The Manual Arrives After the Product

The feature went live on a Tuesday, behind a toggle, in a two-week sprint. A ranking model decided which applicants a recruiter saw first. It worked, the conversion number moved, and nobody in the room had read Regulation (EU) 2024/1689, because most of them had never heard of it. That is the normal order of events. A product is built, sold and deployed, and then the rule that governs it is written and dated afterwards. The AI Act entered into force on 1 August 2024. Its obligations arrive in waves: 2 February 2025, 2 August 2025, 2 August 2026, 2 August 2027, 2 August 2030. Every one of those dates lands on a product that is already in customers' hands. I have signed a EUR 20 million personal guarantee. The company folded on Christmas Day 2008. Nobody handed me a document explaining what that signature was worth at the moment I made it, and no regulator had written one yet. The paperwork arrived later, and it arrived as a bill. That is what risk-based regulation does to a company that treats compliance as a filing exercise instead of an engineering one. It prices the thing you already built.

The classification is not about the technology. It is about the use. A model that summarises internal meeting notes sits in the minimal tier, with no specific obligations beyond voluntary codes of conduct. The same model, pointed at CVs, sits inside Annex III under employment, listed alongside biometrics, critical infrastructure, education, credit scoring, law enforcement, migration, justice and democratic processes. Four tiers exist. Prohibited practices are banned outright: social scoring, manipulative techniques, emotion recognition in workplaces and schools, real-time remote biometric identification in public spaces, with narrow exceptions. High-risk carries the full compliance build. Transparency risk covers chatbots, deepfakes, emotion recognition and biometric categorisation, with duties to tell people they are dealing with a machine and to label synthetic content. Everything else is minimal and unregulated in substance. A team can spend a year on model quality and never ask the only question that determines the cost. What does this output decide, and who is affected when it is wrong. A recruitment ranking is not a chatbot. It is a decision about a person's income. The text does not care what the team intended.

Two sets of obligations are live, and they are the ones most companies have never opened. Since 2 February 2025, the prohibited practices in Article 5 are banned with no grandfathering, and AI literacy duties apply to every provider and deployer. The ceiling behind that tier is EUR 35 million or 7 per cent of total worldwide annual turnover, whichever is higher. Since 2 August 2025, obligations for general-purpose AI models apply, national competent authorities have to be operational, and the penalty regime is active. That tier runs to EUR 15 million or 3 per cent of turnover. Enforcement is not theoretical. Germany designated the Federal Network Agency. France designated CNIL. Most member states completed their designations by August 2025, and cross-border cases coordinate through the European AI Office. The model copies the GDPR: a complaint can come from a customer, a competitor, or the authority acting on its own initiative. A company that builds on top of a general-purpose model may inherit provider obligations, depending on what it does with the output. That single sentence is the reason to build the inventory this quarter rather than in July.

On 19 November 2025, the European Commission proposed the Digital Omnibus on AI. It would delay Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded obligations to 2 August 2028. The European Parliament adopted its position in March 2026 with 569 votes in favour. Trilogue negotiations are running toward a target political agreement of 28 April 2026. None of that changes the law today. Article 113 sets the Annex III date at 2 August 2026 and the Annex I date at 2 August 2027. Until the Omnibus is formally adopted, those stay operative, and the advice from Orrick, WilmerHale and DLA Piper is to keep planning against the original dates. I restructured a EUR 75 million industrial group, and every deadline in that process was real. The ones that moved moved because someone filed the extension, not because someone assumed it. So plan for August 2026. If the delay passes, you gain a year you did not spend. If it does not, you are already finished. That asymmetry only works in one direction. The proposal is worth tracking. It is not worth planning on.

It prices the thing you already built.

Article 99 sets three tiers: up to EUR 35 million or 7 per cent of turnover, up to EUR 15 million or 3 per cent, and up to EUR 7.5 million or 1 per cent for giving incorrect, incomplete or misleading information to a notified body or a national authority. Then Article 99(6) adds one sentence that a lot of small companies read as an exemption. For SMEs, the fine is the lower of the two figures, not the higher one. A company with EUR 2 million of revenue faces a maximum of EUR 140,000 at the 7 per cent rate, not EUR 35 million. At EUR 100 million of revenue, the 3 per cent rate lands at EUR 3 million. Turnover is counted at group level, not entity level. SME status needs fewer than 250 employees together with turnover of EUR 50 million or less, or a balance sheet of EUR 43 million or less. The Digital Omnibus would extend the SME benefits to small mid-caps of up to 499 employees and EUR 100 million of turnover. That is proposed, not enacted. The obligations do not shrink with the company. Risk management, technical documentation, logging and human oversight are the same for everyone. The fine is smaller. The work is not.

Annex IV lists the technical documentation: system architecture, design choices, the development process, intended purpose, performance metrics, limitations, and instructions for use. The purpose of the file is that an authority can assess the system without reverse-engineering it. Article 9 requires a risk management system that runs continuously through the lifecycle, not a one-time checklist. Article 10 sets the data governance bar: training, validation and testing data that is relevant, representative and complete, with bias detection records and provenance linking datasets to model versions. Article 12 requires automatic logging of inputs, outputs, decision points and operator identity, with a minimum retention of six months. Article 14 requires human oversight designed into the system, including a documented way to interrupt or stop it. Article 43 puts the conformity assessment before market placement: internal self-assessment against Annex VI for most Annex III systems, third-party assessment by a notified body for Annex I products. Article 49 requires registration in the EU database before the system goes to market. Article 72 requires post-market monitoring with periodic review reports. Deployers carry a separate list under Article 26: oversight measures, log retention, fundamental rights impact assessments for certain uses, and notification of workers before AI is deployed in an employment context. Incident reporting has three windows. 15 days for a serious incident. 2 days where critical infrastructure is disrupted. 10 days where a death is involved. A log either exists or it does not. No amount of September writing produces a February record.

The obligations are published. The dates are published. The penalty ceilings are published. The list of national authorities is published. The only thing that is not published is which of them apply to your product, and that is a question about your own code. I have built companies across twelve countries. The compliance failures I watched were never caused by a rule nobody could find. They were caused by a rule nobody had read. The probability that a company shipping AI today can name the risk category of every system it operates is not high. Most are pricing it at zero. That gap is not information, because the information is free. The gap is inventory. The regulation is not the manual for the product you intend to build. It is the manual for the product you already shipped. That is why it arrives late, and that is why it costs. What this piece describes are published provisions of Regulation (EU) 2024/1689 as verified on 22 April 2026. It is not legal advice. The only authority on any obligation is the regulation text itself and the national competent authority that administers it.