Zero-Day Dawn

Zero-Day Dawn

The Three Timelines of the EU AI Act

Which one drives your audit risk - and why it’s not the one you think

Violeta Klein, CISSP, CEFA's avatar
Violeta Klein, CISSP, CEFA
Nov 24, 2025
∙ Paid

Executive Summary

The EU AI Act now lives inside a broader, more complex regulatory universe. With the Digital Omnibus on the table and post-Omnibus commentary spreading like wildfire, leadership teams are once again recalculating when they “really” need to be compliant.

Some are locking onto the political cycle: Council conclusions, Omnibus negotiations, and Commission communications that suggest gradual simplification.
Others fixate on enforcement: stop-the-clock mechanisms, extended grace periods, and the apparent shift of high-risk penalties into late 2027.
Almost no one is looking at the only timeline that actually governs financial exposure: the date when classification and documentation obligations crystallize for every AI system they place on the EU market.

The EU AI Act is now operating across three distinct timelines:

  1. A Political Timeline - volatile, headline-driven, and structurally incapable of telling you when your risk actually starts.

  2. An Enforcement Timeline - flexible, dependent on national capacity and Commission acceleration choices, and frequently misread as “extra time.”

  3. A Classification Timeline - fixed, anchored in August 2026, and tied not to enforcement but to the act of placing systems on the market and registering high-risk determinations.

Most organizations are optimizing for the first two. Their decisions are rational from a distance, but structurally misaligned with how the Act actually creates exposure.

This piece does three things:

  • It explains how these three timelines emerged and why they are diverging after the Digital Omnibus.

  • It shows why only the classification timeline is a reliable anchor for financial risk — and why it did not move.

  • It outlines how leadership teams should structure their 2025-2026 roadmap if they want to use Omnibus “simplification” as a competitive advantage rather than a justification for delay.

The conclusion is blunt: political and enforcement timelines can move; the classification timeline cannot. If your organization is still waiting for “clarity” before it starts classification, you are betting your balance sheet on the wrong clock.

This post is for paid subscribers

Already a paid subscriber? Sign in
© 2026 Quantum Coherence LLC · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture