The EU AI Act is obviously a legal document.
Lawyers should read it as one.
The problem starts when everybody else does too.
We have been here before.
When GDPR arrived, an enormous amount of organisational effort went into interpreting articles, rewriting policies, updating privacy notices, changing contracts and debating what particular words meant.
Much of that was necessary.
But it wasn't the difficult bit.
The difficult bit was answering rather more mundane questions.
What personal data do we actually have?
Where is it?
Why are we processing it?
Who can access it?
Who are we sharing it with?
How long are we keeping it?
And what happens when somebody exercises a right, a system changes or something goes wrong?
GDPR became real when it stopped being a regulation that Legal and Privacy discussed and became something that affected how systems were designed and how people actually worked.
The AI Act is heading towards exactly the same trap.
Organisations can spend a great deal of time reading it.
At some point, however, somebody has to turn it into things that people actually do.
First, what AI have you actually got?
It sounds an embarrassingly simple question.
It often isn't.
Most organisations can probably name their obvious AI platforms.
Microsoft Copilot.
ChatGPT Enterprise.
Gemini.
Perhaps an internally developed model or two.
That is the easy bit.
What about the recruitment platform which recently added AI candidate scoring?
The fraud product using machine learning?
The customer-service platform summarising conversations?
The security product automatically prioritising alerts?
The CRM generating recommendations?
The SaaS product that quietly introduced an AI feature in its last release?
The development tools being used by engineers?
And, of course, whatever employees have discovered for themselves.
You can write a magnificent AI policy.
You can classify every conceivable AI use case.
You can have an AI steering committee with an impressive Terms of Reference.
None of it helps very much if nobody knows an AI capability exists.
It is rather difficult to govern an AI system that nobody knows you are using.
This is one of the lessons GDPR should have taught us.
You cannot meaningfully govern information you don't know you hold.
The same applies to AI.
Start with reality. Not the policy.
Then ask what it actually does
One of the least useful ways to start an AI governance discussion is:
“Is this AI?”
Sometimes you need to answer that question for legal reasons.
Operationally, I am usually more interested in:
What is it doing?
Who is it doing it to?
What information does it use?
What decision does it influence?
What happens if it is wrong?
Can a human challenge it?
And is that human genuinely making a decision, or merely clicking Approve on whatever the machine recommended?
Consider two uses of essentially the same underlying technology.
One helps somebody improve the wording of an internal email.
The other ranks candidates applying for a job.
From a technology perspective, both may involve AI.
From a risk perspective they are not remotely the same thing.
Employment and recruitment are among the areas specifically addressed by the AI Act's high-risk regime.
That shouldn't surprise anyone.
The important thing is not simply that AI is being used.
It is what we have allowed it to do.
This is where regulation can actually help rather than hinder.
It forces organisations to think about use cases and consequences rather than being distracted by the technology itself.
GDPR taught us about paper compliance
There was a phase of GDPR implementation where organisations became very good at producing documents.
Policies.
Records.
Privacy notices.
Data-processing agreements.
Impact assessments.
All useful things.
But a beautifully written retention policy is not particularly valuable if every production system keeps personal data indefinitely.
A privacy notice does not protect anyone if engineers are copying production data into test environments.
And declaring that Privacy by Design is company policy doesn't make it happen by itself.
Eventually organisations discovered that privacy had to become part of procurement, architecture, product development, HR, marketing, supplier management and operational processes.
In other words, it had to leave the privacy department.
AI governance is the same.
If the AI Act produces an AI policy, an assessment template and another committee, but does not change how AI is bought, built, deployed, changed and monitored, we haven't really achieved very much.
We have created paperwork about AI.
There is a difference.
Turn the law into an operating model
The useful conversation therefore isn't:
“What does Article X require?”
Legal will quite properly answer that.
The operational conversation is:
“What do we need to do because of it?”
Take transparency.
Applicable AI Act transparency requirements have been enforceable since 2 August 2026. Among other things, certain systems interacting directly with people need to make clear that the interaction is with AI, and there are requirements around identifying or disclosing certain synthetic and manipulated content.
The legal interpretation matters.
But eventually somebody needs to ask:
Do we have customer-facing AI?
Where?
Does the customer know?
Who owns the disclosure?
Is it still there after the next product release?
How would we know if somebody removed it?
That is governance.
Or take a higher-risk use case.
The current timetable gives organisations more time than originally anticipated: the requirements for Annex III high-risk systems now apply from 2 December 2027, with high-risk AI embedded in certain regulated products following from 2 August 2028.
Useful.
But an extra year is not an operating model.
I would use the time to answer fairly ordinary questions:
What AI do we have?
Which use cases matter?
Who owns them?
What data do they depend on?
What evidence do we need from suppliers?
How are important decisions tested?
Where is human oversight actually required?
How do we know when the model or its use changes?
What happens when it fails?
None of this is particularly exotic.
Which is perhaps the point.
Don't govern the model and forget the use case
This is going to become increasingly important.
Most companies are not building frontier AI models.
They are using somebody else's.
So procurement asks the supplier:
“Are you compliant with the EU AI Act?”
The supplier says yes.
A document arrives.
Everyone feels slightly better.
Done?
Not really.
A compliant AI capability can still be used badly.
The supplier does not necessarily know what decision you have embedded it into.
They may not know what data you are feeding it.
They don't know whether your employees are treating its output as advice or as fact.
They don't know whether what started as a productivity tool has quietly become part of an important customer decision.
And they certainly don't own your business outcome.
This is another lesson we should already know from GDPR.
Using a compliant cloud provider did not make the customer's processing automatically compliant.
Buying from a reputable AI provider will not outsource accountability for how you use its technology either.
Govern the use case, not just the model.
And keep doing it.
AI systems change.
Models change.
Vendors add capabilities.
People find new ways to use them.
The use case that was fairly innocuous when approved eighteen months ago may not be the use case you have today.
Don't make governance so painful that people avoid it
There is another danger.
We respond to the AI Act by building an enormous governance machine.
Every use of AI requires a form.
The form has 47 questions.
Then Security reviews it.
Privacy reviews it.
Legal reviews it.
Risk reviews it.
Procurement reviews it.
Then it goes to an AI committee that meets on the third Wednesday of alternate months.
Six weeks later somebody is allowed to summarise a document with Copilot.
We shouldn't be surprised when people find another way.
Good governance needs friction. Some things should be difficult.
But the amount of friction should bear some relationship to the consequence.
An employee using an approved tool to improve the grammar in an internal presentation does not need the same governance as an AI system making recommendations about whether someone gets a job, credit or insurance.
Proportionality
Good AI governance should make low-risk AI easier to use, not harder.
That gives people a reason to stay inside the guardrails.
It also means governance teams can spend their time on the AI that actually matters.
This was another GDPR lesson.
If every processing activity is treated as equally dangerous, Privacy becomes overwhelmed and the business starts treating the process as bureaucracy.
Risk-based regulation requires risk-based implementation.
Otherwise we have rather missed the point.
Compliance is not AI governance
This is probably the distinction I care about most.
The AI Act tells organisations things they are legally required to do.
That matters.
It does not define every AI risk that matters to the business.
An AI system can be perfectly legal and still:
leak commercially sensitive information;
produce convincing nonsense for a customer;
make poor recommendations;
create intellectual-property problems;
introduce a critical dependency on one provider;
expose a new attack surface;
behave unexpectedly after an update;
or simply produce bad business decisions.
None of those becomes unimportant because a lawyer concludes that the system isn't high-risk under the AI Act.
The objective therefore cannot simply be:
“Comply with the AI Act.”
The objective is to use AI in ways that create value without exposing the organisation, its customers or its people to risks it does not understand or cannot tolerate.
Regulatory compliance sits inside that.
It isn't the whole thing.
We already know how to do most of this
AI is new enough that organisations sometimes convince themselves they need an entirely new form of governance.
Some things genuinely are different.
But we should not throw away everything we have learnt.
We already know how to inventory important technology.
We know how to assess suppliers.
We know how to classify information.
We know how to control access.
We know how to test systems.
We know how to record important decisions.
We know how to manage change.
We know how to investigate incidents.
We know how to assign accountability.
AI changes some of the questions.
It does not repeal the fundamentals of good governance.
GDPR taught us that regulation only really works when it stops being a document and becomes part of how the organisation operates.
The AI Act will be no different.
So, yes.
Read it.
Understand what applies.
Get good legal advice where you need it.
But then put the document down.
Find out what AI you actually have.
Understand what it is doing.
Work out what matters.
Put proportionate controls around it.
Know who is accountable.
And keep looking, because it will change.
The EU AI Act is a legal document.
AI governance is an operating model.
Confusing the two is how we end up with excellent compliance paperwork and very little actual governance.
Personal commentary. Views are the author’s own.