Executive Summary
For the board and senior management: first decide which duties apply, who owns them and what evidence is missing. The regulations below do not all apply to every company. Several duties already apply; the deferral of some high-risk AI Act provisions is not a general postponement of AI governance.
Five regulations to assess
| Regulation | What determines applicability | Practical output |
|---|---|---|
| AI Act | System/model definition, role, intended purpose, EU nexus and Article 2 exclusions; Article 6 and Annexes I/III for high risk | Inventory, reasoned classification and obligations for each role |
| NIS2 / Czech law | Specific service, entity type, size including enterprise relationships, and special exceptions; Czech higher/lower regime rules | Record of regulated service assessment, regime and deadlines |
| GDPR | Material and territorial scope in Articles 2–3, processing operation and controller/processor role; not people’s citizenship | Purposes, legal bases, processing records and rights procedures |
| Data Act | User, data holder/recipient, manufacturer, related service or data processing service provider role; relevant chapter and exclusions | Data rights map, access process and contractual/technical switching plan |
| DORA | Listed Article 2 financial entities and exceptions; the special oversight framework for critical ICT providers follows Article 31 designation; ordinary ICT contracts carry duties without that designation | ICT framework, contract register, reporting and testing plan for the applicable regime |
Decisions to make now
- Confirm scope and roles. Inventory AI, regulated services, personal data, cloud contracts and connected products. An AI API integration may be a supplied AI system; model training is not required to become its provider.
- Address current requirements. Article 4 requires contextual measures supporting AI literacy development among relevant staff and people operating AI on the organisation’s behalf. A course certificate can be evidence of training, not proof of organisation-wide compliance. Check Article 5 prohibitions and applicable Article 50 transparency.
- Resolve current operational duties. Check Czech NIS2 notification and registration dates, GDPR rights and incident processes, and DORA duties where applicable. Do not wait until the end of 2026 to determine scope.
- Plan system-specific high-risk work. Chapter III Sections 1–3 except Article 6(5) apply from 2 December 2027 for Article 6(2)/Annex III, and 2 August 2028 for Article 6(1)/Annex I. This does not automatically defer every high-risk article; separately assess scope, Article 2(2) and (13), and Article 111 transitions. Determine provider/deployer duties, conformity assessment route and conditional FRIA/DPIA.
- Approve a measurable remediation plan. Assign owners, resources and acceptance evidence. Treat generic templates as a starting point and maintain the implemented controls.
Management dashboard — fill from your own evidence
This is a blank planning template, not a measured readiness result, customer case study or incident probability estimate.
| Field | Record |
|---|---|
| Entity, service/system and owner | To be completed |
| Applicable duty and primary source | To be completed |
| Statutory trigger and deadline | To be completed |
| Current evidence and gap | To be completed |
| Remediation and acceptance evidence | To be completed |
| Budget and approved delivery scope | To be completed |
| Review date and decision | To be completed |
Avoid presenting a checklist completion percentage as legal compliance. Define the denominator, excluded items and evidence quality before using a score. Estimate costs from actual scope; statutory fine maxima are not expected losses or guaranteed ROI.
Continue
Content reviewed: 6 September 2026. Primary sources: AI Act, Digital Omnibus on AI, NIS2, NÚKIB: registrace a lhůty, GDPR, DORA, Data Act.