TL;DR — The EU AI Act applies in stages. As of 3 September 2026, further deadlines for high-risk systems fall on 2 December 2027 or 2 August 2028 depending on the category. The obligations for an organisation depend on the system and its role. Governance before rollout makes that assessment easier to evidence.

Europäische Kommission: Informationen zum EU AI Act

We have seen this movie.

NIS2's pattern: boards ask "are we compliant?" too late; security inherits a deadline they did not set; consultants sell gap analyses. The winners already ran a real ISMS and just extended it.

The AI Act creates a similar forcing function for new technology: staged application rather than one single date, risk-based obligations rather than one flat rule, and penalties companies need to take seriously.

Why AI is harder than NIS2.

NIS2 often concerns comparatively stable IT and control processes. With AI, models, providers and use cases can change much faster. That makes one-off assessment fragile and operational governance more important.

So this is not a one-time gap analysis. It is a moving target, and only governance built into how you deploy can scale.

The governance problem.

Many enterprise AI initiatives fail rarely on the model, and often on the boring layer: no acceptable-use policy, no data classification for prompts, no human-oversight model, no audit trail, no one who can sign it off.

In a startup you apologize later. In a regulated enterprise that missing layer is the project killer.

What ready looks like.

  • 1. Know your exposure: sanctioned and shadow AI, and what is high-risk.
  • 2. Write the policy before starting the AI pilot project, mapped to the EU AI Act, ISO 42001 and your ISMS.
  • 3. Govern by design: oversight, logging and containment in the architecture.
  • 4. Use ISO 42001 as management-system logic for AI: extend existing ISMS experience, do not rebuild from scratch.

Bottom line.

Companies that handled NIS2 well did not wait to be told. The AI Act favours the same posture. The calm window is open now and closing.

Start with an AI Deployment Readiness Assessment info@amara.gmbh