EU AI Act: Your CISO Checklist for August 2

August 2 is 18 days away. On that date, the EU AI Act begins enforcing its most consequential obligations: the rules governing high-risk AI systems. Fines reach 35 million EUR or 7% of global annual turnover for the most serious violations. A 2026 industry survey found that 78% of organizations have taken no meaningful steps toward compliance.

Most CISOs I speak with know the date. Fewer know which of their AI systems qualify as high-risk. And fewer still have a documented compliance program that would survive a regulatory audit. That gap is the problem this article addresses.

What follows is a practical action plan for CISOs who need to close the gap before August 2, and for those who need to explain the situation clearly to their board.

What the EU AI Act Actually Covers

The EU AI Act (Regulation EU 2024/1689) has been in force since August 2024. The first enforcement milestone came in February 2025, when prohibitions on the most dangerous AI applications took effect - things like social scoring systems, real-time remote biometric surveillance in public spaces, and AI that exploits psychological vulnerabilities.

August 2, 2026 is the second and larger milestone. It activates obligations for high-risk AI systems under Chapters III and IV of the regulation. These are not fringe use cases. High-risk AI under Annex III includes:

• Biometric identification and categorization systems
• AI managing critical infrastructure - energy grids, water systems, transport networks
• AI used in education and vocational training decisions
• Employment and worker management tools - including CV screening and candidate ranking
• Essential private and public services - credit scoring, insurance pricing, access to financial products
• Law enforcement applications
• Migration, asylum, and border control systems
• Administration of justice

The scope surprises most organizations when they run a proper inventory. An ATS (Applicant Tracking System) that uses AI to rank candidates is likely high-risk. A credit scoring model is high-risk. A tool that determines whether a customer qualifies for a loan or insurance product is high-risk. Many organizations are running these systems without realizing the regulation applies to them.

What "High-Risk AI" Compliance Actually Requires

Articles 9 through 15 of the EU AI Act spell out the obligations for high-risk AI systems. For deployers - meaning organizations using these systems in their operations, not just building them - the core requirements are:

Risk management system (Article 9). A documented process for identifying, analyzing, and addressing risks associated with each high-risk AI system. This must be maintained and updated throughout the system's lifecycle, not just at the point of deployment.

Data governance (Article 10). For providers developing high-risk AI, training data must meet quality criteria. For deployers using vendor systems, you need to understand and document the data practices of the systems you deploy.

Technical documentation (Article 11). Documentation describing the system's intended purpose, capabilities, limitations, and performance must be maintained and available to authorities on request.

Transparency and information provision (Article 13). High-risk AI systems must be designed to allow deployers to interpret outputs and enable appropriate human oversight. The system's limitations and the conditions under which it may fail must be documented.

Human oversight (Article 14). Deployers must assign qualified individuals to oversee the system, with the authority and capability to intervene or override outputs. This is not a generic "AI ethics officer" requirement. It means a named person with specific responsibility for each system.

Fundamental rights impact assessment (Article 27). Deployers in the public sector, and private deployers in specific sectors, must complete a fundamental rights impact assessment before deploying a high-risk AI system.

None of these requirements can be satisfied by pointing at an AI ethics policy. They require documented processes, named individuals, and evidence of ongoing operation.

The 5-Step CISO Action Plan

With 18 days remaining before August 2, the window for a comprehensive compliance program is closed. What is still achievable is building the foundation that demonstrates good-faith compliance efforts and creates a defensible position for post-August regulatory interaction. Here is what to prioritize.

Step 1: Build the AI inventory. Before any classification or compliance work, you need to know what AI systems your organization is running. This includes internal builds, vendor software that includes AI features, SaaS platforms with embedded AI, and AI tools purchased by individual business units without central IT involvement. Shadow AI is common. Most organizations discover deployments during this exercise that leadership did not know about. The inventory needs to capture: system name, vendor, intended purpose, who owns it, what data it processes, and who makes decisions based on its outputs.

Step 2: Classify against Annex III. For each system in the inventory, run the Annex III classification. Does it touch biometrics? Employment decisions? Credit or insurance pricing? Critical infrastructure? The classification determines which systems require full high-risk compliance and which do not. Many organizations find they have three to eight high-risk AI systems when they run this exercise honestly.

Step 3: Assign named accountability. For each high-risk system, a specific person must be named as responsible for human oversight. This is not a committee or a department. The regulation contemplates an individual who has the authority and capability to intervene in the system's operation when needed. This is the step most organizations skip. A policy document without named individuals is not compliance.

Step 4: Document what you have, honestly. For each high-risk system, document the current state against Articles 9-15 requirements. Where documentation exists, consolidate it. Where it does not, note the gap. Regulators making enforcement decisions after August 2 will look at whether an organization had a genuine compliance program underway versus no effort at all. An honest gap analysis with a remediation timeline is a significantly stronger position than no documentation.

Step 5: Brief the board. The EU AI Act places legal accountability on the organization. That means the board needs to know: which high-risk AI systems the organization operates, what the compliance status is, what the open risks are, and who is responsible. This briefing should become a quarterly agenda item alongside cyber risk reporting.

What 78% of Organizations Are Missing

The clearact.net industry survey finding - 78% of organizations have taken no meaningful steps toward compliance - points to three specific gaps that appear consistently.

The first is the inventory gap. Organizations simply do not know what AI systems they are running. This is partly a Shadow AI problem: business units deploy AI tools without involving IT or legal. It is also partly a vendor problem: AI features arrive inside existing software products through updates, without explicit procurement decisions. The inventory does not exist, so nothing else can be built on top of it.

The second is the accountability gap. Even organizations that have governance policies in place typically cannot name who is responsible for each high-risk AI system's compliance. The policy names a department or committee. The EU AI Act requires a person. That distinction becomes critical when something goes wrong.

The third is the documentation gap. Risk management systems, fundamental rights impact assessments, technical documentation - these are not retrospective exercises. They need to be in place before the system operates. Organizations that deploy an AI system and document it afterward are not compliant; they are creating records after the fact.

The Brussels Effect: Why Non-EU Companies Are Also Affected

The EU AI Act has extraterritorial reach that mirrors the GDPR approach. If your AI system is placed on the EU market, used by EU-based deployers, or affects people located in the EU, the Act applies regardless of where your organization is headquartered.

For US and Israeli companies operating in Europe, this means the August 2 deadline is not a European internal matter. A US-based HR software vendor whose product is used by European companies to screen job applicants is providing a high-risk AI system under the EU AI Act. The vendor's obligation is to ensure the system meets Articles 9-15 requirements. The deployer's obligation is to ensure the vendor has done so.

The Brussels Effect - the documented tendency for EU regulations to become de facto global standards as multinational companies adopt a single highest-standard approach - is already operating here. Large enterprises with global operations are building EU AI Act compliance into their AI governance programs globally, because maintaining separate compliance postures by jurisdiction is operationally expensive.

After August 2: What Enforcement Looks Like

National supervisory authorities in each EU member state are responsible for enforcing the AI Act within their jurisdiction. Member states were required to designate their authorities by August 2025. Enforcement will initially focus on providers and deployers of high-risk AI systems in regulated sectors, where supervisory infrastructure already exists - financial services, healthcare, critical infrastructure.

Enforcement under new regulations typically begins with investigations triggered by incidents or complaints rather than proactive audits of every organization. The practical implication: the risk is highest for organizations that deploy high-risk AI systems and face a harm, complaint, or incident that draws regulatory attention. At that point, the question becomes whether you can demonstrate a functioning compliance program - not whether you filed a policy document.

For CISOs, this means the goal of the next 18 days is not perfect compliance. It is building enough of the foundation - the inventory, the classification, the named accountability, the documented gap analysis - that you can make a credible case for good-faith compliance efforts if enforcement attention comes your way.