On 2 August 2026, the EU AI Act's high-risk AI system requirements become fully enforceable. This is not a new announcement. The Act was published in the Official Journal of the European Union on 12 July 2024. The timeline has been public for two years. And yet, in our conversations with US-based legal and compliance teams over the last six months, the most common response to the August deadline is a variant of the same sentence: "We thought we had more time."

You do not have more time. The August deadline applies to AI systems deployed in the EU — regardless of where the company deploying them is headquartered. If your system makes decisions about EU residents in employment, credit, healthcare, education, or critical infrastructure, you are in scope. The question is not whether the regulation applies to you. The question is whether you have built the documentation, the oversight mechanisms, and the governance infrastructure to demonstrate compliance when asked.

§ I · What the Act actually requires

The obligations are operational, not aspirational.

The EU AI Act is not a principles document. It is a compliance framework with specific, auditable requirements. For high-risk AI systems — a category that includes systems used in employment decisions, credit scoring, medical devices, educational assessment, and critical infrastructure — the obligations are as follows.

Risk management system. Operators must establish, implement, document, and maintain a risk management system throughout the AI system's lifecycle. This is not a one-time assessment. It is a continuous process with documented outputs.

Data governance. Training, validation, and testing data must meet specific quality criteria. Operators must document the data governance practices, including data provenance, selection criteria, and known limitations.

Technical documentation. Before a high-risk system is placed on the market or put into service, operators must prepare technical documentation demonstrating compliance. The documentation must be kept up to date.

Record-keeping. High-risk AI systems must be capable of automatically recording events — logs — throughout their operation. The logs must be retained for a period appropriate to the intended purpose, with a minimum of six months for systems used by public authorities.

Transparency. Natural persons interacting with high-risk AI systems must be informed that they are interacting with an AI system, unless this is obvious from the context.

Human oversight. High-risk systems must be designed and developed to allow effective human oversight. This includes the ability to understand the system's capabilities and limitations, to monitor its operation, and to override or interrupt the system.

Accuracy, robustness, and cybersecurity. High-risk systems must achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle.

§ II · The US company problem

Extraterritorial reach is not theoretical.

The EU AI Act applies to providers and deployers of AI systems that place systems on the EU market or put them into service in the EU — regardless of where those providers and deployers are established. This is the same jurisdictional logic as the GDPR, and it has the same practical consequence: US companies with EU customers, EU employees, or EU data subjects are in scope.

§ III · The risk classification question

Most companies do not know where their systems sit.

The Act's obligations scale with risk classification. Unacceptable-risk systems are prohibited. High-risk systems face the full compliance burden described in § I. Limited-risk systems face transparency obligations. Minimal-risk systems face no mandatory obligations.

The classification question is therefore the first question. And in our experience, most organisations have not answered it systematically.

The classification is not always obvious. An AI system used for employee performance monitoring may or may not be high-risk depending on how it is used and what decisions it informs. A customer-facing recommendation system may be minimal-risk in one context and limited-risk in another. The classification requires a systematic review of each system's intended purpose, its actual deployment context, and the decisions it informs or automates.

§ IV · The documentation gap

The audit trail does not exist yet.

In our engagements with US companies preparing for August, the most consistent finding is a documentation gap. The technical documentation required by the Act — system architecture, training data provenance, risk assessment outputs, human oversight mechanisms — does not exist in the form the Act requires.

This is not because companies have been negligent. It is because the documentation requirements of the EU AI Act are more specific and more operationally demanding than anything most US companies have previously been required to maintain for AI systems.

The documentation gap has three components. First, the technical documentation of the system itself — architecture, training data, performance metrics, known limitations — is often scattered across vendor documentation, internal wikis, and the memories of the engineers who built it. It has never been assembled into a single, auditable document.

Second, the risk management documentation — the ongoing assessment of risks, the mitigation measures, the residual risks — does not exist as a continuous process. It may exist as a one-time assessment conducted at deployment, but the Act requires a living document that is updated as the system evolves.

Third, the human oversight documentation — who is responsible for monitoring the system, what they are monitoring for, what the escalation path is, what the override mechanism is — is typically informal. It exists in people's heads, not in documented procedures.

§ V · The enforcement timeline

What the next twelve months look like.

The August 2026 deadline is the beginning of enforcement, not the end of a grace period. The enforcement architecture is still being built — national supervisory authorities are at different stages of readiness — but the trajectory is clear.

The first enforcement actions will likely focus on the most visible, highest-risk systems: hiring tools, credit scoring systems, and systems used in healthcare decisions. These are the systems where the potential for harm is greatest and where the documentation requirements are most specific.

The penalty structure is significant. Non-compliance with the high-risk provisions can result in fines of up to €30 million or 6% of global annual turnover, whichever is higher. For a company with €1 billion in global revenue, that is a €60 million exposure. For a company with €10 billion in revenue, it is €600 million.

§ VI · What preparation looks like

The six-week sprint that most companies need.

For a US company with high-risk AI systems deployed in the EU, the path to compliance is not a multi-year transformation programme. It is a focused, six-to-eight-week sprint that produces the documentation and governance infrastructure the Act requires.

The sprint has four phases. The first is inventory: identify every AI system in production that touches EU data subjects, and classify each one by risk tier. This is typically a two-week exercise involving legal, engineering, and operations.

The second is documentation: for each high-risk system, assemble the technical documentation required by the Act. This involves working with the system's developers (internal or vendor) to produce the architecture documentation, training data provenance, and performance metrics. This is typically a three-week exercise.

The third is governance: establish the human oversight mechanisms, the logging infrastructure, and the escalation procedures required by the Act. This is an engineering and operations exercise, not a legal one.

The fourth is maintenance: establish the processes that will keep the documentation current as the systems evolve. This is the hardest part, because it requires changing how the organisation thinks about AI system operation — from a deployment event to a continuous process.

§ VII · Where to begin

The first question to answer.

The first question is not "are we compliant?" It is "do we know what we have deployed?" In our experience, most organisations cannot answer this question without a structured inventory exercise. They know about the AI systems they built. They do not always know about the AI systems their vendors have built into the products they use.

Start with the inventory. Map every AI system that touches EU data subjects. Classify each one by risk tier. For the high-risk systems, assess the documentation gap. Then build the sprint plan.

The companies that will navigate August without incident are not the ones with the most sophisticated AI governance programmes. They are the ones that started the inventory six months ago and have been building the documentation since. If you have not started, the time to start is now — not because August is close, but because the documentation takes longer to produce than most teams expect.

DigiForm works with regulated businesses to build the governance infrastructure required by the EU AI Act and equivalent frameworks. If you are preparing for August, book a call with our team.