The EU AI Act is the first systemic AI law a mid-sized corporate is likely to encounter. It is also, contrary to most early commentary, a manageable law - if treated as an operating-model question rather than a compliance exercise.
This essay sets out the 14-week working plan we have run twice with European mid-sized corporates between €500m and €4bn in revenue. The plan is opinionated and skips three things we have seen waste budget elsewhere.
Weeks 1 to 3: inventory before policy
Most clients start by drafting an AI policy. This is backwards. The policy describes how you intend to act on a population you do not yet know.
Our first three weeks build the inventory: every AI system in use, in development or being procured, across business units. Most institutions overestimate completeness by 30 to 50 percent. We have never seen an enterprise inventory get this right on first sweep.
Weeks 4 to 6: classification with the business in the room
Risk classification under Article 6 is a judgement call. Some calls are clean. Many are not - particularly around HR, education and access to essential services.
We run classification workshops with the relevant business head in the room. Not because the law requires their attendance, but because they are the only people who can describe the actual decisional autonomy of the system in practice.
Weeks 7 to 10: high-risk remediation in parallel
By week 7, you know which systems are high-risk and you know which are sitting closest to the regulatory red line. We have, on every engagement so far, run remediation of the top three high-risk systems in parallel with the inventory completion of the long tail.
Documentation, post-market monitoring and conformity assessment artefacts are produced as part of the remediation, not afterwards. This is the largest single cost saving in the plan.
Weeks 11 to 14: operating model and ongoing assurance
The final weeks build the operating model: the AI Risk Committee, the quarterly attestation, the audit-pack template, the reviewer rota. Without this, the inventory and the policy are dead artefacts that decay within two quarters.
If you are starting an AI Act programme later than mid-2026, this plan is still relevant. We have run shorter compressed variants in 9 weeks where senior sponsorship and budget were already secured.