30 days before the 2 August 2026 deadline, most organisations in scope of the EU AI Act had produced their technical documentation and appointed a compliance lead. The legal checklist is moving forward. But between documentary compliance and operational governance, the gap is structural, and foreseeable. Here are the three gaps that first internal checks systematically reveal, and how to address them before the competent authority identifies them for you.
The illusion of documentary compliance
The EU AI Act imposes on providers and deployers of high-risk AI systems a precise body of obligations: continuous risk assessment, detailed technical documentation, effective human oversight mechanisms, robustness testing, and notification to the competent national authorities. These obligations are clear, verifiable, and now close to enforcement.
What most organisations have not yet translated into practice is the fundamental distinction between having a document and having an operational arrangement. ENISA, in its May 2026 report on the AI Act maturity of entities subject to NIS2, observes that 71% of the organisations audited have technical documentation that complies, but that only 29% can demonstrate that their human oversight mechanisms are actually active in production.
This ratio is not surprising. The two-year transition period granted since the regulation entered into force has encouraged a project logic: produce the documentation, appoint the owners, tick the boxes. In the meantime, AI deployments have continued to evolve, without the documentation keeping pace and without governance processes being tested.
Gap 1: system drift after initial certification
An AI system certified compliant in January 2026 is not necessarily compliant in July. Most GRC teams have not yet turned this logic into a continuous process.
High-risk AI systems evolve: models are retrained on new data, use cases expand, decision parameters change. Article 9 of the EU AI Act requires the risk management system to be "continuous and iterative", not an annual audit. Yet 83% of the organisations audited by the CERRE consortium in 2026 have no automatic reassessment process triggered by a change of model or scope of use.
The common mistake is to treat AI Act compliance as an ISO 27001 project with a one-off certification. A concrete example: an organisation deploys an HR scoring tool in December 2025, certifies it as compliant, then extends its use to performance evaluation in May 2026 without reassessing the risk level. The change of use case potentially alters the classification of the system, and the documentation does not reflect this.
The operational response: define an AI change management process. Any change to the model, the training dataset or the scope of use automatically triggers a reassessment of the risk level and an update of the technical documentation. This process must be formalised, tested and auditable before 2 August.
Gap 2: human oversight on paper, absent in production
Article 14 of the EU AI Act requires deployers to put in place measures enabling human operators to "monitor, understand and, where necessary, stop or question the AI system". This is one of the most frequently cited obligations in compliance documents. It is also one of the least effective.
Two structural frictions explain this gap. The first is cognitive: when a system processes several thousand decisions an hour, such as credit scoring, candidate screening or anomaly detection, human oversight cannot be exercised on every output. In practice it is reduced to sample reviews or alerts when a threshold is exceeded. This is not what the text envisages.
The second friction is organisational. In many organisations, the person responsible for human oversight has been named in the compliance document but has not been equipped: they have no access to logs in real time, have not been trained on the specific characteristics of the system, and have no clear procedure for exercising their power to stop the system.
A documented example: a mid-sized financial institution names its compliance officer as the human overseer of a customer behavioural analytics tool. In practice, this officer receives a monthly aggregated PDF report, with no access to individual decisions and no alert in case of drift. Oversight is documented. It is not operational. During an inspection, this distinction will be immediately visible.
Gap 3: the supplier responsibility chain, still incomplete
The value chain of a high-risk AI system is rarely monolithic. A deployer uses a model developed by a third-party provider, hosted on cloud infrastructure, with data annotated by an external contractor. The EU AI Act allocates responsibilities among these actors through Article 25, but the contracts in force do not yet allocate them.
According to a Paris digital law firm that analysed SaaS contracts signed in 2025 and 2026, 76% of them contain no clause on AI Act obligations. The deployer assumes the provider has handled compliance upstream. The provider considers that use falls under the deployer's responsibility. In the event of an incident, such as a proven bias, systemic discrimination or a failure of an automated decision system, neither the compliance documentation nor the contract makes it possible to clearly identify who is responsible.
This gap is actively monitored by national supervisory authorities: the first requests for AI Act contractual documentation began reaching French organisations in the second quarter of 2026. The remedy is direct: add to every contract with a high-risk AI system provider a clause defining the transparency obligations, the supply of technical documentation, notification of any change of model, and the sharing of responsibility within the meaning of Article 25.
Assessing your exposure before 2 August
These three gaps can be verified within two weeks through a structured gap analysis: an inventory of high-risk systems with the date of last reassessment, an audit of human oversight mechanisms in the production environment, and a review of active supplier contracts. Organisations that start now can reasonably reach a sufficient level of operational compliance before the deadline.
Presidio includes an AI Act governance module covering system mapping, tracking of documentation revisions and alerts on deployment drift. To qualify your level of exposure and prioritise corrective actions, a 30 minute discussion is enough. See also our analysis of the 4 obligations not yet deployed at D-40 and the framework for third-party governance under NIS2.
Conclusion
Documentary compliance with the EU AI Act is necessary. It is not sufficient. The three gaps identified here, namely post-certification drift, formal human oversight without effectiveness, and an incomplete contractual responsibility chain, are structural but manageable. They share a critical characteristic with most regulatory issues: they only become visible too late, when one waits for the regulator to flag them. With 30 days to go before the 2 August deadline, the window to act before the first inspection cycle is still open, but narrow. In your organisation, which of these gaps have you already checked in production?