Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
Regulatory capacity and enterprise readiness are separate questions. A company should not infer that its own responsibilities disappear because an enforcement process is still developing.
Prepare for a question you can answer
Focus first on the evidence the organisation controls. Can it identify the relevant system, explain its intended use and produce the records behind an important decision? Those capabilities are useful for internal review and customer assurance as well as regulatory questions.
An illustrative investigation starts with a disputed action. The team needs the request, relevant context, permission decision and observed outcome. It also needs to know which records were not retained. A confident narrative should not fill gaps in the evidence.
Assign someone to coordinate the response and protect the integrity of the records. Different specialists may explain different parts of the system, but the account should remain consistent. Contradictory descriptions of the same workflow create avoidable confusion.
Questions about regulator powers, procedures and deadlines should be checked against current official guidance. Predictions about how aggressively a regulator will act are not a sound substitute for understanding the applicable obligations.
| Decision | Evidence to request |
|---|---|
| Identify | System, version and relevant workflow |
| Reconstruct | Available evidence and known gaps |
| Respond | Coordinated, accurate explanation |
What to do with this
Test the ability to answer a reasonable question before an urgent one arrives. The exercise may reveal a missing record or unclear owner while there is still time to fix it calmly.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
