EU AI Act: high-risk enforcement now 02 December 2027

EU AI Act: Ultimate Compliance Guide and Checklist

Brussels moved the high-risk deadline, not the obligations. As a deployer you still have three jobs: know what AI is running, fulfill your own duties, and get the right documentation from your vendors. The smart move is to do that work now, while you have runway.

Days to the new enforcement date for standalone high-risk AI systems

Prohibited-practice bans and AI literacy duties already apply

€7.5M-€35M

Maximum fine range under Art. 99

EU AI Act Summary

The EU AI Act applies a risk-based framework to agentic AI use. Enterprises using autonomous AI agents must ensure transparency, human oversight, logging, risk management, and compliance controls — especially for high-risk use cases like HR, finance, healthcare, or critical infrastructure.

For Security Leaders

Three Areas to Have Covered Before the High-Risk Deadline

The EU AI Act splits obligations across providers and deployers. If you are deploying AI, not building it, here is what you own, what you demand from vendors, and what you need to file.

Task 01

What You Own

Art. 14 + Art. 26

Monitor your AI systems. Assign human oversight. Retain logs for at least six months. Intervene when something goes wrong. Article 26 makes you accountable for the AI you deploy regardless of who built it.

This means knowing which agent accessed which system, under what permissions, and when — and being able to produce that log to a regulator on request.

Cequence covers this. Agent Personas, tool-call activity logs, attributable credentials, and anomaly detection — all exportable to your SIEM.

Task 02

What You Demand From Vendors

Art. 9 + Art. 10 + Art. 12 + Art. 13

The companies that built the AI you deploy hold Article 9 (risk management), Article 12 (logging capability), and Article 13 (transparency documentation) obligations. You need their compliance documentation ahead of the high-risk deadline, so start collecting it now.

Ask each vendor in writing now. See the vendor questions section for exact language.

For Cequence AI Gateway’s own ML: We hold Art. 9 and Art. 10 obligations for the intelligence layer and can provide Annex IV documentation under NDA. For foundation models routed through the Gateway, the GPAI provider holds those obligations.

Task 03

What You Need to File

Art. 49

If you are deploying high-risk AI systems as defined under Annex III, you may need to register in the EU database before deployment. Your legal counsel makes the high-risk determination.

What they will need from you: a complete inventory of every AI system in your environment — who owns it, what it accesses, and when it was deployed.

Cequence gives you the inventory. Every agent, MCP server, and agentic workflow is discovered and documented so your counsel has what they need to make the filing determination.

Plain Language

What Each Article Actually Means

The six articles that matter most for deployers, in plain English. Each one has a different owner — provider, deployer, or both.

Art. 9

Risk Management System

The AI system must have an ongoing risk management process across its full lifecycle, including after deployment. Provider’s job to build and document; your job to verify they have it.

Owner: Provider

Art. 10

Data Governance

Training data must meet quality, relevance, and representativeness standards. Providers hold this for the models they supply. If you fine-tune a model yourself, you hold it. Requires data classification, sensitive data handling, and regional controls.

Owner: Provider (or Deployer if fine-tuning)

Art. 12

Record-Keeping

High-risk AI systems must technically allow automatic logging of events over the system’s lifetime. If your AI vendor cannot produce these logs, it is non-compliant — but the problem lands on your deployment.

Owner: Provider

Art. 13

Transparency

Your AI vendor must give you documentation on what the system can and cannot do, its accuracy and limitations, known risks, and how to interpret its outputs. Should come with the product.

Owner: Provider

Art. 14

Human Oversight

High-risk AI systems must be designed so humans can effectively supervise them — detect anomalies, override outputs, and shut them down. You must assign people with authority and training to actually do this.

Owner: Deployer

Art. 26

Deployer Obligations

This is your article. Use the system per the vendor’s instructions. Monitor it. Retain logs. Assign qualified human oversight. Report serious incidents. If you deploy it, you own how it runs.

Owner: Deployer

Art. 27

Fundamental Rights Impact Assessment

Certain deployers — public bodies, and organizations deploying high-risk AI in areas like employment, credit, or biometrics — must conduct a fundamental rights impact assessment before going live. Documents potential harms to individuals.

Owner: Deployer (where applicable)

Art. 49

Registration

Before deploying a high-risk AI system, it must be registered in the EU database. Providers register their systems. Public authorities register their use cases. Counsel determines whether your deployment qualifies under Annex III.

Owner: Provider + Deployer

Key Dates

EU AI Act Timeline

The EU AI Act rolled out in phases. Not everything is enforced on 02 August.

02 Feb 2025

Prohibited practices banned

Article 5 prohibited AI practices are now illegal in the EU. Fines up to €35M or 7% of global turnover. In effect now.

02 Aug 2025

GPAI model obligations active

General-Purpose AI model obligations apply. GPAI providers must produce technical documentation, comply with copyright rules, and publish training data summaries. In effect now.

16 June 2026

Parliament approves the delay

The European Parliament granted final approval to amendments delaying high-risk obligations. Council adoption and Official Journal publication are expected by 02 August 2026; until then the current Act remains law. Treat this as added time to complete compliance work, not a relaxation of the obligations.

02 DEC 2026

Watermarking and a new prohibition

Watermarking obligations take effect for AI systems placed on the market before 02 August 2026. Nudifier applications become a prohibited AI system. General transparency duties under Article 50 continue to apply.

02 Dec 2027 — Standalone high-risk systems

Obligations for standalone high-risk AI systems in the Annex III categories (employment, education, credit scoring, critical infrastructure, law enforcement, and similar) take effect. Articles 9, 10, 12, 13, 14, 26, 27, and 49 apply here. This 16-month delay from the original 02 Aug 2026 deadline covers most agentic AI in regulated functions.

02 Aug 2028

AI in regulated products

High-risk AI rules extend to AI embedded in regulated products — medical devices, machinery, toys, vehicles. If you deploy AI in physical products, this date applies to you.

Responsibility Split

Compliance Checklist by Owner

For each article: who holds the obligation and what evidence your risk officer needs to have on file.

Article	What It Requires	Owner	Evidence You Need
Art. 9	Continuous risk management across the full AI lifecycle	Provider	Vendor's risk management documentation — request in writing
Art. 10	Data quality, governance, and regional handling controls for training data	Provider / Deployer if fine-tuning	Vendor's data governance documentation; your own data handling records if you fine-tune
Art. 12	System must technically allow automatic logging over its lifetime	Provider	Vendor confirmation that logging is technically enabled
Art. 13	Provider must supply transparency documentation on capabilities and limits	Provider	Vendor's transparency disclosure — should come with the product
Art. 14	Human oversight mechanisms must be in place	Deployer	Your internal records: assigned oversight roles and training completed
Art. 26	Monitor the system, retain logs 6 months, report incidents	Deployer	Activity logs, incident reports, oversight assignment records
Art. 27	Fundamental rights impact assessment before deploying certain high-risk AI systems	Deployer (where applicable)	Completed FRIA documentation — required for public bodies and certain high-risk use cases
Art. 49	Register in EU database before deployment	Provider + Deployer	EU database registration confirmation and your system inventory

Vendor Due Diligence

Four Questions to Send Your AI Vendors

Send these in writing to every AI vendor whose systems you deploy. Their responses — or lack of them — become part of your compliance record.

Article 12 — Logging capability

“Does your system technically allow automatic recording of events over its lifetime as required by Article 12 of the EU AI Act? Can you provide documentation confirming this?”

Article 9 — Risk management

“Can you provide your Article 9 risk management system documentation? We need to confirm you have a continuous risk management process in place across the full lifecycle of your system.”

Article 13 — Transparency documentation

“Where is your Article 13 transparency disclosure? We need documentation covering the system’s capabilities, limitations, accuracy metrics, known risks, and instructions for use.”

Article 49 — Registration status

“Has this system been registered in the EU AI database per Article 49? If so, can you provide the registration reference? If not, what is your timeline?”

If You Are Behind

What Regulators Actually Look For First

Use the extended timeline to close gaps. If you are not there yet, here is what matters most to regulators, and what demonstrates good faith.

🔎

Visibility first

You cannot govern what you cannot see. Having an active discovery process running — even if incomplete — demonstrates intent. Regulators look for evidence you are trying, not evidence you are done.

📋

A documented risk assessment

Have you identified which of your AI systems are potentially high-risk under Annex III? A written assessment — even a preliminary one — shows you have engaged with the framework.

✉

Vendor correspondence on record

If you have sent your vendors the Article 9, 12, and 13 questions and are waiting for answers, document that. The burden of those obligations sits with the provider. Your job is to have asked.

🕐

A remediation timeline

Regulators respond better to “here is our plan and our timeline” than to silence. A written gap assessment with owner assignments and target dates is worth more than a completed program you cannot evidence.

⚖

Legal counsel engaged

The AI Act compliance determination is a legal question. Having documented that your counsel is engaged and advising you is itself a form of due diligence.

“It ticks the boxes.

CISO, global investment management firm — 1,300 employees, regulated in EU, UK, and South Africa. May 2026.

Start With Visibility

Know What's Running in Your Environment

You cannot fulfill Article 26, register under Article 49, or demand the right vendor documentation until you know what AI is deployed. If you have Palo Alto, Fortinet, or any NGFW with logs in Splunk, Sentinel, or Elastic — we can show you how to leverage this data. No deployment. No procurement.

Cequence AI Gateway supports compliance evidence for the obligations described above. Compliance determinations are made by your legal counsel and risk officers, not by Cequence. Article citations per EU AI Act (Regulation (EU) 2024/1689). Fine tiers per Article 99. On 16 June 2026 the European Parliament approved amendments delaying high-risk obligations to 02 December 2027; these await formal Council adoption and Official Journal publication, and the current Act remains in force until then. Dates current as of 26 June 2026.