I have a confession: I maintained an EU AI Act compliance matrix for a client as a shared spreadsheet. It had conditional formatting. I was proud of it.
Then I actually read the amendments.
30-second takeaway
- Dec 2027 — high-risk AI Act obligations actually land, not Aug 2026 (Digital Omnibus amendment; re-check the current text before you rely on it)
- 1 of the 3 compliance spreadsheets I reviewed still said August 2026 — three is not a sample, but it is a warning (my own review, n=3)
- 0 hallucinations in the classification layer (model-assisted prose only)
- 4 risk buckets that actually matter: unacceptable, high, limited, minimal
(Confession: my own spreadsheet said Aug 2026 too. I caught it because my ruleset generator disagreed with me.)
(Caveat: no automated tool issues certificates. You still need a lawyer for humans-scoring systems.)
The deadline everyone built against moved
Here's the thing that surprised me most when I dug into this properly. A huge amount of third-party guidance, templates, and even paid tooling was written against the original Annex III timeline. Then the Digital Omnibus package pushed the high-risk obligations out to December 2027. If your risk register says "August 2026" anywhere in it, that row is now wrong.
I'm not going to pretend I caught this from careful reading. I caught it because I built a ruleset generator, fed it the dates, and the output disagreed with my own spreadsheet. That was humbling.
The classification part is genuinely hard
The Act's risk taxonomy is four buckets: unacceptable, high, limited, minimal. Sounds simple. It is not simple, because the buckets depend on what your system does, who it's for, and whether it touches any of the listed domains: employment decisions, credit scoring, education, biometrics, critical infrastructure, and so on.
A customer support chatbot is minimal risk. A chatbot that screens job applicants is high risk. Same model, same code, different bucket. The determining factor isn't the tech, it's the use case. Which means you can't classify a system by scanning its dependencies. You have to ask questions.
What I ended up building
I turned my spreadsheet into AIActRadar. You answer questions about what your AI system does, and it does three things:
- Classifies the system into the risk taxonomy
- Maps which obligations and deadlines apply to that classification
- Outputs a checklist of the high-risk requirements, with the dates attached
The checklist part is deterministic. Same answers, same output, every time. There's a model-assisted layer for the prose, but the classification and the obligation mapping don't depend on an LLM, because "the compliance tool hallucinated my obligations" is not a sentence I ever want to write or read.
What it is not
It does not issue a certificate. No automated tool can. It also doesn't replace a lawyer, and if you're building anything that scores humans (credit, hiring, exam grading), you should talk to one. What it gives you is a defensible starting point: which bucket you're in, what's attached to that bucket, and what's due when.
One thing worth checking today
Open whatever you use to track AI compliance and search for "2026". If the high-risk rows reference August 2026, they predate the omnibus amendments. Whether that matters depends on your systems and your market, but knowing your spreadsheet is stale is better than not knowing.
The tool is free to try: aiactradar.lxsaihub.com. If it classifies your system wrong, I'd genuinely like to know which answer led it astray.
FAQ
What is AIActRadar?
I turned my spreadsheet into AIActRadar. You answer questions about what your AI system does, and it does three things:
Why does "The deadline everyone built against moved" matter?
Here's the thing that surprised me most when I dug into this properly. A huge amount of third-party guidance, templates, and even paid tooling was written against the original Annex III timeline. Then the Digital Omnibus package…
Is AIActRadar free to try?
The tool is free to try: aiactradar.lxsaihub.com.
Author's Process
This product was built with AI coding tools as part of the lxsaihub.com portfolio. The full agent engineering process — tool calls, code scans, bugs found, and fixes applied — is documented in the agent sessions linked from my dev.to profile.
References
- EU AI Act (Regulation 2024/1689) — The official regulation text — obligations, tiers, and deadlines this tracker watches.
Top comments (0)