EU AI Act readiness checklist for CIOs and CISOs

The EU AI Act readiness checklist below is written for CIOs and CISOs who need a concrete plan rather than legal theory. The EU Artificial Intelligence Act is now in force. It is the first full legal framework for AI systems, with a risk-based model, heavy obligations for high-risk AI, and significant fines for non-compliance. For technology and security leaders, this is now a core architecture, data and risk issue – not a side legal topic.

For CIOs and CISOs, the message is simple: you cannot treat the EU AI Act as a legal side issue. It sits in the middle of your architecture, data, security and operating model. If you wait for the 2027 high-risk deadline, you will be retrofitting governance into live AI systems under pressure, while the 2026 transparency duties land on top of you.

It focuses on the steps that you and your teams can control:

• Building a complete view of your AI systems

• Understanding where the EU AI Act applies

• Classifying risk and obligations

• Identifying gaps in architecture, controls and governance

• Building a realistic roadmap from now to 2028

If you work through this checklist honestly, you will know whether you can handle EU AI Act readiness internally, or whether you need a structured EU AI Act Readiness Assessment to move faster and reduce risk.

Key takeaways (for busy leaders)

The EU AI Act deadlines changed in June 2026, and only half of them moved. The Digital Omnibus, given final approval by the Council on 29 June 2026, postponed the high-risk obligations: stand-alone Annex III systems now comply from 2 December 2027, and high-risk AI embedded in regulated products from 2 August 2028. Everything else stands: the bans on prohibited AI and the AI literacy duty have applied since February 2025, general-purpose AI obligations since August 2025, transparency duties apply from 2 August 2026, and AI generated content must be marked from 2 December 2026.

That means the most dangerous sentence in AI compliance right now is “the EU AI Act got delayed”. If your business runs customer chatbots, generates content with AI, or uses AI that people interact with, your next deadline is 2 August 2026 rather than 2027. And the 2027 date is one procurement cycle away for any system that needs architecture change.

• The Act uses a risk-based model: prohibited, high-risk, transparency-tier and minimal-risk systems carry different obligations.
• Most high-risk obligations fall on providers, but deployers, meaning your business, carry clear duties too, even when you buy AI from vendors.
• The real bottleneck is not policies. It is knowing every AI system you run, classifying each one against the Act as amended, and putting logging, documentation and human oversight into real architecture.
• Fines reach €35 million or 7 per cent of global turnover for prohibited practices, and €15 million or 3 per cent for most other breaches.

The dates as amended in one table

Sources: the amended implementation timeline following the Digital Omnibus, adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026. This article was reviewed after those changes, which is worth checking on any EU AI Act guidance you read: most of what ranks today was written before them.

1. Why you cannot wait for 2027 and what still lands in 2026

When the high-risk postponement was agreed, headlines said the EU AI Act had been delayed. Half true, and the wrong half to relax about.

What did not move: the prohibitions have been enforceable since February 2025, with the largest fines in the Act attached. General-purpose AI duties have applied since August 2025. And on 2 August 2026, Article 50 transparency arrives: people must be told when they are interacting with an AI system, and deepfakes must be disclosed. On 2 December 2026, AI generated content must be identifiable as such. If your business runs chatbots, AI assistants, or publishes AI generated material, those are your deadlines, and they are weeks away rather than years.

Why 2027 is closer than it sounds: the Annex III high-risk obligations now apply from 2 December 2027. For a CIO or CISO, that is one budget cycle and one procurement cycle. High-risk compliance is not a policy exercise: it needs logging you can replay, documentation that matches reality, human oversight that genuinely works, and data governance underneath all of it. Systems that need architectural change to meet those duties need that change starting now, because the alternative is paying emergency prices in eighteen months.

The practical reading: use the postponement as a gift of sequencing rather than a reason to stop. Fix the 2026 transparency duties immediately, and use the bought time to do the high-risk work properly instead of in a panic.

2. EU AI Act readiness check: are you in scope?

Before you follow a detailed EU AI Act readiness checklist, you need to confirm whether you are in scope and in what role.

2.1. Are you operating in or serving the EU?

You are very likely in scope if:

• You are established in the EU and build or use AI systems
• You are outside the EU but your AI outputs are used in the EU (for example, products, services, platforms)
• You deploy third-party AI tools that affect customers, users, patients or citizens in the EU

2.2. What roles do you play in the AI value chain?

The EU AI Act defines several operator roles, including:

• Provider – you develop an AI system or place it on the market under your name or trademark
• Deployer – you use an AI system under your own authority (for example, you use an AI model in a business process or product)
• Importer / Distributor – you bring AI systems into the EU or distribute them

In practice, many enterprises are:

• A deployer of vendor AI systems
• A provider of internal AI systems that support external products or services
• Sometimes both, depending on the specific system

Your EU AI Act readiness plan must be clear about which role you play for each AI system, because obligations differ for providers and deployers.

3. The 10-step EU AI Act readiness checklist for CIOs and CISOs

This is the core of the article. Use it as a working document with your teams.

Step 1 – Build a single AI system inventory

You cannot manage what you cannot see.

Tasks:

• Identify all AI systems and AI-enabled tools across the organisation, including:
  • In-house models and services
  • Vendor SaaS with embedded AI
  • Low-code / no-code AI tools
  • Experimental projects and pilots
• Record, at minimum, for each system:
  • Name and owner
  • Business purpose and use case
  • Data sources and main flows
  • Users and affected groups (internal / external)
  • Whether the system is in production, pilot, or proof-of-concept

Output: a living AI System Inventory, owned jointly by technology and risk. This is the first anchor for every EU AI Act readiness checklist and every EU AI governance discussion.

Step 2 – Map roles and obligations per AI system

For each AI system in your inventory:

• Decide whether you are acting as:
  • Provider
  • Deployer
  • Importer or distributor
• Record which parties are responsible for:
  • Development and maintenance
  • Hosting and operations
  • Security
  • Risk and compliance

This gives you:

• A clear view of where obligations fall for each system
• A starting point for vendor due diligence and contractual updates
• A better picture of where your real exposure sits in the AI value chain

Step 3 – Classify risk level for each AI system

The EU AI Act uses a risk-based model:

• Unacceptable risk – certain uses that are banned
• High risk – AI systems in sensitive use cases listed in Annex III
• Limited risk – AI with specific transparency obligations
• Minimal risk – general AI uses with very light requirements

For each AI system in your inventory:

• Assess whether the use case falls into any high-risk category in Annex III, such as:
  • Biometrics and identification
  • Critical infrastructure
  • Education and exams
  • Employment and worker management
  • Essential services (credit, health, social services)
  • Law enforcement and justice
• Flag systems that may be prohibited (for example, certain manipulative practices or social scoring), so they can be stopped or redesigned.

Output: a risk classification for each system: prohibited, high risk, limited risk, minimal risk.

Step 4 – Understand obligations for your high-risk AI systems

High-risk AI systems are subject to a long list of requirements covering:

• Risk management (map this to NIST AI RMF for a practical control structure)
• Data and data governance
• Technical documentation
• Logging and record-keeping
• Transparency and information for deployers
• Human oversight
• Accuracy, robustness and cybersecurity
• Quality management systems and post-market monitoring

Your checklist here:

• For each high-risk system, map which obligations apply to:
  • The provider
  • The deployer
• Confirm whether the system must be registered in the EU database for high-risk AI systems (Annex III use cases).
• Identify where you are relying on vendor compliance versus your own controls.

Step 5 – Assess your data, logging and documentation gaps

For CIOs and CISOs, most of the real work will fall under data and logging.

Check, for each high-risk AI system:

• Data and data governance
  • Do you know all data sources used for training and operation?
  • Are there controls for data quality, bias, representativeness and relevance?
  • Are data retention and deletion practices clear and enforced?
• Logging and record-keeping
  • Are inputs, outputs and key events logged in a way that supports traceability and investigations?
  • Can you reconstruct how a system behaved in a specific case?
• Technical documentation
  • Does each high-risk AI system have documentation that meets the Act’s requirements, including intended purpose, performance metrics and limitations?

You will quickly see which systems are easy to bring into line and which will need serious work or redesign.

Step 6 – Evaluate human oversight and operational controls

The EU AI Act expects that high-risk systems do not run unchecked. There must be meaningful human oversight that can prevent or correct harmful outcomes.

Checklist questions:

• Who is responsible for monitoring outputs and decisions from each high-risk AI system?
• Can human operators understand how to use the system and when to intervene?
• Are there clear procedures for pausing or disabling an AI system if issues emerge?
• Are frontline teams trained in the risks, limitations and escalation paths?

As a CIO or CISO, you do not need to design the detailed workflows, but you must ensure that oversight is real, auditable and backed by systems and training.

Step 7 – Align AI risk with existing security and incident processes

The EU AI Act does not replace security and incident management. It builds on them.

You should:

• Integrate AI-related incidents into your existing incident management process
• Extend your threat modelling and security reviews to cover:
  • Data poisoning
  • Model theft and misuse
  • Prompt injection and adversarial attacks
  • Abuse of general-purpose AI tools
• Clarify when an AI incident needs to be treated as:
  • A security incident
  • A data protection incident
  • A safety or compliance incident
  • All three

Use MITRE ATLAS to structure AI threat modelling with real-world attacker techniques.

Attach AI risks to existing governance forums and risk registers. You want one coherent picture of operational risk rather than a separate AI risk world.

UK organisations can also align to the UK Government’s AI Cyber Security Code of Practice.

Step 8 – Design or refine your AI governance operating model

Policies and checklists mean very little without a clear operating model.

At a minimum, you need:

• A named AI governance owner at senior level (for example, the CIO in partnership with the CISO and CRO)
• A cross-functional AI governance group with representation from:
  • Architecture and technology
  • Security and privacy
  • Risk and compliance
  • Legal
  • Business and product
• Defined decision flows for:
  • Approving new AI use cases
  • Approving changes to high-risk systems
  • Handling deviations, incidents and non-compliance

This should align with your broader governance and, where relevant, with ISO 42001 (AI management systems) so that AI Act compliance is embedded into normal governance rather than run as a side project.

For a deeper dive into AI operating models and ISO 42001, see our AI Strategy & Operating Model Consulting service.

Step 9 – Build a realistic EU AI Act readiness roadmap and budget

Once you have:

• An AI system inventory
• Risk classification
• A rough view of gaps in data, controls, documentation and governance

You can turn EU AI Act readiness into a roadmap.

Organise work into three waves:

1. Immediate risk reduction (0–6 months)
   • Stop or redesign any prohibited uses
   • Fix obvious high-risk issues on systems closest to customers or citizens
   • Patch critical documentation gaps that would block market access or audits
2. Core compliance and architecture (6–18 months)
   • Strengthen data governance, logging and documentation for high-risk systems
   • Implement standard patterns for human oversight and monitoring
   • Implement architectural patterns for model lifecycle management, access control and audit
3. Continuous improvement and scaling (18+ months)
   • Integrate EU AI Act checks into project intake and change management
   • Refine AI governance forums
   • Extend controls and patterns to new use cases and business units

This roadmap should be costed and linked to your technology and security budgets. If it is not funded, it will not happen.

Step 10 – Decide where you need specialist support

You do not need to outsource everything. You should own your AI strategy, architecture, risk appetite and culture.

However, it is usually efficient to bring in specialists for:

• Designing an AI system inventory and classification method
• Mapping EU AI Act obligations to your specific architecture and platforms
• Designing AI governance operating models aligned with ISO 42001
• Running a structured EU AI Act Readiness Assessment that accelerates discovery and roadmap design

If you have a small internal team, or if you are already stretched by security, cloud and data programmes, this is the point where you decide whether you will move slowly and reactively, or whether you will front-load the work and remove EU AI Act readiness as a strategic risk.

If you want a structured, time-boxed engagement, see our EU AI Act Readiness Assessment

4. Where most EU AI Act programmes fail (and how to avoid this)

From an architecture and security perspective, the common failure patterns are clear:

• Policy without inventory
  There are written EU AI Act policies, but no AI system inventory, no mapping to real systems and no owners.
• Legal-only programmes
  Legal and compliance teams run the programme, but architecture, data and security are not deeply involved.
• Vendor blind spots
  Organisations assume that vendors will take care of compliance, but deployer obligations and integration risks are ignored.
• No operating model
  There is no clear process for approving, monitoring or updating AI systems, especially high-risk ones.
• Last-minute rush
  Work starts in 2026, when high-risk obligations kick in, leaving no time to redesign systems or architecture.

You avoid these traps by:

• Starting with an inventory and architecture view
• Treating EU AI Act readiness as a technology and governance issue rather than only a legal one
• Building a roadmap that is realistic for your teams and budget

We see the same patterns in our enterprise architecture consulting work across pharma, manufacturing and public sector organisations.

5. How Intelance accelerates EU AI Act readiness

Everything above is work we do for clients, at fixed published fees, current to the Act as amended in June 2026:

• EU AI Act Readiness Assessment: every AI system inventoried and classified, your role determined per system, obligations mapped to the dates that stand, and a plan showing where each fix sits in your systems. Four to six weeks, from £18,000 + VAT.
• AI Governance QuickScan: the broader AI governance baseline beyond the Act, from £15,000 + VAT.
• AI Governance Office: the working function that keeps you compliant as AI use grows, intake, tiering, approvals and evidence, from £30,000 + VAT.
• ISO/IEC 42001: the certifiable AI management system, which overlaps usefully with the Act’s expectations.

As a CIO or CISO, this gives you something concrete to take to the board: a defensible view of where you stand against the amended dates, what it costs to close the gaps, and evidence that the 2026 duties are handled before anyone official asks.

EU AI Act readiness: frequently asked questions

Did the EU AI Act get delayed?

Partially. The Digital Omnibus, adopted in June 2026, moved high-risk obligations for stand-alone Annex III systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. It did not move the prohibitions and AI literacy duty, in force since February 2025, the general-purpose AI obligations, in force since August 2025, the Article 50 transparency duties arriving 2 August 2026, or the AI content marking duty arriving 2 December 2026.

What still applies on 2 August 2026?

Article 50 transparency: people must be told when they are interacting with an AI system, and deepfakes must be disclosed. If you run customer chatbots or AI that people interact with, this date is yours regardless of the high-risk postponement. AI generated content marking follows on 2 December 2026.

What is an EU AI Act readiness checklist?

A structured list of actions that maps every AI system you run, confirms whether you are in scope, classifies each system against the Act as amended, and identifies the gaps in architecture, controls and governance. It turns the EU AI Act into a concrete plan your architecture, security, risk and legal teams can execute together, sequenced against the real dates.

Who in the organisation should own EU AI Act readiness?

Not legal alone. Ownership usually sits with a senior technology or risk leader, supported by architecture, security, data, risk, compliance and legal, because the hard work is in systems rather than documents. One executive must be accountable for the roadmap and the outcomes.

How long does EU AI Act readiness take?

A defensible readiness position takes four to six weeks: inventory, classification, role determination and a gap roadmap. Closing the gaps depends on what the roadmap finds: transparency fixes for the 2026 dates are usually quick, while high-risk systems needing architectural change can consume much of the runway to December 2027, which is why the postponement is sequencing time rather than spare time.

Do we need a dedicated EU AI Act programme if we already have GDPR and security in place?

Strong GDPR and security programmes help enormously, and the smart route is to extend them rather than duplicate them. But the Act adds duties they do not cover: system classification, transparency to users, model documentation, human oversight and lifecycle controls. You still need an explicit plan against the Act as amended.

What are the penalties under the EU AI Act?

Up to €35 million or 7 per cent of global annual turnover for prohibited practices, and up to €15 million or 3 per cent for most other breaches, with proportionate caps for smaller companies. The prohibited practice rules have applied since February 2025, so the largest penalty tier is already live.

When should we bring in external support?

Keep strategy, risk appetite and decisions in-house. External support earns its fee on the system-level work: building the inventory honestly, classifying against the amended Act, and placing controls in real architecture. Our EU AI Act Readiness Assessment does exactly that in four to six weeks from £18,000 + VAT, fixed after a scoping call, with every price published.

Emmanuel Olatunji

Chief Enterprise Architecture Partner

Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.

See his record on LinkedIn About Intelance