Updated 17 October 2026. Readiness is a claim about a particular system and its evidence. It is not a percentage printed beside a green traffic light.
Earlier versions of this article described August 2026 too broadly. The AI Act has several application dates. The current timeline by obligation category distinguishes the relevant Annex III high-risk date in December 2027 from regulated-product high-risk systems in August 2028 and obligations already applicable. Classification and transitional provisions matter.
Ask the team to demonstrate the claim
Imagine reviewing an AI assistant used in a consequential workflow. The document says a human can intervene. Ask the team to show that intervention. Does the reviewer receive the original request and relevant evidence? Can they decline the action? Does the system respect that decision?
These are operational questions. They do not, by themselves, establish legal compliance. They do tell you whether the documented control describes something that exists.
| Claim | Demonstration | Unresolved if |
|---|---|---|
| We know the system | Inventory, purpose and owner | Scope is unclear |
| We can oversee it | Reviewer can inspect and intervene | Review is only a label |
| We can investigate | Reconstruct a sample action | Records omit the result |
| We manage changes | Show reassessment after a change | Old evidence is reused blindly |
Separate missing evidence from a failed control
If a test has not been run, the answer is unknown. If it has been run and the control failed, the answer is failure. Calling both “in progress” hides a distinction that should affect the release decision.
A small evidence register can record the claim, the test, the result, the date and the person responsible. It should also say what the test does not cover. One success in a clean environment is not proof that the workflow handles ambiguous inputs, unavailable tools or revoked permissions.
Review the release, not just the document
A new tool, a new data source or permission to take an action can change the risk even when the product name stays the same. Decide which changes trigger review and make that trigger part of the release process.
For the evaluation side, use separate checks for outcomes, authority and recovery. For the organisation side, begin with a decision record that names the purpose, exclusions and evidence needed. Neither replaces qualified assessment of the applicable law.
The European Commission’s AI Act page is the primary reference for the timeline discussed here. Keep a dated interpretation alongside the system assessment rather than assuming a headline applies to every use case.
Readiness becomes useful when someone can inspect the evidence and disagree with it. Until then, the green traffic light is mostly interior decoration.
