COMMENTARY: The EU AI Act entered into force on Aug. 1, 2024. Two years later, on Aug. 2, 2026, its broader application phase began, with several obligations already active and others scheduled for later stages.
More importantly, the European Commission’s AI Office and national competent authorities now have enforcement powers for provisions applicable at this stage.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
This changes the conversation.
AI governance can no longer be treated simply as a future compliance project.
What has changed?
The EU’s prohibited AI practices and AI literacy requirements have applied since Feb. 2, 2025. Governance requirements and obligations for general-purpose AI models followed on Aug. 2, 2025.
On Aug. 2, 2026, enforcement expanded alongside further transparency requirements.
Article 50 introduces transparency obligations for certain AI interactions and AI-generated or manipulated content. Depending on the use case, people may need to know when they are interacting with AI, while certain synthetic content must be identifiable.
There is also a limited transition for certain marking and detection requirements: systems placed on the market before Aug. 2, 2026, have until Dec. 2, 2026, for the relevant obligations.
This matters because 2026 is not one single compliance deadline.
The AI Act is a phased program.
The next deadlines matter
The next major milestone is Dec. 2, 2026, followed by the scheduled application of rules for certain high-risk AI systems on Dec. 2, 2027. AI systems embedded in regulated products have a later date of Aug. 2, 2028.
That additional time should not be interpreted as permission to wait.
High-risk AI governance can involve risk management, data governance, technical documentation, record keeping, human oversight, accuracy, robustness and cybersecurity.
Building these capabilities across a complex organization takes time.
The financial exposure is significant
The AI Act establishes substantial maximum penalties.
For prohibited AI practices and certain data-related infringements, fines can reach €35 million or 7% of worldwide annual turnover, whichever is higher.
For other breaches, the maximum can reach €15 million or 3% of worldwide annual turnover. Providing incorrect, incomplete or misleading information to authorities can result in penalties of up to €7.5 million or 1% of worldwide annual turnover, subject to the regulation’s applicable rules and proportionality provisions.
These numbers change the level at which AI governance should be discussed.
This is no longer only an IT issue. It is an enterprise risk and board-level governance issue.
The biggest weakness may be visibility
One of the first questions I would ask an organization is simple: “Show me your AI inventory.”
Many organizations have mature IT asset inventories but still cannot confidently answer that question.
AI can enter through enterprise applications, cloud services, recruitment platforms, development tools, security products, marketing systems and employee experimentation.
This creates "shadow AI" — technology being used without sufficient organisational visibility or assessment.
A meaningful AI inventory should identify the system, provider, business purpose, owner, data processed, affected users, AI role and risk classification.
Without that visibility, compliance becomes difficult to demonstrate.
AI governance must connect with cybersecurity
The AI Act should not become another isolated compliance program.
AI governance should connect with ISO/IEC 27001, privacy, cybersecurity, supplier risk, procurement, enterprise risk management and internal audit.
Consider a simple example: an employee uploads confidential company information into an external AI service. That is not simply an AI issue. It can involve information classification, data protection, supplier risk, access control and employee awareness.
AI crosses traditional governance boundaries.
What should organizations do now?
1. Build an AI inventory. Identify approved and unauthorised AI use.
2. Classify the use cases. Determine which requirements apply.
3. Assign ownership. Establish clear accountability for material AI systems.
4. Review suppliers. Do not assume purchasing an AI-enabled product transfers all compliance responsibility to the vendor.
5. Integrate AI into risk management. Assess AI alongside cybersecurity, privacy, operational and supplier risks.
6. Establish evidence. Maintain assessments, approvals, training records, supplier reviews, technical documentation, monitoring and corrective actions.
7. Prepare for the next deadlines. Address upcoming requirements now rather than waiting for the deadline.
The auditor’s question
The most important question may not be: “Do we have an AI policy?”
It should be: “Can we demonstrate that we know what AI we use, understand its risks, know who is accountable, have implemented appropriate controls and can produce evidence when challenged?”
That is the real shift.
The organizations that respond well will not simply produce more documentation. They will make AI governance part of normal business control.
- Know your AI.
- Understand its risk.
- Assign accountability.
- Control it.
- Keep the evidence.
That is what AI readiness should look like as regulation moves from the rulebook into the real world.
