The European AI rulebook is no longer a single future deadline. Transparency duties are already active, while major obligations for specified high-risk systems arrive later. That split changes how leadership teams should plan compliance.
Three clocks, not one
First, disclosure requirements are already relevant. People must be told when they are interacting with certain automated systems, and specific synthetic media and public-interest content require clear identification. Second, obligations for general-purpose models entered the compliance calendar earlier. Third, the strict framework for selected high-risk applications follows a separate timetable, extending into 2027 and 2028.
Why waiting creates operational debt
A company cannot build traceability, data governance and human oversight in the week before a legal deadline. These capabilities depend on procurement records, model inventories, system logs, testing evidence, accountable owners and escalation routes. When those foundations are missing, compliance becomes an expensive reconstruction project.
The minimum management system
Every organisation using AI should maintain a living inventory that records purpose, owner, vendor, data inputs, affected users and material decisions. Systems should then be classified by use rather than by marketing label. A general writing assistant, a recruitment-ranking tool and an automated credit decision may all use similar technical components but carry very different obligations and risks.
Boards do not need to approve every experiment. They do need reliable thresholds for escalation: when a use affects employment, education, access to services, safety or fundamental rights, legal, security and operational review should begin early.
From compliance project to business control
The strongest response is not a legal memo kept outside daily operations. It is a control system integrated into product development, procurement and vendor management. The deadline map should become a roadmap for documentation, testing, monitoring and incident response.
That approach also creates strategic value. Teams know which experiments can move quickly, which require safeguards and which should not proceed. Regulatory readiness then stops being a brake on innovation and becomes the architecture that makes responsible scale possible.