An EU AI Act Compliance Roadmap: A Phased Plan to Every Deadline

A compliance roadmap is a practice, not a statutory artefact. Regulation (EU) 2024/1689 sets dates; it does not tell you how to sequence your work toward them. A roadmap is that sequencing — a phased plan that turns a wall of deadlines into milestones with owners and evidence. The reason it matters is that the Act's obligations do not all arrive at once: some have been in force since early 2025, one major tranche landed on 2 August 2026, the big high-risk tranche has moved to late 2027, and a final product-embedded tranche follows in 2028. A roadmap built around a single "the deadline" is wrong on the facts and useless in practice.

This guide lays out the phases against the real dates, the milestones in each, who owns them, and the evidence that proves each phase is done.

---

The dates the roadmap is built on

Get these right and the whole plan sequences itself. Get one wrong and the plan misallocates a year of work.

Two precision points the roadmap depends on. First, the high-risk deferral is law: the Digital Omnibus on AI — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026 — moved the stand-alone high-risk date from 2 August 2026 to 2 December 2027. Plan against 2 December 2027. Second, not everything moved — Article 4, Article 5, the GPAI obligations and Article 50 did not shift; Article 50 has applied since 2 August 2026. A roadmap that "waits for 2027" misses three live tranches.

---

Phase 0 (now): the foundation — and the live duties

The work that is already overdue or imminent, and that everything else depends on:

• Build the use-case register. The single inventory of every AI system you build or deploy. You cannot plan, classify or prove anything without it. Owner: AI governance lead. Evidence: a populated register.
• Run Article 5 prohibited-use screening. In force since 2 February 2025. Screen every system and every new use case against the eight original prohibitions — plus the two added by the Omnibus, Article 5(1)(ba) (non-consensual intimate deepfakes) and 5(1)(bb) (child sexual abuse material), which apply from 2 December 2026; a prohibited system must not be operated. Owner: governance lead / legal. Evidence: screen results logged in the register.
• Stand up Article 4 AI literacy. Also in force since 2 February 2025, for all AI; since 27 July 2026 the duty is to take measures to support AI literacy, not to guarantee a set level per person. A baseline training programme for staff who use or are affected by AI. Owner: governance lead with HR. Evidence: training records.
• Confirm GPAI exposure. GPAI obligations (Chapter V) have applied since 2 August 2025 — but they bind model providers, not the typical deployer using a model through an API. Confirm whether you are a GPAI provider (you usually are not). Owner: governance lead / legal. Evidence: a documented determination.

Phase 0 is not future work. If your roadmap puts the prohibited-use screen and literacy in 2027, it is already non-compliant.

Phase 1 (due 2 August 2026 — now live): transparency and classification

• Classify the whole estate under Article 6 / Annex III. For each registered system, determine minimal / limited / high-risk by use, recording the Article 6(3) reasoning where you exempt an Annex III system — and registering that system in the EU database all the same. Owner: product owners, reviewed centrally. Evidence: classification record per system.
• Implement Article 50 transparency. Since 2 August 2026, chatbots and AI-interaction interfaces must tell users they are dealing with AI, and synthetic content must be marked (generative systems already on the market before that date have until 2 December 2026 for the marking). Identify every limited-risk system and confirm the disclosure is live. Owner: product owners. Evidence: disclosure live, screenshots/log.
• Derive roles. For each system, Article 16 provider vs Article 26 deployer, testing the Article 25 flip where you re-brand or modify a third-party system. Owner: governance lead. Evidence: role recorded.

Phase 2 (to 2 December 2027): the high-risk build

The heavy tranche — for the systems Phase 1 flagged high-risk. For each, the provider/deployer obligation stack:

• Article 9 risk-management system — continuous, iterative, lifecycle. Owner: product owner; method by the governance lead.
• Article 10 data governance for training/validation/test data. Owner: data/ML lead.
• Article 11 / Annex IV technical documentation. Owner: product owner.
• Article 14 human oversight arrangements. Owner: product owner.
• Article 15 accuracy, robustness, cybersecurity. Owner: security + product owner.
• Article 43 conformity assessment (internal-control / Annex VI for most Annex III; notified body / Annex VII for biometrics). Owner: governance lead.
• Article 47 / Annex V declaration of conformity, then Article 49 EU-database registration. Owner: governance lead.
• Article 27 FRIA where it applies (public bodies; creditworthiness and life/health-insurance deployers). Owner: DPO/legal with product owner.
• Article 72 post-market monitoring + Article 73 serious-incident reporting, ready for go-live. Owner: product owner.

Plan this against 2 December 2027, the date set by the Digital Omnibus — but start well ahead of it: the Annex IV pack and Article 9 evidence take 12–18 months to assemble properly, so starting late is the real risk.

Phase 3 (to 2 August 2028): product-embedded high-risk

For high-risk AI embedded as a safety component in Annex I products (medical devices under MDR/IVDR, vehicles, machinery, etc.), the obligations integrate through the product's sectoral route — for machinery, now an Annex I Section B product under the Machinery Regulation (EU) 2023/1230, via that Regulation's delegated acts — and apply from 2 August 2028. If you build or place such products, this is a distinct, later workstream owned with your product-safety/regulatory function — do not fold it into the Phase 2 stand-alone track; the routes and dates differ.

---

A one-page view

---

Worked example: a SaaS company's roadmap

Brightfjord Analytics AB — ~110 employees, ~€18M turnover, a Swedish SaaS company shipping an HR-analytics product with an embedded candidate-ranking feature and a customer-support chatbot — builds its roadmap.

• Phase 0 (done this quarter): register lists three AI systems; the candidate-ranking feature passes the Article 5 screen (it is not a prohibited use); Article 4 literacy training rolled out; a GPAI check confirms Brightfjord is a deployer of a third-party model, not a GPAI provider.
• Phase 1 (done by Aug 2026): classification finds the candidate-ranking feature high-risk (Annex III point 4, employment) — and because Brightfjord builds and ships it, the firm is a provider under Article 16. The chatbot is Article 50 limited; disclosure is built. The internal analytics dashboard is minimal.
• Phase 2 (planned against 2 Dec 2027): the full provider stack for the ranking feature — Article 9 RMS, Article 10 data governance, Article 11/Annex IV pack, Article 14 oversight, Article 15 robustness, Article 43 internal-control conformity, Article 47 declaration, Article 49 registration, Article 72/73 monitoring and reporting. The governance lead owns the dossier; the ML lead owns the data work.
• Phase 3: not applicable — Brightfjord ships software, not an Annex I product.

Brightfjord's roadmap shows the value of phasing: it is not "doing AI Act compliance" in one undifferentiated push, but a register and screen done now, classification and disclosure by 2026, and a single high-risk dossier — for the one system that needs it — planned against 2 December 2027.

---

Penalties (the stake the roadmap protects against)

Under Article 99: prohibited Article 5 practices — €35,000,000 or 7% of worldwide turnover (99(3)); high-risk obligations and Article 50 disclosure — €15,000,000 or 3% (99(4)); incorrect/misleading information to an authority — €7,500,000 or 1% (99(5)). The third tier is 1%, never 1.5%. GPAI model-provider fines are a separate regime (Article 101, imposed by the Commission). The Article 99(6) cap (lower of the percentage or the fixed amount) applies to SMEs and start-ups, and since the Omnibus Article 99(6a) extends it to small mid-caps for the 99(4) and 99(5) tiers — surface it in your plan as a risk-calibration factor, not an excuse to slow down.

---

How Confir helps

Confir turns the roadmap from a spreadsheet into a live record: it holds the use-case register, runs the Article 5 screen and the Article 6 / Annex III classification, derives the Article 16/26 role, and routes each phase's obligations to an owner with a status. The classification is deterministic and rule-based — same intake, same finding, with the rule that fired recorded — so each milestone has defensible evidence behind it, and it generates the Article 11/Annex IV pack, the Article 47 declaration and the Article 27 FRIA that Phase 2 produces.

Related guides

• AI governance operating model
• EU AI Act deadlines and timeline
• The EU AI Act enforcement timeline
• EU AI Act compliance checklist
• Implementation roadmap for compliance teams
• Article 9 risk-management system
• How to classify your AI system