Updated 17 October 2026. This article has been revised to separate the policy timeline from the product argument. See the current AI Act timeline for the category-specific dates and primary reference.
Extra runway only helps if the team knows what has to happen in sequence. A compliance programme can look busy while its most important dependency sits untouched.
Map the critical path
Suppose a team needs to assess an agent’s permission boundary. It first needs an accurate account of the tools the agent can invoke. It may then need a test environment, realistic cases and an owner who can approve the result. Buying a reporting tool does not remove those dependencies.
Write down which activity enables the next one. This can expose work that looks small but blocks everything else, such as confirming who owns an integration or obtaining a representative test dataset. The biggest meeting is not necessarily the biggest dependency.
Use evidence-based completion criteria. “Review held” records an event. “Permitted actions documented and disputed cases resolved” records an outcome. The distinction prevents a schedule from progressing while the underlying uncertainty stays still.
Leave room for a failed test to create more work. A plan that assumes every assessment passes on the first attempt is not a plan for assessment. It is a plan for congratulating ourselves.
| Decision | Evidence to request |
|---|---|
| Establish scope | System and action inventory |
| Prepare assessment | Cases, environment and reviewers |
| Resolve findings | Fixes and repeat evidence |
What to do with this
Review the dependency map when the product changes. A new integration can invalidate a convenient sequence. The point of planning is to surface that change early enough to respond.
Record the decision, the responsible owner and the evidence still missing. The decision-record example shows a lightweight way to do that. Where a claim concerns system behaviour, connect it to evaluation evidence. These are proposed product practices, not a finding that a system complies with the law.
Primary timeline reference: European Commission, AI Act. The operational recommendations above are my analysis.
