An Examination of Corporate Compliance Gaps in the Implementation of the EU Artificial Intelligence Act

Abstract

The Regulation on Artificial Intelligence, commonly known as the EU Artificial Intelligence Act, entered into force in August 2024 and has since been applying to companies in stages that stretch from February 2025 through December 2027 and beyond. This staggered timetable, compounded by a Digital Omnibus agreement that has already pushed back the deadline for full compliance with the rules governing stand-alone high-risk systems from August 2026 to December 2027, has left many companies uncertain about precisely what is required of them and by when. This article examines the compliance gaps that have opened between the obligations the Act imposes on providers, deployers, importers and distributors of artificial intelligence systems and what companies operating in or serving the European Union have actually implemented. Drawing on the regulatory text itself, recent readiness research indicating that a large majority of enterprises still lack a basic inventory of the artificial intelligence systems they use, and the professional and academic commentary that has followed the Act’s phased rollout, the article traces gaps across five domains, namely the identification and risk classification of artificial intelligence systems, data governance and algorithmic bias, documentation and traceability, human oversight and artificial intelligence literacy, and post-market monitoring. The article concludes with a set of recommendations organized around enterprise-wide risk mapping, contractual allocation of responsibility across the artificial intelligence supply chain, and integrated board-level governance, intended to help companies close the gap between what the Act requires and what most organizations have so far put in place.