AI Act Compliance Roadmap: A 12-Month Infrastructure Plan for Enterprises

2 December 2027 is the deadline for high-risk AI system compliance under Annex III — postponed from the original August 2026 date by the EU's 2026 Digital Omnibus. Working backwards from December 2027, here's a 12-month infrastructure roadmap. Even with the extension, every month counts — 12-18 months is realistic for the full stack.

Months 1-2: Discovery and Classification

• AI system inventory — Identify every AI system in your organization (don't forget spreadsheet ML models and RPA bots)
• Risk classification — Map each system to AI Act risk categories. Get legal review for borderline cases
• Gap assessment — For each high-risk system, evaluate current compliance against Articles 8-15
• Infrastructure audit — What MLOps/governance infrastructure exists? What's missing?

Months 3-5: Foundation Infrastructure

• Model registry — Central inventory of all AI models with metadata, risk classification, and lifecycle status
• Data quality pipeline — Automated data validation, bias detection, and lineage tracking in your ML pipeline
• Logging infrastructure — Immutable, comprehensive logging of AI system events for record-keeping
• Monitoring foundation — Performance, fairness, and drift monitoring for deployed models

Months 6-8: Governance and Oversight

• Risk management system — Automated risk assessment integrated into the ML lifecycle
• Human oversight infrastructure — Review queues, confidence routing, kill switches for high-risk systems
• Explainability service — Explanation generation and serving for high-risk predictions
• Technical documentation automation — Auto-generated Annex IV documentation from development artifacts

Months 9-10: Testing and Validation

• Conformity pre-assessment — Internal dry run of conformity assessment for each high-risk system
• Adversarial testing — Robustness testing against the AI Act's accuracy and cybersecurity requirements
• End-to-end compliance testing — Verify the full chain: data governance → training → deployment → monitoring → incident response

Months 11-12: Conformity and Deployment

• Formal conformity assessment — Complete self-assessment (or notified body assessment for biometric systems)
• EU database registration — Register high-risk AI systems
• Declaration of conformity — Issue and maintain
• Post-market monitoring activation — Continuous monitoring system live and operational

The Infrastructure Partner's Role

Months 1-2 require regulatory expertise. Months 3-8 require platform engineering. Months 9-12 require both. An AI infrastructure partner provides the technical depth to build the platform AND the regulatory knowledge to ensure it satisfies the AI Act. Build capability, not dependency.