With August 2, 2026 now firmly on the regulatory calendar, the EU AI Act’s high-risk provisions are transitioning from policy discussion to enforcement reality. For CFOs, General Counsel, and board members at companies with any EU market exposure, the compliance window is narrowing faster than many organisations have anticipated. The convergence of AI Act obligations with existing GDPR frameworks is creating a layered compliance challenge that demands immediate structural attention — not a deferred line item.

A Staggered Enforcement Timeline With Immediate Exposure

The EU AI Act does not arrive as a single enforcement event. Its obligations have been rolling out in phases, and several are already active. Prohibited AI practices — including manipulative AI systems, social scoring mechanisms, and untargeted facial image scraping — became enforceable in February 2025, carrying fines of up to €35 million or 7% of global annual turnover, whichever is higher. General-Purpose AI (GPAI) model rules followed in August 2025.

The August 2, 2026 deadline represents the full activation of high-risk AI system obligations: mandatory conformity assessments, registration in the EU AI database, post-market monitoring, and robust technical documentation requirements. High-risk categories are broad and operationally significant — they include AI systems used in hiring and HR screening, credit scoring, biometric identification, and critical infrastructure management. Mid-market firms that have deployed off-the-shelf AI tools in these domains without formal compliance review face material regulatory exposure today, not in 2026.

Ireland’s AI Office is advancing its supervisory infrastructure ahead of the August 2026 deadline, signalling that enforcement architecture is being built in parallel with compliance obligations — a dynamic that should accelerate internal timelines for any organisation headquartered or operating in the EU.

GDPR-AI Act Convergence: The Governance Overlap That Cannot Be Ignored

One of the most operationally complex challenges emerging in 2026 is the intersection of GDPR and the EU AI Act. The European Data Protection Board (EDPB) and the European Commission are jointly developing guidance — as of March 2026 — on how the two frameworks interact, particularly around training data quality, purpose limitation, and Data Protection Impact Assessments (DPIAs) for high-risk AI systems.

This convergence creates a dual-track obligation for data governance teams. A DPIA required under GDPR for a high-risk processing activity may need to be aligned — or consolidated — with a conformity assessment under the AI Act. The risk of parallel, siloed compliance processes is both cost inefficiency and regulatory inconsistency. General Counsel should ensure that data privacy counsel and AI compliance functions are operating from a unified governance framework, not separate workstreams.

Simultaneously, the European Commission’s Q4 2025 Digital Package proposes targeted GDPR amendments that could ease some pressure: expanded SME exemptions for organisations up to 750 employees, mandatory one-click cookie rejection mechanisms, and explicit recognition of legitimate interests as a lawful basis for certain AI processing activities. These proposed changes, if adopted, offer meaningful relief for mid-market operators — but they are not yet law, and compliance programmes cannot be structured around anticipated amendments.

Implications for Enterprise Risk Management and Corporate Governance

For boards and executive leadership, the EU AI Act is not solely a legal and compliance matter — it is an enterprise risk management and corporate governance issue with direct financial and reputational dimensions. Consider the following immediate priorities:

  • AI system inventory: Conduct a structured audit of all AI tools deployed across HR, finance, customer-facing operations, and infrastructure to identify which fall within high-risk categories under Annex III of the AI Act.
  • Extraterritorial scope assessment: The Act applies to providers and deployers placing systems on the EU market or whose outputs are used in the EU — regardless of where the company is headquartered. US and global firms with EU exposure must assess their obligations as providers, deployers, or both.
  • Conformity assessment readiness: High-risk systems require documented conformity assessments before deployment. For systems already in use, retroactive documentation and gap analysis should begin immediately.
  • Third-party vendor governance: Many organisations are deployers of third-party AI systems. Contractual obligations, data governance standards, and liability allocation with AI vendors must be reviewed against Act requirements.
  • Board-level reporting: AI regulatory risk should be integrated into existing enterprise risk management frameworks and reported at board level, alongside ESG and AML obligations.

Key Takeaway

The EU AI Act’s August 2026 high-risk deadline is not a distant horizon — it is an active compliance programme that should already be underway. With prohibited practices enforceable since February 2025, GPAI rules live since August 2025, and national supervisory bodies building enforcement capacity now, the regulatory environment is operational. Organisations that treat this as a 2026 problem rather than a 2025 programme risk both financial penalties and the reputational cost of reactive compliance. The firms best positioned will be those that integrate AI Act obligations into existing data privacy, corporate governance, and risk frameworks — treating regulatory compliance not as a constraint, but as a strategic differentiator in an increasingly scrutinised AI landscape.