The High-Risk Triage: What the EU AI Act’s August 2026 Deadline Actually Forces

Sometime this month, your legal team will ask for a live inventory of “high-risk” AI systems. If your answer is “we’ll get back to you,” you have handed them a blank check and your delivery teams a stop-work order.

The EU AI Act’s high-risk obligations became enforceable on August 2, 2026. That is not a policy debate anymore; it is an operating constraint. The CIO’s job is not to become a compliance officer. It is to make triage decisions fast enough that compliance does not become a freeze.

The first gate: does the AI decide about people?

Employment, credit, education, essential services, biometric identification, and law enforcement are the default high-risk zones. If your system makes or materially influences decisions about people in those areas, treat it as high-risk until proven otherwise. Everything else goes to the second gate.

The second gate: can you redesign out of scope?

A surprising number of “high-risk” systems are high-risk only because the human is a rubber stamp. If you move the AI to assistive mode — the human reviews options and makes the final call — many use cases drop below the threshold. That redesign costs far less than conformity assessment, logging, and monitoring. Do it wherever the business can stand a human in the loop.

The third gate: is the remaining high-risk value worth the cost?

If a system cannot be redesigned and must remain high-risk, force the product owner to defend the economics. Conformity assessment, technical documentation, human oversight, and post-market monitoring are not one-time tasks; they are permanent operating costs. If the value does not clear that bar, retire the system or replace it with deterministic rules.

What I would do this week

Produce a one-page register with four columns: system, classification, redesign option, and owner decision. Review it with legal and business owners in the same room. Anything still “undecided” after that meeting is your real exposure.

Compliance is not a technology problem. It is a portfolio prioritization problem disguised as a regulation.