EU AI Act enforcement begins next month. Here is what legal teams must ship by then.

Why this matters now

The first enforcement window for the EU AI Act general-purpose AI obligations opens on May 15, 2026. After that date, any organization deploying or providing GPAI services to users in the EU is subject to the Act transparency, documentation, and governance requirements, with fines that can reach 15 million euros or 3% of global annual turnover, whichever is higher.

For legal teams at multinational firms and corporate clients, the window for we will figure it out later closed about six months ago.

The seven workstreams

1. AI inventory. Every AI system in use across the organization, classified by AI Act risk tier. This includes shadow IT: Copilot in Word, ChatGPT browser sessions, embedded AI features in existing SaaS. If you do not have this inventory, you do not have compliance.

2. Data governance and provenance. Documentation of training data sources, licensing, and any high-risk personal data exposure. The Act Article 10 obligations are not aspirational.

3. Human oversight specifications. For each high-risk system, a documented human-in-the-loop protocol with named accountable individuals.

4. Transparency and disclosure. User-facing disclosure of AI involvement in decisions. This is not just a footer, it is a structured workflow.

5. Bias testing and ongoing monitoring. Pre-deployment evaluation plus continuous post-deployment monitoring with documented thresholds.

6. Incident response and reporting. Article 73 requires serious-incident reporting to authorities within tight timelines. You need the workflow before you need it.

7. Vendor due diligence. Contractual flow-down of Act obligations to AI vendors. Most existing SaaS contracts do not satisfy this.

The realistic timeline

A team starting today, with executive support and budget, can plausibly stand up workstreams 1, 3, 4, and 6 by the May enforcement window. Workstreams 2, 5, and 7 are 6-9 month builds.

For teams that have not started: the realistic path is to prioritize incident-response and high-risk-system documentation, and accept that bias testing and full vendor flow-down will land later in 2026.