A risk-based rulebook for how AI is built and run in the EU. Teams classify use cases, map roles, choose a conformity path, prepare a technical file (purpose, data, tests, oversight, security), and monitor after launch with logs, incidents, and periodic reviews.

Most focused products reach initial readiness in 2–3 months. That covers scoping, risk tiering, conformity route, a technical file foundation, core testing evidence, and a basic post-market plan. Broader portfolios or multiple high-risk use cases take longer.

Now. Readiness work stacks up fast — data mapping, test design, evidence generation, and process updates. Leaving it until late compresses tasks, raises cost and delivery risk, and can block enterprise deals or market entry.
Late starts often lead to incomplete technical files, rushed testing, limited availability for external reviews, and slower procurement cycles, making it hard to “do everything in a day.” Starting early spreads effort, reduces rework, and keeps launch or sales timelines on track.

Yes. If EU users can access or use the system, the rules apply. Non-EU firms may need an EU representative and must meet the same documentation, testing, transparency, and monitoring duties.

Think impact and context. High-risk often means: consequential decisions, vulnerable users, autonomous operation, bias potential, or fundamental-rights impact. If several apply, treat it as high-risk until assessed.

It depends on the chosen route. Many high-risk systems can use internal control when aligned to standards and backed by a QMS. Third-party review is needed when standards aren’t used, when tied to other product laws, or when the route requires it.

Before: classify risk and roles, pick the route, build the technical file (data governance, testing, oversight, security), set instructions.
After: track KPIs and drift, handle incidents and feedback, run CAPA and controlled retraining, keep evidence up to date.