EUAIActreadiness,builtintotheplatform.
High-risk obligations apply from 2 December 2027 for stand-alone Annex III systems and from 2 August 2028 for systems embedded in regulated products. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. The question for AI teams is what you must prove: classification, logging, human oversight, and technical documentation. NeuroCluster generates that evidence as a by-product of running your workflows.
The timeline — and what the Digital Omnibus changes
The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026. Prohibitions applied from 2 February 2025 and GPAI model obligations from 2 August 2025.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026. It sets Chapter III high-risk rules to 2 December 2027 for systems under Article 6(2) and Annex III, and to 2 August 2028 for systems under Article 6(1) and Annex I. The Omnibus changes those dates, not the duties: classification, logging, oversight, and documentation stay the same.
Practically, this means the organizations that treat the deferral as extra runway to build compliant infrastructure will be ready either way — and the ones that treat it as a reason to pause will repeat the same scramble a year later.
Provider vs deployer: which obligations are yours
Most enterprises are deployers, not providers: you use AI systems under your own authority rather than placing them on the market. Deployer obligations under Article 26 include using systems per the provider's instructions, assigning competent human oversight, ensuring input data is relevant, monitoring operation, and retaining automatically generated logs.
The trap is that fine-tuning a model or substantially modifying a high-risk system can shift you into provider territory — with conformity assessment, technical documentation, and CE-marking obligations. Classification of each use case, before production, is where compliance work actually starts.
How NeuroCluster maps to AI Act requirements
NeuroCluster is not a compliance document generator bolted onto someone else's model API. The controls the Act asks for are properties of the runtime itself:
- Logging (Art. 12/26): every agent action, model call, retrieval, and tool invocation is recorded deterministically — logs exist because the platform cannot act without producing them.
- Human oversight (Art. 14/26): policy gates require named human approval before high-risk actions execute; approvals are recorded with identity and timestamp.
- Technical documentation (Art. 11): deployment snapshots capture model versions, prompts, policies, and data sources per workflow — exportable as an evidence pack.
- Risk management (Art. 9): use-case-scoped policies, classification-aware retrieval, and tenant isolation bound what a system can reach, so risk analysis maps to enforced controls rather than intentions.
- Data governance (Art. 10): governed data access with row-level policies and lineage from output back to source.
Evidence packs: what you hand the auditor
When an internal auditor, regulator, or procurement reviewer asks "prove your AI system operates under control", NeuroCluster exports an evidence pack: the deployment snapshot, the policies in force, the approval history, and the complete action log for the period under review.
This is the difference between compliance as a quarterly documentation project and compliance as a property of infrastructure. Teams running on general-purpose cloud AI APIs reconstruct this evidence manually; teams on NeuroCluster export it.
The EU AI Act readiness checklist
A 40-point, print-ready checklist covering classification, deployer obligations, logging, human oversight, technical documentation, and vendor evidence — the working document our assessment starts from.
Frequently asked questions
Does the Digital Omnibus mean we can wait until 2027?
No. The Omnibus is in force, and it moves the high-risk dates to 2 December 2027 and 2 August 2028. It does not change the requirements. Classification, logging, human oversight, and documentation take months, and the rest of the Act has applied since 2 August 2026.
Are we a provider or a deployer under the AI Act?
If you use AI systems under your own authority you are typically a deployer (Article 26 obligations). If you develop a system, place it on the market, or substantially modify a high-risk system — including some fine-tuning scenarios — you can take on provider obligations. Classify each use case with legal and compliance before production.
Which enterprise AI use cases count as high-risk?
Annex III covers, among others: AI in critical infrastructure operation, employment and worker management (CV screening, performance evaluation), access to essential services (creditworthiness, insurance pricing), education, and law enforcement. If a system influences decisions about people's access to jobs, credit, or services, treat it as a high-risk candidate until classified otherwise.
Does using NeuroCluster make us AI Act compliant?
No platform can make you compliant by itself — compliance depends on your use cases, classification, and processes. What NeuroCluster does is make the technical controls the Act requires (logging, human oversight, documentation, data governance) native properties of the runtime, and export the evidence reviewers ask for.
How do we start?
A 30-minute readiness assessment: we map your intended use cases against the Act's risk categories, identify which obligations apply, and show how the required evidence would be generated on your infrastructure.
Keep evaluating
EU AI Act compliance guide
The full pillar guide: timeline, risk categories, and the three pillars of technical compliance.
High-risk AI systems explained
Which Annex III categories catch enterprise use cases, with examples.
Trust Center: AI Act readiness
Security controls, data residency, and procurement materials for vendor review.
Case study: municipality under BIO BBN2
Permit processing with governed agents in a Dutch municipality.
Free FRIA template
Who needs a Fundamental Rights Impact Assessment, and a structured template.
Bring us one operational problem.
You do not need a finished brief. Bring the problem — we will work out the next step together.
Or book a call with the team