare, manufacturing, energy, retail, telecoms, and transport, 78% of the enterprises surveyed had yet to take meaningful steps toward compliance. Three gaps recur across sectors. Only 17% of organizations maintain a formal inventory of the AI systems they use or deploy. Only 26% have assigned an internal owner or governance body for AI compliance. Only 39% have a process in place to produce the technical documentation that the Act requires for high-risk systems. The Cloud Security Alliance reached a similar view in its March 2026 research note, describing the gap between regulatory calendar and enterprise execution as material rather than marginal.
Awareness is there. Execution is the problem.
Where things really stand, April 2026
Across Europe, the picture is uneven. According to the implementation tracker on artificialintelligenceact.eu, three of twenty-seven Member States have fully designated both the notifying authority and the market surveillance authority required by Article 70. Ten are partway through the process. Fourteen have yet to start. On the standards side, CEN and CENELEC missed their 2025 target for the harmonized technical standards that enterprises will need to demonstrate conformity. They are now aiming for the end of 2026, which means organizations are building against specifications that will still be moving for much of the compliance window.
In November 2025, the European Commission included a proposal inside its Digital Omnibus package to postpone the high-risk provisions to December 2, 2027, citing the late arrival of harmonized standards. That proposal has not yet been legislated. Until it is, August 2, 2026 remains the operative deadline. Planning around a deferral that has yet to become law is a gamble dressed up as a strategy.
Italy deserves a separate line. Despite a long-standing reputation for moving slowly on EU tech files, it became the first Member State to adopt a comprehensive national AI law: Law No. 132/2025, in force since October 10, 2025. The Agenzia per la Cybersicurezza Nazionale (ACN) acts as the market surveillance authority and as the single point of contact with the EU. The Agenzia per l’Italia Digitale (AgID) acts as the notifying authority. The Italian Data Protection Authority, AGCM, AGCOM, the Bank of Italy, CONSOB, and IVASS hold sector-specific roles. The framework exists on paper. The implementing decrees, which the Government has twelve months from October 2025 to adopt, are still being drafted and are expected to land throughout 2026. Italian organizations, in practice, are operating inside a framework whose edges will still be defined while they try to comply with it.
What “Annex III” actually covers
When practitioners talk about “the August 2026 deadline,” they are usually talking about Annex III high-risk systems. Annex III lists eight areas where an AI system is automatically classified as high-risk because of its impact on fundamental rights or safety: biometrics (including remote biometric identification and emotion recognition), critical infrastructure (water, gas, electricity, road traffic), education and vocational training, employment and worker management, access to essential services (including credit scoring and life and health insurance risk assessment), law enforcement, migration and border control, and the administration of justice and democratic processes.
For most enterprises, the categories that cause the real trouble are the ones that sound administrative rather than the obvious ones. A CV-screening tool sits under employment. A model that prices health insurance sits under access to essential services. A credit decisioning engine is covered whether the lender refers to it as “AI” internally or as “the scoring model we have always had.” A video analytics system watching a corporate parking lot can land inside biometrics the moment it does identification or emotion recognition.
Organizations usually discover this only after they run an inventory. That is one of several reasons inventory work has to come first.
Five moves for the next 104 days
Five pieces of work need to run in parallel between now and August. All five matter, and none of them can wait for the others to finish.
Build an inventory of every AI system in use or in development. Include the models procured from vendors, the ones built internally, and the ones embedded inside third-party platforms that the business thinks of as “the CRM” or “the helpdesk.” Without provenance and purpose metadata, what you have is a spreadsheet, and a spreadsheet will not hold up against an auditor’s first question.
Classify each system against Annex III and against the list of prohibited practices. Classification needs to be documented, traceable, and signed off by a named decision-maker. When a system sits on the border between two categories, treat it as the more demanding of the two until a legal reading says otherwise.
Assign a named accountable owner for AI governance. One person, not a committee, at least while the first version of the framework is being built. The owner needs a direct line to the board and a budget, however modest, to bring in external review when the internal answer is unclear. Committees are where compliance timelines go to die.
Start the technical documentation for anything classified as high-risk. The AI Act requires records of training data, design, testing, risk management measures, and human oversight mechanisms. The underlying requirements are stable even where the standards are still being finalized. Waiting for the final CEN/CENELEC text before starting the documentation is the surest way to miss August.
Run a pre-audit readiness review. Think of it as an internal rehearsal for the questions an external auditor, a procurement team, or a due diligence lawyer will ask after August. The output is a prioritized gap list with owners and dates. Everything else in the 104 days that remain is preparation for that list.
What can wait, and how to say so honestly
Some things can wait, and being clear about what can wait is part of a mature governance posture rather than a shortcut.
Formal certification against harmonized CEN/CENELEC standards only becomes possible once those standards are published. Pretending otherwise wastes resources. Advanced training programs for the entire workforce tend to work better after the governance baseline has been established and the vocabulary is stable. CE marking for systems whose classification is still being debated internally can be staged once classification is stable.
The Digital Omnibus proposal is a judgment call in itself. Organizations with substantial high-risk exposure should keep planning toward August 2, 2026 and treat any deferral as upside. Organizations with lower exposure and tighter budgets can reasonably put more weight on the governance layer first and less on certification activities that may end up recalibrated if the deferral is legislated. Whichever path you take, document the reasoning. An auditor, a procurement team, or a board member who asks why the company deprioritized a task will accept a considered explanation and will not accept silence.
The real pressure point lands on August 3
Most of the public conversation about the day after the deadline focuses on regulatory risk: fines, enforcement actions, recalls. That risk is real, and it is worth tracking. For most enterprises, though, it is rarely the first risk they feel.
The first pressure is commercial. Starting in August, AI governance turns into a procurement question. Enterprise customers in regulated industries will ask to see documentation before signing. Investors will ask during due diligence rounds that would have skipped the topic six months earlier. Insurance carriers will ask at renewal. Companies that are ready will say so in their sales conversations, in their RFP responses, and in their investor updates. The rest will spend a lot of time explaining themselves.
The organizations that come out of this window well are the ones that can answer four questions, in plain language and in writing: what AI do you use, how is it governed, who is accountable for it, and what happens when something goes wrong. Sophistication of the underlying technology matters less than being able to answer those four.
104 days is a short runway. For organizations that start this week, it is a workable one.
OneSynergy is a consulting network focused on AI strategy, governance, and digital transformation. If your organization is working through the last stretch of the EU AI Act compliance window, we help teams move from inventory to execution.
Data in this article reflects publicly available sources as of April 20, 2026. Member State readiness figures update frequently and are accurate as of this date.
Further reading
- EU AI Act Implementation Timeline, artificialintelligenceact.eu
- European Commission, Shaping Europe’s digital future, AI Act page
- Cloud Security Alliance, EU AI Act High-Risk Compliance Deadline: Enterprise Readiness Gap (March 2026)
- IAPP, EU AI Act Regulatory Directory
- UNESCO, Who Governs AI in the EU?
- Annex III full text, artificialintelligenceact.eu
- Article 70 on competent authorities, artificialintelligenceact.eu
- European Commission, Digital Omnibus package (November 19, 2025)
- Italian Dipartimento per la trasformazione digitale, Autorità AI Act page
OneSynergy works with organisations in Turin, Italy and across Europe on EU AI Act readiness and AI governance: obligation mapping, risk classification as scoping, transparency, governance and technical documentation, alongside your legal counsel. See how we work on the AI Act.
For the state of the rules today rather than on the day this was written, see EU AI Act: deadlines and current status, a dated reference page we keep current.
Article 4 of the same regulation requires AI literacy among the staff who operate these systems, not only governance among those who deploy them. See how we approach AI literacy training and capacity building.
