Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
The deadline moved. The unresolved permission, missing test and unclear handoff did not politely move out of production with it. My concern is the work that can lose its owner when urgency fades.
Build a control backlog
Instead of creating a single ticket called “AI compliance”, separate the work into observable changes. A task to demonstrate credential revocation is different from a task to document intended use. Each needs its own acceptance evidence and someone who can judge the result.
An illustrative backlog might include an inventory correction, an access-boundary test and an exception-routing exercise. Rank those by the consequences of failure and the dependencies between them. Do not assume that the longest document is the highest-priority task.
A review can then ask whether the controls improved this month, not merely whether the programme consumed budget. This is a product-management proposal, not a claim that one backlog format satisfies a regulator. The legal assessment still determines the obligations that apply.
| Decision | Evidence to request |
|---|---|
| Inventory correction | Current purpose and owner recorded |
| Access-boundary test | Disallowed action is blocked |
| Exception routing | Unresolved task reaches a responsible person |
The deadline was never the hard part. The infrastructure for ongoing AI accountability is the hard part, and you cannot bolt it on in the final weeks before any deadline, no matter when that deadline falls.
That work is not glamorous. It does not produce demos or generate press releases. But it is the difference between an organisation that is structurally ready for AI governance and one that is scrambling in Q4 2027 to paper over two years of decisions made without audit trails.
What to do with this
Keep the remaining uncertainty visible. If a test has not been run, say so. If it failed, record the failure and the response. A backlog that turns every uncomfortable result green is a presentation, not a management tool.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
