Module 1 — The Map, and the Timetable That Actually Applies

Module 1 of the AI Act Compliance certification: who owes what across the roles, what is in force today after the Digital Omnibus, and how to sequence a programme against real dates.

Before any gap analysis, two maps: who owes what, and when. Getting the second wrong is the more expensive error, because it sends a programme at the part of the Regulation that is not yet due while the parts already in force go unaddressed.

The roles, and what each owes

Two structural facts a compliance officer should internalise.

Almost every organisation is a deployer and nothing else. Almost all published guidance is written for providers. That mismatch is the single largest source of wasted effort in this area.

Roles are per system, not per organisation. The same company can be the provider of one system, the deployer of a second, and the distributor of a third. The register in Module 2 records the role per system for exactly this reason.

The timetable, post-Omnibus

Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was published on 24 July 2026 and entered into force on 27 July 2026. It moved dates and rewrote Art. 4. Anything written before then needs re-checking.

Read that table as a compliance officer rather than as a lawyer. Everything above 2 December 2027 is already enforceable. Everything at or below it is preparation.

What the deferral did and did not change

It did not remove any obligation. Annex III systems are still high-risk; the requirements are unchanged; only the application date moved.

It did not touch Art. 50, which is why an organisation with no high-risk system at all may still owe something today.

It did rewrite Art. 4 from a duty of result — ensure a sufficient level of AI literacy — to a duty of means: take measures to support the development of AI literacy, with the text stating expressly that it does not require guaranteeing any specific level for any individual. Module 3 works through what that changes about evidence.

It did create breathing room that is shorter than it looks. The artefacts required for a December 2027 deadline — a risk management system running as a process, an Annex IV file with contemporaneous design rationale, a monitoring plan with history — cannot be produced in the last quarter before the date. They accumulate or they do not exist.

Sequencing a programme

In order, and justified by the timetable rather than by tidiness:

1. Inventory. Nothing else is possible first. Module 2.
2. Art. 5 across the inventory. In force since February 2025, highest fine band under Art. 99(3) at 35 million euro or 7%, and it catches ordinary corporate deployments — emotion inference in the workplace above all.
3. Art. 50 across the inventory. In force since August 2026, tier-independent, and two of the four duties sit on deployers.
4. Art. 4 literacy programme and register. In force, cheap, and it feeds Art. 26(2) later. Module 3.
5. Classification, written down. With the date and the legal baseline.
6. Governance gates. Procurement, purpose change, modification. Module 4. This is where future problems stop being created.
7. Chapter III artefacts for whatever turned out to be high-risk, against December 2027.

Steps 2 to 4 are the enforceable exposure today. Step 6 is the highest-leverage work. Step 7 is the largest.

Enforcement, and who turns up

AI systems are enforced by the national market surveillance authority designated by each Member State, with the powers of the market surveillance framework behind them.

GPAI models are enforced centrally by the Commission through the AI Office, with fines under Art. 101 at up to 3% of worldwide annual turnover or 15 million euro.

Individuals may lodge a complaint with a market surveillance authority under Art. 85, and Art. 87 brings reporting of AI Act infringements within the Union whistleblower protection framework. Module 6 covers both.

Fines for other operators sit in Art. 99: 35 million euro or 7% for Art. 5 breaches; 15 million or 3% for the operator obligations including Art. 26; 7.5 million or 1% for supplying incorrect, incomplete or misleading information. Art. 4 appears in none of those bands — a fact worth knowing before budgeting a literacy programme on the basis of a fine that does not exist.

Check yourself

1. Nothing applies to us until December 2027. — Wrong. Art. 5 and Art. 4 since February 2025, Chapter V since August 2025, Art. 50 since August 2026.
2. We are a provider because we bought and configured a system. — Configuring is not developing. You are a deployer unless one of the Art. 25 triggers fires.
3. We should appoint an AI officer because the Regulation requires it. — It does not. Naming an owner is how work happens, not a statutory duty.
4. Art. 4 carries a large fine, so it is our first priority. — Art. 4 carries no fine band of its own. It is a priority because it is cheap, in force, and feeds Art. 26(2), which does.

Next: Module 2 — Inventory and classification register →