EU AI Act Readiness Starts With an Inventory, Not a Risk Assessment

The most common mistake organizations make when beginning an EU AI Act compliance program is starting with the risk assessment.

Risk assessment is Step 2. Step 1 is inventory.

You cannot classify the risk tier of an AI system you don't know you're running. You cannot implement Article 12 event logging on a tool that isn't in your system of record. You cannot assign human oversight responsibility for a deployment that lives on a developer's personal account and never went through procurement.

The EU AI Act's enforcement provisions, which take full effect August 2, 2026, create deployer liability — not just provider liability. If an employee in your organization is using an AI tool that wasn't sanctioned by IT, the organization can still be liable for the outcomes of that deployment. Shadow AI isn't just a security and cost governance problem under the EU AI Act. It's a legal exposure.

What EU AI Act readiness actually requires, in sequence:

First: A complete inventory of every AI system deployed in the organization, including unsanctioned tools detected through behavioral signals and spend data. You need to know what you're running before you can classify it.

Second: Risk-tier classification for each system in the inventory — prohibited, high-risk, limited-risk, or minimal-risk — based on use case, affected population, and the presence or absence of human oversight.

Third: Documentation of the technical characteristics of each high-risk system, as required by Article 11.

Fourth: Continuous event logging for high-risk deployments, as required by Article 12.

Fifth: Assignment of human oversight responsibility per system, as required by Article 14.

Most compliance programs that are struggling in mid-2026 are not struggling because of Steps 2 through 5. They're struggling because they never properly completed Step 1. Their inventory is incomplete, their shadow AI exposure is unquantified, and their spend data doesn't map to system-level documentation.

The compliance program that works starts with a complete, current, automatically maintained AI inventory. Everything else builds on that.

Does your organization have a complete AI inventory today — including tools that weren't formally provisioned by IT?