Topic starter
25/06/2026 1:26 am
TL;DR: The EU AI Act’s high-risk system obligations become operational on August 2, 2026, and the hardest requirements are continuous risk management, tamper-evident logging, human oversight, and AI-specific cybersecurity, according to WitnessAI. Compliance will fail where organisations treat the law as documentation work instead of evidence-producing governance across the AI lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “EU AI Act checklist: 2026 update”.
By the numbers:
- Tier 2 violations can reach €15 million or 3% of total worldwide annual turnover, whichever is higher.
- For a company with €10 billion in global revenue, that translates to €300 million.
- The main obligations for high-risk AI systems begin to apply on August 2, 2026.
Key questions
A: Paper-only governance breaks at the point of evidence.
Q: Why do high-risk AI systems need formal impact assessment and stronger accountability controls?
A: High-risk AI can affect health, safety, fundamental rights, and democratic processes, so weak governance can create disproportionate harm.
Q: How can organisations tell whether their AI security model is actually working?
A: They should test whether the control stack can explain who acted, what data was touched, and what purpose the action served.
Practitioner guidance
- Classify AI use cases against Annex III before control design Map each AI system to its intended use, user group, and EU-facing impact so you can determine whether high-risk obligations apply before you build the operating model.
- Define evidence ownership across security, legal, and AI teams Assign who is responsible for logging, document maintenance, oversight competence, and incident escalation so no control depends on informal coordination.
- Test whether logs can reconstruct AI decisions end to end Verify that inputs, outputs, and material decision points are retained in a way that supports traceability, incident review, and regulatory challenge.
Bottom line: The EU AI Act turns high-risk AI governance into an ongoing evidence problem, not a one-time policy or legal review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:51 am
EU AI Act readiness is becoming an evidence management problem, not a policy drafting problem. The article shows that the hard obligations are operational because they depend on traceable behaviour across the AI lifecycle. That changes the governance baseline for security, legal, and AI teams: if controls cannot produce durable proof, they are not meeting the Act’s intent. Practitioners should treat evidence production as a core control objective, not a reporting afterthought.
A question worth separating out:
Q: What should organisations do when AI systems may fall under Annex III high-risk rules?
A: Classify the use case first, then build controls around the legal duty set rather than around the tool category. The organisation should confirm intended use, EU scope, deployer responsibilities, and evidence requirements before deployment. That sequencing prevents late-stage redesign when a system is already in production and subject to higher obligations.
👉 Read our full editorial: EU AI Act high-risk system controls are now the 2026 test