I have a confession: I maintained an EU AI Act compliance matrix for a client as a shared spreadsheet. It had conditional formatting. I was proud of it.
Then I actually read the amendments.
The deadline everyone built against moved
Here's the thing that surprised me most when I dug into this properly. A huge amount of third-party guidance, templates, and even paid tooling was written against the original Annex III timeline. Then the Digital Omnibus package pushed the high-risk obligations out to December 2027. If your risk register says "August 2026" anywhere in it, that row is now wrong.
I'm not going to pretend I caught this from careful reading. I caught it because I built a ruleset generator, fed it the dates, and the output disagreed with my own spreadsheet. That was humbling.
The classification part is genuinely hard
The Act's risk taxonomy is four buckets: unacceptable, high, limited, minimal. Sounds simple. It is not simple, because the buckets depend on what your system does, who it's for, and whether it touches any of the listed domains: employment decisions, credit scoring, education, biometrics, critical infrastructure, and so on.
A customer support chatbot is minimal risk. A chatbot that screens job applicants is high risk. Same model, same code, different bucket. The determining factor isn't the tech, it's the use case. Which means you can't classify a system by scanning its dependencies. You have to ask questions.
What I ended up building
I turned my spreadsheet into AIActRadar. You answer questions about what your AI system does, and it does three things:
- Classifies the system into the risk taxonomy
- Maps which obligations and deadlines apply to that classification
- Outputs a checklist of the high-risk requirements, with the dates attached
The checklist part is deterministic. Same answers, same output, every time. There's a model-assisted layer for the prose, but the classification and the obligation mapping don't depend on an LLM, because "the compliance tool hallucinated my obligations" is not a sentence I ever want to write or read.
What it is not
It does not issue a certificate. No automated tool can. It also doesn't replace a lawyer, and if you're building anything that scores humans (credit, hiring, exam grading), you should talk to one. What it gives you is a defensible starting point: which bucket you're in, what's attached to that bucket, and what's due when.
One thing worth checking today
Open whatever you use to track AI compliance and search for "2026". If the high-risk rows reference August 2026, they predate the omnibus amendments. Whether that matters depends on your systems and your market, but knowing your spreadsheet is stale is better than not knowing.
The tool is free to try: aiactradar.lxsaihub.com. If it classifies your system wrong, I'd genuinely like to know which answer led it astray.
Top comments (0)