The eighteen months nobody prepared for

The Record, written in October 2026. A retrospective. This piece covers the period around August 2024, when the AI Act entered into force, and was written afterwards from the documents. Nothing here was published at the time.

On 1 August 2024, Regulation (EU) 2024/1689 entered into force. It is a long document with a phased application, and almost every summary of it written that autumn led with the same sentence: the obligations that matter arrive in 2026.

That sentence was true and it was the reason nothing happened. Associations read 2026, put the file in a folder, and got on with the renewals cycle.

What the phasing actually said

The Act applies in stages, and the first stage was six months away, not two years.

• 2 February 2025 — the prohibitions in Article 5, and the obligation in Article 4 that staff be sufficiently AI literate.
• 2 August 2025 — the obligations on providers of general-purpose AI models, the governance architecture, and the penalty regime.
• 2 August 2026 — most of the obligations for high-risk systems listed in Annex III: employment, education, access to essential services.

A member association's own systems sit almost entirely in that last bucket. Its membership database, its renewals engine, its events platform — none of them is a high-risk AI system in the sense the Act means. So the honest reading in the autumn of 2024 was that an association had time.

The dishonest reading, and the one that spread, was that an association had nothing to do until 2026. Between those two sentences sits eighteen months of work that could have been done calmly and was instead done in a rush, or not at all.

The mistake was reading the Act as a product rule

The Act regulates two different people. A provider puts a system on the market. A deployer uses one in the course of its work. Most of the heavy obligations — conformity assessment, technical documentation, the CE mark — land on providers. Most member associations are deployers, and deployers were told, correctly, that the burden was lighter.

Light is not the same as absent. A deployer of a high-risk system carries its own duties: to use the system according to its instructions, to assign human oversight to somebody competent, to keep the logs the system produces, and to tell the people affected that they are dealing with a machine. Those are not engineering tasks. They are management tasks, and an association is a management organisation.

Meanwhile Articles 4 and 5 arrived in February 2025 and applied to everybody, high-risk or not. A recruitment tool that screens CVs, an emotion-recognition feature bolted onto a members' wellbeing survey, a chatbot that decides whether a member's complaint gets escalated — those were live questions in 2024, and they were answered in the last quarter of 2025 by people who had discovered the Act eight weeks earlier.

What an association should have done with the time

Three things, all cheap, none of them requiring a lawyer.

Take an inventory. Not a data map — an inventory of the tools that already touch members, staff or applicants and that make a judgement about a person. Renewals scoring, churn prediction, CV screening, member segmentation for campaigns. The list is usually shorter than people fear and more surprising than people expect.

Write down who decides. For each system on that list: who is competent to override it, and what the override procedure is when they are on holiday. This is what the Act calls human oversight, and in most associations it existed informally and nowhere in writing.

Say when a machine is speaking. A member who receives a decision from a software system is entitled to know that. This is the cheapest obligation in the whole Act and the one most often discovered late, because it lives in a paragraph of the transparency chapter that no summary ever quoted.

The cost of the eighteen months

It is now October 2026. The high-risk obligations were deferred in July 2026 to December 2027, which bought the sector another fifteen months. That deferral did not retroactively fix the two years before it.

The associations that moved are not the ones with the biggest IT teams. They are the ones that read the phasing table instead of the executive summary, worked out that February 2025 came before August 2026, and treated the prohibitions and the literacy duty as the first tranche rather than an afterthought. What they got for it was not compliance. It was a list of systems they owned, an argument they could have with a supplier, and no panic.

That is the whole lesson of the first two years, and it will be the lesson of the next two: the deadline that matters is almost never the one in the headline.

---

The Record · What the prohibitions actually banned →

---

Running an association? The AI Act for associations — what your body must actually do sets out the whole thing on one page: whether you are a provider or a deployer, the four duties that reach a membership body, the dates that matter, and the five items of evidence a board will ask for.