Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
A later deadline can make governance look like a project to restart later. That is the wrong operating model for a system that changes every release. The calendar moves occasionally. The product moves continuously.
Make governance part of the release
Before release, identify which changes could invalidate the previous evidence. A new model, tool, data source or permission may affect different controls. Not every change needs the same review, but the decision about review should be explicit.
An illustrative release adds a tool that writes to customer records. Existing answer-quality tests remain useful, but they do not establish that the write permission is correctly scoped. The team needs evidence for the new action, including rejection, interruption and recovery.
After release, decide what signals lead to investigation and who receives them. Collecting records is not the same as reviewing them. A dashboard nobody is responsible for checking is a very elaborate screensaver.
| Decision | Evidence to request |
|---|---|
| Before release | Changed behaviour and affected controls |
| At release | Acceptance evidence and owner decision |
| After release | Monitoring, escalation and reassessment triggers |
Governance is not a sprint that you finish before the deadline. It is the operating model of how you build AI products in regulated industries. The EU just told the market that the calendar is flexible. The work is not.
What to do with this
Keep a small, repeatable loop rather than a once-a-year documentation rush. The objective is to notice when the evidence no longer describes the product. That remains useful whether a particular legal obligation is already applicable or still in transition.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
