In short. A gap analysis for the EU AI Act compares what the AI regulation requires of your company with what you can show today. It has five steps: AI inventory, role and risk class, obligations, gaps and roadmap. The deadlines changed this summer. Since the Digital Omnibus, the obligations for high-risk AI under Annex III apply from December 2, 2027, and for AI in regulated products from August 2, 2028. Some rules already apply today, though: the prohibitions, AI literacy and the labelling duties under Article 50. The next deadline is December 2, 2026.
What a gap analysis for the AI Act is
The AI regulation, Regulation (EU) 2024/1689, does not use the term gap analysis. What it means in practice is a comparison in two columns. On the left are the obligations that apply to your AI systems. On the right is what you can show for each of them today. Whatever is missing on the right is a gap.
The analysis produces three results: a list of all AI systems with role and risk class, a list of gaps, and a roadmap with dates and owners. A gap analysis is not a certification and not a legal opinion. It is a stocktake that management, IT, data protection and the business units carry out together. For tricky individual questions, such as whether a particular system is high-risk, bring in legal advice.
EU AI Act deadlines as of November 2026
On July 27, 2026, the Digital Omnibus entered into force, Regulation (EU) 2026/1744. It rebuilt the AI Act timetable a few days before the high-risk obligations were due to apply on August 2, 2026. The chart shows what applies when.
When each obligation applies, timeline 2025 to 2028
Two dates are new. From December 2, 2026, two additional prohibitions apply: AI that generates intimate depictions of real people without consent, and AI for child sexual abuse material. On the same day a grace period ends. Providers of systems that generate text, images, audio or video and were already on the market before August 2, 2026 must mark their outputs in a machine-readable way by then.
For high-risk systems there is a legacy rule. If a system was placed on the market or put into service before the relevant date, the new obligations only apply if its design is significantly changed afterwards (Art. 111(2)). Whether a vendor update counts as such a change is best clarified early with the provider.
The five steps of the gap analysis
Step 1: AI inventory, which AI runs where
Record every AI system in the company, including the ones nobody calls AI. That covers your own applications, AI features in purchased software, for example in applicant management, CRM or accounting, assistants such as ChatGPT or Microsoft Copilot, and private accounts that employees use for work. Ask the business units and purchasing, not just IT.
At the start, a few fields per system are enough: name and vendor, purpose, business unit, who makes decisions based on the results, which data goes in, since when it has been running and who owns it internally. A spreadsheet will do. What matters is that it is kept up to date: every new AI system gets a row before it goes live.
Step 2: determine role and risk class
For each system, ask two questions. The first: what is your role? A provider is anyone who develops an AI system or has it developed and places it on the market or puts it into service under their own name (Art. 3(3)). A deployer is anyone who uses a system under their own authority in a professional context (Art. 3(4)). Most mid-sized companies are deployers. But if you build your own chatbot on top of a language model and offer it under your own name, you are usually the provider for it. Under Article 25 you also become the provider of a high-risk system if you put your name on it, modify it substantially, or use a system for a purpose that makes it high-risk.
The second question: which class does the system fall into? The regulation has four tiers.
- Prohibited (Art. 5). For example social scoring or inferring emotions in the workplace, except for medical or safety reasons.
- High-risk (Art. 6). AI as a safety component in products under Annex I, such as machinery or medical devices. Or a use case from Annex III, such as selecting applicants, decisions about employees or the creditworthiness of private individuals.
- Subject to transparency duties (Art. 50). Chatbots, generated images, audio, video and text, emotion recognition and biometric categorisation.
- Everything else. Here, only AI literacy applies.
Be careful with the exception in Article 6(3). Under it, a system listed in Annex III is not considered high-risk if it poses no significant risk and does not materially influence the outcome of a decision. The provider must document this assessment beforehand and register the system (Art. 6(4)). If your vendor relies on it, ask to see the assessment.
Step 3: assign obligations
Role and class determine the obligations. The table shows the most important ones for mid-sized companies.
| Obligation | Applies to | From | Typical evidence |
|---|---|---|---|
| No prohibited practices (Art. 5) | everyone | Feb 2, 2025, two new prohibitions from Dec 2, 2026 | review note per system in the register |
| Support AI literacy (Art. 4) | providers and deployers | Feb 2, 2025, reworded since Jul 27, 2026 | training plan, attendance, policy for staff |
| Notice for chatbots, machine-readable marking (Art. 50(1), (2)) | providers | Aug 2, 2026, older systems by Dec 2, 2026 | notice in the dialogue, technical description |
| Disclose deepfakes and AI text on public-interest matters (Art. 50(4)) | deployers | Aug 2, 2026 | rule for publications |
| Deployer obligations for high-risk AI (Art. 26) | deployers | Dec 2, 2027, Annex I Aug 2, 2028 | named oversight, logs, information for staff |
| Fundamental rights impact assessment (Art. 27) | public bodies, private entities providing public services, credit scoring and health and life insurance pricing | Dec 2, 2027 | assessment, notification to the authority |
| Provider obligations for high-risk AI (Art. 9 to 17, 43, 49) | providers | Dec 2, 2027, Annex I Aug 2, 2028 | risk management, technical documentation, conformity assessment, registration |
For deployers of a high-risk system, Article 26 sets out seven core tasks: use the system according to the instructions for use, assign oversight to people with the necessary competence and authority, make sure input data is appropriate where you control it, monitor operation and report risks, keep automatically generated logs for at least six months, inform worker representatives and affected employees in advance, and inform affected people about the use. What providers have to do on top of that is covered in our post on risk management under Article 9.
Step 4: assess the gaps
Now comes the actual comparison. For each system and obligation, record what exists today: met, partly met or missing. Only count something as met if you can back it up with a document you would also show to an authority. A training session without an attendance list is a gap.
Weight each gap by two factors: how close the deadline is and how high the fine could be. Article 99 sets the fines in three tiers.
Maximum fines under Article 99 of the AI Act
In Germany, the Federal Network Agency (Bundesnetzagentur) has been the supervisory authority since July 29, 2026. This is set out in the German AI market surveillance act, the KI-MIG. For AI in products such as machinery or medical devices, the existing market surveillance authorities remain responsible, and for AI in regulated financial services, BaFin. In other EU countries, check which national authority has been designated.
Step 5: build the roadmap
The roadmap orders the gaps by deadline. A sensible sequence looks like this:
- By December 2, 2026. Check every system against the prohibitions, including the two new ones. Settle the AI notice for your own chatbots and the labelling of generated content, for voice agents on the phone as well as in chat.
- Ongoing from now. Support AI literacy with role-based training and a short policy, and keep records. Keep the register up to date.
- By mid-2027. For every high-risk system, request the instructions for use and documentation from the provider, name the people responsible for oversight, set up logging and involve the works council.
- By December 2, 2027. Meet the obligations for high-risk AI under Annex III, including a fundamental rights impact assessment where required. You may reuse parts of an existing data protection impact assessment there.
- By August 2, 2028. Bring AI in your own products under Annex I into conformity. This mainly affects manufacturers of machinery and medical devices.
Every item gets an owner and a date. Repeat the analysis at least once a year and whenever you buy a new AI system. The rules will keep being supplemented, for example by Commission guidelines.
Checklist: what you should do now
- Name an owner. Someone has to hold the AI rules together in the company, usually together with data protection and IT.
- Set up the AI register. All systems, including AI in purchased software and privately used accounts.
- Check every system against the prohibitions. Including the two new prohibitions from December 2, 2026.
- Record role and risk class. If in doubt, request the provider's assessment.
- Document AI literacy. Role-based training, attendance, a short policy for staff.
- Put dates on the roadmap. With milestones up to December 2027 and August 2028, reviewed every year and with every new AI system.
Frequently asked questions about the AI Act gap analysis
Does every company need an AI Act gap analysis?
It is not mandatory. But every company that uses AI professionally is a deployer and must, for example, support the AI literacy of its people. Without an overview of your own systems, you cannot show that you know your obligations. A gap analysis is the shortest route to that overview.
Does the AI Act apply if we only use ChatGPT or Copilot?
Yes, as a deployer. For normal office use it usually comes down to AI literacy. On top of that comes disclosure if you publish deepfakes, or AI text on matters of public interest without editorial review. Things change if you use the tool for a purpose listed in Annex III, for example to sort job applications. The system can then become high-risk and, under Article 25, make you its provider.
What did the Digital Omnibus change in the AI Act?
Regulation (EU) 2026/1744 has applied since July 27, 2026. It postponed the high-risk deadlines, to December 2, 2027 for Annex III and to August 2, 2028 for Annex I. It added two prohibitions and softened the AI literacy obligation: companies must take measures but do not have to guarantee a particular level. Small and medium-sized enterprises and small mid-caps get relief, among other things on fines.
Who enforces the AI Act in Germany?
Since July 29, 2026, the Federal Network Agency, as laid down in the KI-MIG. Exceptions apply to AI in products such as machinery or medical devices, where the existing market surveillance authorities remain responsible, and to AI in regulated financial services supervised by BaFin.
A gap analysis does not turn into a big project if you start with the inventory and align the rest with the deadlines. If you would like a second pair of eyes on your list, we are happy to look at it together.
