From "Not Compliant Today" to CE-Marked High-Risk AI System by August 2, 2027

The EU AI Act (Regulation 2024/1689) gives you two public dates and a lot of silence in between. Program management turns those two dates into seven. This document is the roadmap from today to CE mark, working backward from August 2, 2027, with the conformity-assessment queue treated as the critical path. It is a status document, not legal advice. Conformity decisions must be validated with counsel and, where required, a notified body.

1. Executive Summary

• Two statutory deadlines drive every date in this document. GPAI obligations (Articles 51–55) become enforceable on August 2, 2026 — roughly 3.5 months from today. High-risk obligations (Articles 8–17, 26, 27) become enforceable on August 2, 2027 — roughly 15.5 months from today.
• Conformity assessment is the critical path. For Annex I high-risk systems, a notified body engagement runs 6–12 months depending on queue depth. An organization that starts the engagement in February 2027 or later will almost certainly miss the deadline. The last reasonable start date for conformity assessment is February 2, 2027.
• This roadmap works backward from that six-month conformity buffer. If you want the notified body to begin in February 2027, you need your Annex IV technical documentation package complete by November 2, 2026. Which means your controls must be operational by August 2, 2026. Which means your architecture design must be complete and your build underway by May 2, 2026 — about two weeks from today.
• Total effort for a single Annex III high-risk AI system, from scratch, is approximately 55–75 person-weeks for a 3-engineer team, plus 12–25 person-weeks of compliance and legal work, plus conformity assessment fees (EUR 30k–150k+ for notified bodies, or internal-assessment cost for non-biometric Annex III). The bill of materials is in §6.
• Three architectural invariants must hold end-to-end. If any one of them is missing, the conformity dossier will not survive scrutiny: (1) a deterministic pre-execution gate, (2) a cryptographically-signed, hash-chained audit ledger, (3) fail-closed defaults across every governance component. Each is detailed in §3.
• The "acceleration path" with EVE AI Core compresses the 66-week build-and-certify timeline to 18–24 weeks of integration. §8 shows the phase-by-phase math.

2. Deadline Cascade

The Act gives you two public dates. Program management gives you seven. Reading the cascade: if you are at "T-15 months" today and have not yet started Phase 2 control design, you are one week late. Phase 1 classification work should already be complete.

  DATE (ISO)      T-minus    Milestone                                               Type
  ---------------------------------------------------------------------------------------------
  2025-08-02      T-24mo     Risk management system designed (Article 9 scoping)    (past)
  2026-02-02      T-18mo     Classification + scoping decisions locked              (past)
  2026-04-16      T-15.5mo   ▶▶▶ YOU ARE HERE ▶▶▶                                   (now)
  2026-05-02      T-15mo     Architecture design complete; build started            CRITICAL
  2026-08-02      T-12mo     GPAI obligations LIVE (Articles 51-55); controls operational  STATUTORY
  2026-11-02      T-9mo      Technical documentation package complete (Annex IV)    CRITICAL
  2027-02-02      T-6mo      Conformity assessment underway (notified body engaged) CRITICAL
  2027-05-02      T-3mo      Conformity assessment substantially complete           CRITICAL
  2027-08-02      T-0        HIGH-RISK OBLIGATIONS LIVE (Articles 8-17, 26, 27)    STATUTORY
  2027-08-02+     ongoing    Post-market monitoring (Article 72) begins             CONTINUOUS

The path below assumes a team starting Phase 1 on the publication date of this document and is aggressive but achievable. A team that waits until Q3 2026 to begin will not finish in time without buying pre-built components — which is one of the two sustainable paths out of this problem.

3. The Three Architectural Invariants

Before we describe phases, establish what must be true of the end-state. These three are non-negotiable. A compliance dossier that lacks any of them will fail a notified body review or a market surveillance audit.

4. Phase-by-Phase Technical Roadmap

Five phases. Durations assume a dedicated team of 3 engineers + 1 compliance lead + 0.5 legal counsel working through the schedule. Larger teams can compress Phases 2 and 3; Phases 1, 4, and 5 do not parallelize well.

Phase 1 — Classification + Scoping (Weeks 1–4)

Phase 2 — Control Design (Weeks 5–12)

Phase 3 — Build + Integration (Weeks 13–32)

Phase 4 — Technical Documentation + Dossier (Weeks 33–44)

Phase 5 — Conformity Assessment + CE Marking (Weeks 45–66)

After T-0: Post-Market Monitoring (ongoing)

Article 72 requires a documented post-market monitoring system: systematic collection of operational data, periodic review, incident reporting (Article 73: 15 days for serious incidents, 2 days for widespread infringement or critical-infrastructure disruption). This is not a phase — it is a permanent operating mode that begins the day you place the system on the market or put it into service. See §9 for how to operationalize post-market monitoring with unified audit bus, Merkle aggregator, and the resilience score engine.

5. Build vs. Buy Decision Matrix

For each of the four technical obligation controls, the realistic options are: build from scratch, buy a point solution (limited vendor market in early 2026), hybrid (build the last-mile, buy the primitive), or adopt EVE AI Core. Effort in person-weeks assumes a 3-engineer team with no prior governance-infrastructure experience.

6. Cost Model (Micro / Mid / Enterprise)

The numbers below are internal-cost estimates. Actual cost varies significantly by jurisdiction, engineer seniority, and existing tooling. Figures in USD; conformity assessment fees are in EUR as quoted.

Scenario A — Micro (1 AI product, solo founder + 1–2 contractors)

Scenario B — Mid-Market (5–50 engineers, 2–4 AI products, 1 regulated)

Scenario C — Enterprise (50+ engineers, regulated industry, 5+ AI products)

7. Risk Flags That Kill Schedules

These are the failure modes that most commonly cause a compliance program to slip past August 2, 2027. Every one of them has been observed in adjacent regulatory programs (GDPR, DORA, HIPAA).

8. The Acceleration Path — If You Have EVE AI Core

The base roadmap totals approximately 66 weeks (Phases 1–5, weeks 1–66). Integrating EVE AI Core modules compresses the phases as follows:

The 37-week path begins today (week 0 = April 16, 2026) and lands at week 37 = January 1, 2027 — which leaves a 31-week buffer before the high-risk deadline. In practice that buffer is absorbed by notified body queue and by remediation cycles that are not fully predictable.

The 37-week path assumes:

• EVE modules are adopted as-is for the pre-execution gate and audit ledger — no custom forks.
• Your integration team has at least one senior engineer experienced with signed-attestation systems.
• Your compliance lead has direct reading access to the EVE audit stream (via /v1/decisions/evaluate and EVE Proof verification).
• You do not have unusual upstream GPAI supplier dependencies that require independent re-certification.

Where the savings come from:

• Phase 2 −6 weeks: The three architectural invariants are already designed, tested, and validated against a 1000-vector adversarial gauntlet. Your design work shrinks to "how do I integrate" rather than "how do I invent."
• Phase 3 −12 weeks: The four obligation controls have EVE reference implementations. The integration work is wiring, not inventing.
• Phase 4 −5 weeks: Build attestations, resilience certificates, and signed audit samples are auto-generated.
• Phase 5 −6 weeks: Notified body review is faster when every evidence request has a signed artifact behind it.

9. Monitoring After Compliance

Article 72 post-market monitoring is permanent. It is the operating mode, not a phase. The compliance program does not end on August 2, 2027; it becomes steady-state.

Four obligations persist:

1. Operational telemetry collection. Accuracy, robustness, drift, and incident data must be continuously collected against a documented monitoring plan. EVE support: core/resilience/resilience_score.py provides a composite 0–100 score across governance, identity, behavioral, and governance sub-layers; core/resilience/trunk_certificate.py provides signed snapshots suitable for auditor verification.
2. Periodic review. The RMS must be reviewed at minimum annually (more often if the system changes materially). Every review produces a signed record. EVE support: the unified audit bus + Merkle aggregator produces a quarterly signed Merkle root that summarizes all decisions for the quarter; regulators can verify inclusion of any single decision without downloading the full log.
3. Incident reporting (Article 73). Serious incidents: 15 days from awareness. Widespread infringement or critical-infrastructure disruption: 2 days. Reporting is to the competent authorities of the member states affected. EVE support: the audit bus emits severity=serious events that can be wired to an incident reporting workflow.
4. Substantial modification review. Material changes to the system trigger re-assessment. Whether a change is "substantial" is a judgment call that needs a documented policy. EVE support: the core/governance/build_attestation.py module detects git-level and dependency-level changes automatically and can trigger substantial-modification review.

10. Close — What to Do This Week

You have roughly 15.5 months to the high-risk deadline. The notified body queue compresses that to 9 months of useful time. This roadmap's base path is 66 weeks; the EVE-accelerated path is 37 weeks. Both are feasible from today. Neither is feasible from Q4 2026.

Where to engage EVE AI Core

The document count for this compliance series ends here. The deadline clock does not. If you want a deeper pass — mapping your specific deployment to the Articles, scoping the conformity-assessment work, and sequencing the phases against your release calendar — schedule a compliance architecture review. August 2, 2027 is fifteen and a half months away. Phase 1 was supposed to be done two weeks ago. There is no runway left for delay.