AI at Work News
Four Months to Full EU AI Act Enforcement: What Every CEO Needs to Know
August 2, 2026 is the date the EU AI Act's enforcement provisions for high-risk AI systems come into full effect. If your company operates in Europe, sells to European customers, or uses AI tools that touch employment decisions, credit assessments, or customer scoring, this deadline applies to you directly. The clock is running.
According to a detailed regulatory breakdown published by LegalNodes, the EU AI Act entered into force in August 2024 and has been rolling out in stages. Prohibitions on banned AI practices and AI literacy requirements took effect in February 2025. Governance obligations for general-purpose AI models kicked in by August 2025. The August 2026 milestone is when full enforcement begins for high-risk AI systems, the classification that catches most enterprise AI use cases that companies haven't thought of as "AI products."
The penalty structure is not theoretical. Non-compliance with high-risk AI obligations can result in fines of up to €35 million or 7% of global annual revenue, whichever figure is larger. For a company with $500 million in revenue, that's potentially $35 million in exposure from AI tools you didn't build, just deployed.
The Assumption That's Getting Companies Into Trouble
The most common misconception about the EU AI Act is that it applies primarily to AI developers: the OpenAIs, Anthropics, and Mistral AIs of the world. That assumption is wrong, and it's the one creating the most compliance risk for B2B enterprises right now.
The EU's AI regulatory framework extends obligations to the deployers of AI systems, not only the developers. If you're a company that bought an AI-powered ATS for recruiting, an AI performance management platform for employee reviews, or a credit decisioning tool embedded in your finance workflow, you're a deployer. The compliance obligations don't sit entirely with the vendor. They sit with you too.
This matters more than most executive teams currently appreciate. The standard B2B procurement assumption is that SaaS vendors handle their own compliance. Under the EU AI Act, that's partially true, but deployer obligations around human oversight, documentation, and risk management are yours to meet regardless of whether your vendor is compliant. Your AI governance framework will need to explicitly address this deployer responsibility — vendor compliance and internal compliance are two separate audit trails.
What "High-Risk" Actually Means in Practice
The EU AI Act's high-risk classification isn't based on how sophisticated the AI is. It's based on what decisions the AI system informs or makes. A simple AI tool that screens CVs for an HR team is high-risk. A complex AI system that suggests blog post topics is not.
Per the LegalNodes analysis, the high-risk categories most relevant to B2B enterprises include:
Employment and workforce management. AI tools used for recruitment (including CV screening, candidate ranking, and interview scoring), performance monitoring, promotion decisions, and termination processes fall into this category. If your ATS or performance management platform has an AI scoring layer (and most modern ones do) you're operating a high-risk AI system. The AI security and compliance considerations for these tools go beyond the vendor's privacy policy — they include your own operational documentation.
Credit and financial decisions. AI that informs creditworthiness assessments, loan origination, or risk scoring for financial products is high-risk. This extends beyond banking into B2B sales contexts where AI tools support credit line decisions or payment terms.
Education and vocational training. AI systems used to evaluate students, recommend learning paths, or make decisions about access to educational programs fall under high-risk classification.
Law enforcement and border control. Less relevant to most B2B enterprises, but included for completeness.
The practical test is this: does your AI tool make or strongly inform a consequential decision about a person? If yes, treat it as potentially high-risk until your legal team confirms otherwise.
What Compliance Actually Requires
Meeting the EU AI Act's high-risk AI obligations isn't just about having a privacy policy that mentions AI. It requires documented processes that can be demonstrated to regulators. According to compliance guidance from SecurePrivacy, the core requirements for deployers of high-risk AI systems include:
System inventory and classification. You need to know which AI systems your organization uses, what decisions they inform, and whether they touch the high-risk categories above. Most enterprises don't have this inventory yet, and it's harder to produce than it sounds, because AI features are now embedded in dozens of SaaS tools that weren't purchased as "AI systems."
Risk assessments. For each high-risk AI system in use, you need documented risk assessments covering the system's intended purpose, potential for bias or discriminatory outcomes, and data quality controls.
Human oversight mechanisms. High-risk AI systems must be designed to allow meaningful human review before final decisions are made. "The AI recommended it" is not a sufficient process for employment or credit decisions under the Act.
Data governance documentation. You need to demonstrate that the data used to train or operate AI systems is accurate, complete, and not systematically biased. This is often the hardest part because the relevant data may sit with your SaaS vendor, not with you. For RevOps teams running AI-powered lead scoring and forecasting tools, the RevOps compliance checklist covers the specific documentation steps for those workflows.
Vendor compliance verification. You need to confirm that your AI vendors (the companies who built the tools you're deploying) are themselves compliant with the Act's obligations for AI developers and providers. Don't assume. Ask, in writing, for their compliance documentation.
The Gap Most Leadership Teams Haven't Addressed
There's a specific gap that shows up repeatedly in conversations about EU AI Act readiness: the disconnect between legal/compliance teams and the operational functions that actually deploy AI tools.
Most enterprise legal teams are aware the EU AI Act exists. But the people who know which AI tools are actually running inside the business (in HR, sales operations, finance, and customer success) are not always in those legal conversations. The HR leader who upgraded the ATS last year may not know the AI scoring feature qualifies as a high-risk system. The RevOps director who configured the AI lead scoring system may not realize it touches credit-adjacent decisions that require deployer documentation.
Closing this gap requires a cross-functional inventory process, not a legal review conducted in isolation. The companies that will be well-positioned in August 2026 are the ones that start that cross-functional conversation now.
A Compliance Action Framework
This is not legal advice. Work with qualified legal counsel on your specific obligations. From an executive awareness standpoint, here's the sequence that makes sense in the next four months:
Commission an AI system inventory. Within the next two to three weeks, ask each department head to list every AI tool or AI-enabled feature their team uses, including tools embedded in existing SaaS platforms. The result will surprise you.
Apply the high-risk classification test. Run each identified tool against the EU AI Act's high-risk categories. Employment, credit, education, and law enforcement contexts are the primary filters. Your legal team should do this review, but they can't do it without the inventory first.
Request compliance documentation from vendors. For any tool that might qualify as high-risk, contact the vendor and ask for their EU AI Act compliance status documentation. If they can't provide it, escalate to your procurement team. Vendor compliance is now a procurement criterion, not just a security checkbox.
Map your human oversight processes. For high-risk AI systems in use, document how human review actually happens before consequential decisions are finalized. If the honest answer is "it doesn't," that's a process gap you need to address.
Engage legal counsel for the formal assessment. With the inventory in hand and the preliminary high-risk classification done, you have what you need to have a substantive conversation with your legal team or outside counsel. They can advise on specific documentation requirements and your risk exposure.
What to Do This Week
One concrete action: start the AI system inventory.
Send a short message to your leadership team (HR, RevOps, Finance, Product, Customer Success) asking for a list of every AI tool or AI-enabled feature in active use in their functions, including features embedded in tools they already have. Give them a week to respond. Compile the responses centrally.
This single step puts you ahead of most companies that will still be figuring out what they're running when August 2026 arrives. The compliance timeline is fixed. Your preparation timeline is not, but it's shorter than most executives currently assume.
Sources: EU AI Act 2026 Updates (LegalNodes), EU Digital Strategy regulatory framework, and SecurePrivacy compliance guide. This article is an executive awareness briefing, not legal advice. Consult qualified legal counsel for advice specific to your company's situation.
