EU AI Act High-Risk Deadlines: What US Companies Must Do Before December 2027

If your company places an AI system on the EU market, or its output is used in the EU, the EU AI Act can apply to you wherever your company is incorporated. What you owe depends on your role (provider or deployer) and on how the system is classified.

Updated October 9 and October 27, 2026. The high-risk obligations were originally due on August 2, 2026. Regulation (EU) 2026/1744, adopted July 8, 2026, moved them:

• December 2, 2027 for high-risk systems listed in Annex III, such as those used in hiring, credit, education and critical infrastructure
• August 2, 2028 for high-risk AI built into products covered by Annex I, such as machinery and medical devices

Some obligations did not move and already apply:

• Since February 2, 2025: the bans on prohibited practices (Article 5) and the AI literacy provision (Article 4). Regulation (EU) 2026/1744 softened the literacy duty to supporting AI literacy, but it remains an obligation for providers and deployers.
• Since August 2, 2025: the obligations for providers of general-purpose AI models.

The extra time for high-risk systems is for preparation, not a reason to wait. Here is a practical checklist for US-based organizations. It is a summary, not legal advice; confirm your position with counsel.

Step 1: Classify Your AI Systems

The Act uses a risk-tiered framework. Prohibited practices, such as social scoring and, for law enforcement, real-time remote biometric identification in publicly accessible spaces outside narrow exceptions, have been banned since February 2025; if you find one, it must stop now. High-risk systems — those used in hiring, credit, education, critical infrastructure, or law enforcement — carry the heaviest compliance obligations.

Step 2: Build a Conformity Documentation Package

High-risk systems require technical documentation that covers system architecture, training data governance, performance metrics, including on potentially discriminatory impacts, and human oversight mechanisms. This documentation must be maintained and updated when the system changes materially.

Step 3: Implement a Human Oversight Mechanism

Automated decisions made by high-risk systems must have a meaningful human review pathway. Logging alone is not sufficient. You need a defined process, assigned responsibility, and evidence that the oversight works as designed.

Step 4: Register in the EU Database

High-risk systems used in certain sectors must be registered in the EU database before being placed on the market or put into service (Article 49; some entries are not public).

Step 5: Appoint an EU Representative

Providers established outside the EU must appoint an authorized representative in the EU: for high-risk AI systems before placing them on the EU market (Article 22), and for general-purpose AI models since August 2025 (Article 54). Deployers do not have this duty.

December 2027 is closer than it appears. Classification, documentation and oversight design take months, and the standards they depend on are still arriving. Starting the classification exercise now gives you time to remediate before the obligations apply.