Notifications
Clear all
Topic starter
25/06/2026 1:26 am
TL;DR: The EU AI Act’s high-risk system obligations become operational on August 2, 2026, and the hardest requirements are continuous risk management, tamper-evident logging, human oversight, and AI-specific cybersecurity, according to WitnessAI. Compliance will fail where organisations treat the law as documentation work instead of evidence-producing governance across the AI lifecycle.
NHIMG editorial — based on content published by WitnessAI: EU AI Act compliance checklist 2026 update
By the numbers:
- Tier 2 violations can reach €15 million or 3% of total worldwide annual turnover, whichever is higher.
- For a company with €10 billion in global revenue, that translates to €300 million.
- Nearly 70% of businesses report difficulty understanding their specific obligations under the Act.
Questions worth separating out
Q: How should organisations classify AI systems for EU AI Act compliance?
A: Start with intended use, not technical complexity.
Q: Why do AI governance controls fail when they are only documentary?
A: Because the EU AI Act expects operational evidence, not just policies.
Q: How do security teams know whether AI logging is good enough?
A: Logs should be tamper-evident, detailed enough to reconstruct inputs, outputs, and intervention points, and retained long enough to support review.
Practitioner guidance
- Define the high-risk AI inventory Create a single inventory of AI systems that may reach EU users, then classify each use case against Annex III and provider or deployer duties.
- Map runtime evidence to Articles 9 through 15 For each in-scope system, map the evidence you can actually produce for risk management, logging, documentation, human oversight, and cybersecurity.
- Assign named oversight and escalation owners Name the people who can monitor, override, interrupt, and report AI system behaviour, then test those roles in exercises.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- A clause-by-clause breakdown of Articles 9 through 15 and how each one maps to operational controls.
- Specific examples of where classification mistakes and deployer misunderstandings show up in enterprise AI programmes.
- The implementation discussion behind logging, oversight, and compliance evidence that this post only frames at a strategic level.
- WitnessAI's own compliance checklist and platform-centric mapping for teams already building toward the August 2026 deadline.
👉 Read WitnessAI's EU AI Act compliance checklist for high-risk AI systems →
EU AI Act high-risk controls - are your AI governance tools ready?
Explore further
25/06/2026 10:51 am
EU AI Act compliance now behaves like identity governance for AI systems, not like a one-time legal checklist. The Act’s operational core is evidence of control over runtime behaviour, data handling, oversight, and accountability. That aligns more closely with governance disciplines in IAM and NHI management than with static policy review. Practitioners should expect the winners to be the organisations that can prove control continuity, not just policy completeness.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows that identity weakness compounds instead of staying isolated.
A question worth separating out:
Q: Who is accountable when a regulated AI system causes harm?
A: Accountability depends on whether the organisation is the provider, deployer, or both. Providers carry the heavier design and documentation burden, while deployers must use the system properly, monitor it, retain evidence, and escalate serious incidents. Clear ownership matters because shared accountability often becomes no accountability.
👉 Read our full editorial: EU AI Act high-risk system controls are now the 2026 test
