10decodersThe Compliance Gap No One Is Talking About Loudly Enough
The EU AI Act is the most consequential AI regulation enacted to date. It applies to any organization placing an AI system on the EU market or putting it into service within the EU, regardless of where the organization is headquartered. A US healthcare company running an AI-assisted clinical decision tool for European patients is in scope. A Singapore fintech using an AI credit-scoring model for European applicants is in scope. Geographic distance from Brussels does not create legal distance from the regulation.
The compliance problem is not that enterprises do not know the regulation exists. It is that the work required to comply is harder than most legal and technology teams assumed when they first read the summary. Completing a formal AI system inventory, classifying each system by risk tier, producing Article 11 technical documentation, installing Article 14 human oversight mechanisms, and registering applicable systems in the EU database: this is a six-to-twelve month program for a mid-size enterprise, not a six-week checklist exercise. With August 2 fewer than five weeks away as of publication, teams that have not started are not going to finish. The question is how to triage what can still be done in time and what requires a documented risk position while remediation continues.
The six failures below are the most common points where enterprise compliance programs break down. None of them require a new AI model or a new vendor. All of them require someone in the organization to own them, with board-level visibility and a deadline that is not treated as negotiable.
"83% of organizations have not completed an AI system inventory. That is the starting line, not the finish line, for EU AI Act compliance."
The 6 EU AI Act Compliance Failures and What Each One Exposes You To
The first three failures create direct regulatory exposure: if a regulator audits your AI systems, these gaps will surface immediately. The second three are secondary compliance failures that compound the first group and make remediation significantly harder once enforcement begins.
| Compliance Failure | What Is Missing | Regulatory Exposure | Risk |
|---|---|---|---|
| No AI system inventory | No documented list of AI systems in production, development, or procurement across the organization | Cannot classify risk tiers, cannot demonstrate compliance, cannot respond to a regulatory inquiry | Critical |
| Missing technical documentation (Article 11) | High-risk AI systems lack the technical documentation required before deployment: design intent, training data, validation approach, performance limits | Deployment of an undocumented high-risk system is a direct Article 11 violation subject to maximum fines | Critical |
| No human oversight mechanism (Article 14) | AI-driven decisions in employment, credit, or clinical settings have no defined human override process | Article 14 requires that a human can intervene, stop, or reverse any high-risk AI decision. Absence means non-compliance from the moment of deployment. | Critical |
| No data governance controls on training data (Article 10) | Training datasets for high-risk AI systems have no documented quality controls, bias analysis, or data lineage records | Article 10 requires demonstrable data quality and bias management. Undocumented training data is an audit failure point. | Moderate |
| Missing transparency disclosures (Articles 13 and 52) | Users interacting with AI-generated content or AI-assisted decisions are not informed that AI is involved | Article 52 requires disclosure when AI generates or moderates content affecting users. Missing disclosures expose marketing, support, and content teams. | Moderate |
| No EU database registration pathway (Article 71) | High-risk AI systems under Annex III have no registration plan for the EU AI database maintained by the European Commission | Registration is a legal requirement for applicable high-risk systems. Operating without registration is a compliance gap that regulators can detect at any point post-enforcement. | Lower |
Not sure where your EU AI Act gaps are?
10decoders runs a structured AI compliance assessment across your active AI systems: inventorying deployed models, classifying risk tiers, identifying Article 11 documentation gaps, and producing a prioritized remediation plan with timelines your legal team can work with.
Book a Free AI Assessment →What High-Risk Actually Means and Why Most Teams Get It Wrong
The most common classification error in enterprise AI Act compliance programs is the assumption that "high-risk" means AI that could physically harm someone. That is not how the regulation works. The EU AI Act's Annex III defines high-risk by application area, not by severity of potential harm in isolation. An AI system used to screen job applicants is high-risk. A model that scores creditworthiness is high-risk. An AI tool that prioritizes patient treatment is high-risk. An algorithm that allocates social benefits is high-risk. None of these require a physical failure mode to carry full Article 9 through 17 obligations.
This misclassification is not a minor error. A system incorrectly classified as limited risk or minimal risk skips the entire compliance chain: no technical documentation, no human oversight mechanism, no data governance controls, no EU database registration. When that system is eventually identified as high-risk by a regulator, the organization is not just facing a gap in a compliance program. It is facing evidence that the system was in production without required safeguards, which is the worst possible posture for an enforcement conversation.
The 10decoders Zero-Trust Security Layer engagement always includes an AI Act risk classification step for clients operating in the EU or processing EU data. The standard we apply follows the four-question test: does the system fall under an Annex III category, does it significantly affect rights or safety, is it used in an area where regulatory oversight applies, and who bears responsibility as provider versus deployer? Answering these four questions correctly for every AI system in production is the fastest way to identify where full compliance obligations apply and where they do not.
Three Stages of EU AI Act Compliance Readiness
No inventory, no classification
The organization cannot name which AI systems are in production, let alone classify them. No technical documentation exists. Human oversight mechanisms are absent or informal. A regulator inquiry could not be answered accurately today.
Systems identified, gaps not yet closed
AI system inventory is complete. High-risk systems are identified. A gap analysis exists and a remediation timeline has been written. Article 11 documentation and Article 14 oversight mechanisms are in progress but not yet live.
Documentation live, oversight active
Technical documentation is complete for all high-risk systems. Human override mechanisms are operational. Data governance controls on training data are documented. Transparency disclosures are live. EU database registration is complete or in process.
The 8-Gate EU AI Act Compliance Checklist
Most enterprise teams are at Stage 1 with fewer than five weeks to August 2. The checklist below identifies the gates that can realistically be closed before the deadline and those that require a documented risk position while remediation continues.
"The EU AI Act deadline does not care whether your legal team is still reviewing the regulation. August 2 is the date that matters, not the date you finished reading the summary."
What to Do This Week
01 Run a two-hour AI system inventory workshop with your technology and legal leads
Pull together your CTO, Head of Legal, and the leads from your highest-risk business units for two hours. The goal is a complete list of every AI system the organization runs, procures, or embeds in its products. Include third-party tools. Include AI features inside existing SaaS platforms your teams use. Many organizations discover that their highest-risk AI exposure comes from a vendor's embedded model, not from a system their engineering team built. You cannot classify what you have not listed.
02 Apply the Annex III test to every system on that list before Friday
For each system on your new inventory, run through the Annex III categories: biometric identification, critical infrastructure management, education and training, employment and recruitment, access to essential services, law enforcement, migration and border control, administration of justice, and democratic processes. If a system touches any of these categories and EU residents or EU data are in scope, it is potentially high-risk and requires full Articles 9 through 17 compliance. Document your classification decision for each system now, not during a regulatory inquiry.
03 Identify which high-risk systems have zero Article 11 documentation today
For every system classified as high-risk, ask a direct question: does technical documentation exist that covers design intent, training data, validation approach, performance limits, and monitoring setup? If the answer is no, that system is in a non-compliant state under the EU AI Act from August 2 onward unless documentation is completed or the system is taken out of scope for EU operations. Knowing the gap is the first step to triaging what can be fixed before the deadline and what requires a risk acceptance decision by leadership.
04 Book a formal EU AI Act exposure review with legal counsel before August 2
The compliance work described in this checklist is ultimately a legal question, not just a technical one. A structured exposure review with counsel who knows the EU AI Act in detail will tell you which of your high-risk systems carry the most acute enforcement risk, whether the Digital Omnibus extension is likely to be formally enacted before August 2, and what a defensible risk position looks like for systems that cannot be fully documented in time. That conversation is worth having now, while you still have a few weeks to act on it.
Let 10decoders assess your EU AI Act exposure
We run a structured AI compliance audit across your active AI systems: inventorying deployed models, classifying risk tiers against EU AI Act Annex III criteria, identifying documentation and oversight gaps, and delivering a prioritized remediation plan your legal and technology teams can act on before the deadline.