Most U.S. general counsel have the same read on the EU AI Act right now: it’s delayed, so there’s time. Our Managing Director of Legal & Compliance Solutions, Claire Frazer, makes the case in a recent piece for Law.com that this read is only half right, and the half that’s wrong is the costly one. 

The Omnibus package adjusted the timeline, not the destination. High-risk requirements now phase in through December 2027 and August 2028, depending on the system. But AI literacy requirements have applied since February 2025, and Article 50 transparency obligations, including disclosure and machine-readable marking of AI-generated content, already took effect in August 2026. The runway got longer. The obligations didn’t disappear. 

Two assumptions are worth retiring along with it. First, EU establishment isn’t the trigger, use is. The Act can apply to any organization whose AI outputs are used in the EU, with or without a European entity involved, which means the operative question isn’t “do we operate in the EU,” but “where do our AI systems’ outputs actually land.” Second, legal AI gets no automatic pass for being a professional tool. Contract review and e-discovery aren’t exempt by category. Classification turns on the purpose and function of the specific use case, not on whether a lawyer is in the loop, which makes use-case mapping far more important than simply labeling something “legal technology.” 

The piece also reframes what governance should mean in practice: risk classification against Annex III use cases, verifiable data segregation, documented human-oversight protocols, and audit-ready records of how AI outputs were validated. Claire’s sharpest point may be the simplest one: regulatory classification should be the floor of the governance conversation, not the ceiling. An organization should be able to answer how its confidential information is handled and who’s accountable for AI output, regardless of whether a given workflow technically qualifies as high-risk. 

For in-house teams evaluating an ALSP partner right now, that list of questions is a useful one to borrow directly, starting with: can the partner show the risk mapping, not just describe it, and is there a named owner for AI Act compliance, or is it diffused across IT, legal, and operations in a way no one actually owns? 

It’s also the foundation our Compliance Support team is built around: governance that’s operational today, not a policy document waiting for 2027.