Topic starter
02/08/2026 11:36 am
TL;DR: May 2026 is the final validation window before August 2, 2026 high-risk AI obligations become enforceable, with providers needing conformity assessments, technical documentation, and registration while deployers must complete impact assessments and retain logs, according to Openlayer. Compliance is now an evidence problem, not a policy exercise, and delaying infrastructure build-out shifts governance risk onto the organisation.
Editorial analysis by NHI Mgmt Group, based on content published by Openlayer: “EU AI Act timeline: Key compliance deadlines for May 2026”.
By the numbers:
- August 2, 2026 is when high-risk AI obligations become enforceable.
- The Digital Omnibus proposal could defer high-risk AI compliance obligations to December 2, 2027.
- Prohibited AI practices carry maximum fines of €35 million or 7% of global annual turnover.
Key questions
Q: What fails when AI Act compliance depends on policies instead of evidence?
A: Policies alone do not satisfy the EU AI Act if an organisation cannot show inventories, logs, assessments, and oversight records.
Q: When should organisations treat AI readiness as a governance issue rather than a deployment issue?
A: They should do so from the start.
Q: What are the signs that AI compliance controls are not ready for enforcement?
A: Common warning signs include spreadsheets as the only inventory, unclear ownership between builders and deployers, missing change history, and logs that cannot reconstruct how a decision was made.
Practitioner guidance
- Build an AI evidence register Create a system inventory that tracks model version, intended use, owner, deployment context, and linked governance artefacts for every high-risk AI system.
- Separate provider and deployer duties Document which obligations apply when your organisation builds an AI system, integrates a third-party model, or deploys it into a regulated workflow.
- Operationalise audit-ready logging Retain output logs, change records, and oversight decisions in a format that can reconstruct why a system produced a specific result.
Bottom line: The EU AI Act deadline is forcing organisations to move from policy intent to provable control over high-risk AI systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:49 pm
Evidence-ready governance is now the real compliance threshold: the EU AI Act has moved AI governance away from policy language and into proof. Organisations that cannot export audit trails, reconstruction logs, and versioned documentation will struggle to demonstrate control even if internal policies look complete. For practitioners, the priority is not drafting another policy but ensuring the operating model generates defensible records by design.
A question worth separating out:
Q: How should teams respond to a possible extension of the EU AI Act timeline?
A: They should not re-plan around a possible extension. The safer approach is to build toward the current enforcement date and treat any delay as an upside, not a dependency. That avoids creating governance debt that becomes visible only when regulators or auditors ask for evidence.
👉 Read our full editorial: EU AI Act compliance deadlines tighten as May 2026 closes