If your organisation has not yet mapped its AI tools against the EU AI Act's risk classification framework, you are not behind schedule, you are already in a reactive position. What mid-market organisations need to do before that date is specific: build a complete inventory of every AI tool in active use, classify each one against the Act's risk tiers as part of a structured AI risk classification exercise, and document the deployer obligations under Article 26 that follow. The first step makes the other two possible. Most mid-market organisations have not taken it.
I say this as someone who has spent fifteen years in financial services compliance. The EU AI Act is not moving. The high-risk AI system obligations that activate in August 2026 apply whether your organisation has a governance programme in place or not.
“In financial services compliance, the deadlines that hurt are never the ones organisations haven’t heard of. They are the ones that kept slipping to next quarter. August 2026 has been next quarter long enough.” - Namita Razdan, Co-Founder, Montro
This piece is for the DPO trying to work out how the Act intersects with their existing GDPR workload, the CISO who has been told AI governance is now on their agenda, and the CFO who needs to understand what non-compliance actually costs before signing off on the budget to avoid it.
What Enforcement Actually Means
The EU AI Act has been in phased implementation since August 2024. It is live law with an active timeline.
- 2 February 2025: Prohibited AI practices became enforceable under Article 5. Any system engaging in subliminal manipulation, emotion recognition in the workplace, or biometric categorisation to infer sensitive attributes was required to be removed or remediated by this date.
- 2 August 2026: The full framework for high-risk AI systems under Annex III activates. This is the deadline most mid-market organisations have circled.
- Fines: Up to €35 million or 7% of global annual turnover for the most serious violations - exceeding even GDPR’s maximum.
The August 2026 deadline is not a grace period. It is the point at which organisations using high-risk AI systems become subject to the full set of deployer obligations under Articles 26 and 27. If you are using AI tools for credit decisioning, recruitment screening, performance assessment, or fraud detection, those obligations apply to you directly, regardless of whether the AI provider has achieved conformity.
Why Mid-Market Is Specifically Exposed
Enterprise organisations with dedicated AI governance teams have had the resources to track this legislation since its proposal in 2021. Mid-market organisations, typically 200 to 2,000 employees - have not.
Harmonic Security identified 665 distinct generative AI tools in active enterprise use in 2025. In mid-market organisations, adoption moved faster still because procurement controls are lighter and employee-led tool adoption is harder to monitor. Only 1.5% of organisations believe they have adequate AI governance headcount to manage the tools already present in their environment, and 98% expect governance budgets to increase substantially - a recognition that the gap between tool adoption and governance capacity is structural, not temporary.
Most mid-market organisations are therefore trying to build an EU AI Act compliance programme on top of an AI inventory they cannot see clearly. You cannot classify what you have not discovered.
What the Act Requires of You, By Role
If you are a DPO
Your existing GDPR workload and the EU AI Act are not separate programmes. They intersect at several points that require immediate attention.
Article 27 of the Act requires deployers of high-risk AI systems to conduct a Fundamental Rights Impact Assessment (FRIA) before deployment. Structurally it resembles the Data Protection Impact Assessment (DPIA) mandated under GDPR Article 35, but broader in scope - covering impacts on non-discrimination, dignity, freedom of expression, and access to justice, not only data protection rights. The European Data Protection Board has confirmed that a combined DPIA and FRIA is permissible, which means extending your existing DPIA template is more efficient than building a parallel process.
Article 86 of the Act gives individuals the right to an explanation when a high-risk AI system has been used in a decision affecting them. This is additive to, not a substitute for, GDPR Article 22 rights relating to automated decision-making. Satisfying one does not satisfy the other.
Your Record of Processing Activities under GDPR Article 30 is also incomplete if it does not account for AI tools processing personal data. Discovery of shadow AI tools is therefore a precondition for an accurate RoPA, not a separate compliance exercise.
If you are a CISO
Article 5 prohibited practices have been enforceable since 2 February 2025. The tools that fall into this category are not always labelled clearly. “Candidate sentiment analysis,” “employee engagement scoring based on facial cues,” and “behavioural profiling” are commercial product names for what the Act defines as prohibited emotion recognition in the workplace and biometric categorisation.
If your organisation has tools in these categories that were not reviewed and either remediated or removed before February 2025, you are in active violation. Discovery is the first step - but AI risk classification against the Act’s prohibited and high-risk categories is what turns a discovery exercise into an enforceable compliance position.
Under Article 9, deployers of high-risk AI systems must implement technical and organisational measures ensuring human oversight is genuine, not nominal. This intersects with NIS2 Article 21’s supply chain security obligation, a shadow AI tool that appears in neither your EU AI Act register nor your NIS2 ICT asset register is a simultaneous gap under both frameworks.
Of the three roles this piece addresses, I am most worried about the CISO. Not because they do not understand the regulation; they are often the ones who understand it better than anyone else in the organisation. Because the EU AI Act falls squarely on their agenda without giving them the tools to respond to it alone. The discovery work requires a budget that belongs to either IT or finance. The policy enforcement requires authority over functions that do not report to them. The classification work requires the DPO's sign-off. The CISO is accountable for a programme that three other people have to co-own. This organisational problem will not resolve itself before August 2026. The firms that will be ready are the ones who resolved it before the deadline, not after. - Namita Razdan, Co-Founder, Montro |
If you are a CFO
The compliance cost question is legitimate and I will answer it directly.
For a mid-market organisation with two to three high-risk AI systems, a reasonable estimate for initial compliance is £150,000 to £600,000, covering discovery and classification, remediation per system, legal and advisory fees, and establishment of ongoing governance. Ongoing annual cost runs approximately £50,000 to £120,000.
The comparison that matters: a single high-risk AI Act violation at 3% of €200 million in revenue is €6 million. A prohibited practice violation at 7% of the same revenue base is €14 million. The compliance programme costs a fraction of a single enforcement action.
What makes mid-market organisations specifically vulnerable is that enforcement is more likely to be triggered by incident or complaint than by proactive regulatory audit in the near term. An ungoverned AI tool that produces a discriminatory output, a data breach, or a customer complaint to a national supervisory authority creates enforcement exposure regardless of company size.
The Four-Clock Problem
The reason AI governance cannot be treated as a standalone compliance project is that a single ungoverned AI tool creates simultaneous obligations across four regulatory frameworks, each with its own timeline:
- EU AI Act: Immediate reporting obligations for serious incidents involving high-risk AI systems.
- DORA: Initial notification to the competent authority within 4 hours of classifying a major ICT incident.
- NIS2: Early warning to CSIRT within 24 hours of becoming aware of a significant incident.
- GDPR: Notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
In a financial services organisation, a shadow AI tool used for fraud detection that produces an erroneous output affecting customers simultaneously engages all four clocks. The organisation cannot meet any of those notification requirements if it does not know the tool exists.
Treating AI governance as aspirational has a concrete operational consequence: an organisation that does not know a tool exists cannot report an incident involving it.
What to Do Before August 2026
Three months is a short window, but it is not an empty one if you move in sequence.
First: discover. You need a complete inventory of every AI tool in use across your organisation, sanctioned and unsanctioned, expensed and personal, integrated and browser-based. A management-declared inventory will typically capture 50 to 70% of what is actually present. Technical discovery closes the gap.
Second: classify. Once you have an inventory, every tool needs to be positioned against the Act’s risk pyramid as part of a systematic AI risk classification exercise: prohibited, high-risk (Annex III), limited-risk, or minimal risk. The classification drives the remediation priority. Prohibited tools require immediate action. High-risk tools require the full deployer EU AI Act compliance programme. Limited and minimal risk tools require governance proportionate to their actual exposure.
Third: document. The artefacts required under Article 26 - records of use, human oversight procedures, instructions followed, and personnel qualifications, need to exist before August 2026, not in response to an enforcement action after it.
If you have not started, start with discovery. Everything else is impossible without it.
Frequently Asked Questions
What does the EU AI Act enforcement phase mean in practice?
The Act has been in phased implementation since August 2024. Article 5 prohibited practices became enforceable on 2 February 2025. The high-risk AI system obligations under Annex III activate on 2 August 2026. From that date, organisations using AI tools for credit decisioning, recruitment screening, performance assessment, or fraud detection are subject to the full set of deployer obligations under Articles 26 and 27 of Regulation (EU) 2024/1689 - regardless of whether the AI provider has achieved conformity. Violations carry fines of up to €35 million or 7% of global annual turnover under Article 99.
Which AI tools fall under Article 5's prohibited practices, and are any of them in common use?
More than organisations expect. Article 5 prohibits emotion recognition in workplace and educational settings, AI that infers sensitive attributes - ethnicity, political opinion, sexual orientation, from biometric data, and systems that exploit psychological vulnerabilities to influence behaviour. These do not always announce themselves clearly. "Candidate sentiment analysis", "employee engagement scoring based on facial cues", and "behavioural profiling" are commercial product names for practices the Act prohibits. If tools in these categories were not reviewed and either remediated or removed before 2 February 2025, the organisation is in active violation now.
What is the difference between a FRIA and a DPIA, and do we need both?
A Data Protection Impact Assessment under GDPR Article 35 addresses risks arising from personal data processing. A Fundamental Rights Impact Assessment under EU AI Act Article 27 covers a broader set of rights - non-discrimination, dignity, freedom of expression, access to justice - not only data protection. The two overlap significantly for AI tools that process personal data. The European Data Protection Board has confirmed that a combined DPIA and FRIA is permissible. For most mid-market organisations, extending an existing DPIA template is more efficient than building a parallel process from scratch.
If we use a third-party AI tool, does the Act still apply to us directly?
Yes. The Act distinguishes between providers, organisations that develop or place AI systems on the market, and deployers - organisations that use those systems in a professional context. Using a third-party AI tool for a purpose covered by Annex III makes your organisation the deployer. Article 26 obligations apply directly: use the system in accordance with the provider's instructions, ensure genuine human oversight, monitor operation, inform affected individuals before deployment. The provider's conformity assessment establishes that the system meets the Act's requirements. It does not discharge your obligations as the organisation putting it to use.
What does genuine human oversight actually require under Article 14?
Not a human signature on every output. Article 14 of Regulation (EU) 2024/1689 requires that oversight is meaningful rather than nominal - systematic sampling of decisions, routing of exceptions above defined risk thresholds, periodic audit of decision patterns, and documented evidence that the reviewer has genuine authority to override. A process in which a human approves AI-generated outputs without the information or authority to challenge them does not satisfy Article 14. The documented controls matter as much as the controls themselves.
What does EU AI Act compliance actually cost for a mid-market organisation?
For an organisation with two to three high-risk AI systems, a reasonable initial estimate is £150,000 to £600,000, covering discovery and classification, remediation per system, legal and advisory fees, and the establishment of ongoing governance. Annual ongoing cost runs approximately £50,000 to £120,000. The comparison worth making: a single high-risk violation at 3% of €200 million in revenue is €6 million. A prohibited practice violation at 7% of the same revenue base is €14 million. The compliance programme costs less than one enforcement action.
