AI Act readiness in 90 days: a practical plan
Adopted 2026-06-22 · ≈ 2 min read · 
edited by Dirk Baaijen
A concrete 90-day plan to build AI Act readiness, split into three one-month phases: inventory and classify, close the gaps, and embed governance with ongoing oversight.
Short answer: Ninety days won't make you "done forever", but it does lay a solid base. Split it into three monthly blocks: month 1 get visibility, month 2 close gaps, month 3 embed governance. The goal is demonstrable control, not false perfection.
Month 1 — Visibility and classification
Start by inventorying: build a register of every AI system, its function, vendor and business process. For each system determine your role (provider or deployer) and place it in the risk pyramid. Flag anything potentially prohibited or high-risk straight away — that is where your urgency lies. Assign an owner and ensure baseline AI literacy among the people using the systems.
Month 2 — Close the gaps
Run a gap analysis: for each high- and limited-risk system, set the legal requirements against what you already have. Tackle the largest shortfalls first — usually technical documentation, logging, transparency notices and human oversight. High-risk uses carry the heaviest package; see the high-risk obligations overview. Lock down vendor arrangements where you depend on bought-in AI.
Month 3 — Embed and oversee
Lift one-off actions into a structure: capture roles, decision-making and monitoring in an AI governance framework. Schedule periodic reassessment, because both your systems and the rules change. Align your planning with the timeline of obligations so you prioritise by deadline and risk.
Stay proportionate
A 90-day plan need not be a mega-project. For smaller organisations with manageable AI, a lighter execution is enough — see the AI Act for SMEs. Scale the depth to your actual risk.
What to do
- Weeks 1-4: build an AI register, set roles and risk classes, arrange baseline AI literacy.
- Weeks 5-8: run a gap analysis and close the largest shortfalls first.
- Weeks 9-12: embed governance, schedule reassessment and lock down vendor arrangements.
- Use the broader AI Act roadmap as your frame.
- Keep an eye on the cost of AI Act compliance when choosing depth.
Ninety days is enough to move from "no idea" to "demonstrable control" — provided you prioritise by risk and deadline.
Sources
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2024/1689 (AI Act): obligations per risk class and phased entry into force. - https://artificialintelligenceact.eu/article/4/
Article 4 AI Act: requirement of sufficient AI literacy among staff operating AI.
Read next
AI Act roadmap: from inventory to compliance
A practical roadmap to becoming AI Act compliant — from inventorying your AI systems and determining your role and risk class to governance, documentation and ongoing oversight.
AI Act board briefing: a template for the board and management team
A concise template to get the AI Act and AI use onto the board table: what is happening, which risks and deadlines, which decisions are needed, and which oversight questions the board should ask. Adopt it for your next board/management meeting.
AI for strategic workforce planning: usually not high-risk, as long as it does not become individual
AI for strategic workforce planning and skills forecasting at organisation level is usually not high-risk under the AI Act. But once it steers individual decisions, it can tip over. Data quality, governance and transparency remain crucial.