Your AI is already making decisions. Is your governance keeping up?

Often, yes. The Act reaches any organization that places AI systems on the EU market or whose AI outputs are used in the EU, regardless of where the company sits. A US university recruiting EU students with algorithmic tools or a SaaS product with EU customers can both be in scope.

Prohibited practices have applied since February 2025 and general purpose AI obligations since August 2025. The high risk system obligations were set for August 2, 2026, and a proposed postponement to December 2027 is still moving through the EU legislative process. Planning around a delay that is not yet law is a gamble we advise against.

Categories listed in Annex III, including AI used in hiring and worker management, education admissions and scoring, credit decisions, essential services, and safety components of regulated products. If your AI influences who gets a job, a loan, or a seat in a program, assume high risk until analysis says otherwise.

Up to 35 million euros or 7 percent of global turnover for prohibited practices, up to 15 million euros or 3 percent for high risk noncompliance, and up to 7.5 million euros or 1 percent for supplying misleading information to authorities. Regulators can also pull noncompliant systems from the EU market entirely.

Yes. The Act assigns obligations to deployers, not just developers, and US law works the same way: the employer using a biased screening tool gets sued alongside the vendor. You can outsource the technology, but not the accountability.

At minimum: a statement of purpose and intended use, known limitations, data provenance, a risk assessment, bias and performance testing results, a monitoring plan, a defined human oversight point, and a change log. If a regulator or plaintiff asked tomorrow, this is the file you would want to hand them.

One named owner per system, usually the product or system owner closest to how it actually runs, with legal, data, and security contributing sections. The governance function sets the standard and audits against it. Documentation owned by everyone is owned by no one, and that shows up at the worst possible moment.

A single registry of every AI system in use: what it does, who owns it, what data it touches, and its risk tier. It is the first artifact we build in any engagement because nothing else in governance works without it, and most organizations discover systems they did not know they had, especially vendor AI embedded in existing tools.

At every material change to the model, its data, or its use, plus a scheduled review, quarterly for high risk systems and at least annually for the rest. Models drift, and documentation that described last year’s system protects no one.

Yes, though it looks different: an acceptable use policy, approved and prohibited use cases, data handling rules, and a vendor assessment on record. Employee misuse of general purpose AI is one of the most common incident sources we see, and a two page policy prevents most of it.

An executive sponsor with real authority, legal counsel, compliance or risk, information security, the senior data or AI leader, a privacy officer, and rotating business owners for the systems under review. Add HR when employment uses are on the table. The test is whether builders and gatekeepers are both in the room with a shared process.

Six to ten core members, meeting monthly, with an expedited path for time sensitive reviews so the board never becomes the reason a launch slipped. Larger groups stall, and boards that meet quarterly become ceremonial.

No, and it should not try. A risk tiered intake process sends high risk systems to full review, routine deployments through a streamlined checklist, and exempt uses straight through. Boards that review everything review nothing well.

Written decision rights: approve, approve with conditions, or halt, plus a defined escalation path when a business unit disagrees. A board with no authority is governance theater, and sophisticated buyers, auditors, and regulators can tell the difference quickly.

Mostly, yes. Intake forms in Microsoft Forms or a ServiceNow catalog item, routing and approvals in Power Automate or ServiceNow workflows, the model inventory in SharePoint or Lists, and review queues in a dedicated Slack or Teams channel. The process design matters far more than the platform, which is why we build the process first and fit it to your stack.

The plumbing: intake, routing, evidence collection, reminders, logging, and audit trails. The judgment, deciding whether a system’s risk is acceptable, stays human. Automating the plumbing is exactly what makes the human part fast enough that teams stop routing around it.

Yes. A disciplined SharePoint list with owner, purpose, data, risk tier, and next review date outperforms an expensive platform nobody updates. Graduate to dedicated tooling when volume demands it, not before.

No. Software amplifies a defined process and calcifies an undefined one. Design the framework, run it manually for a quarter, then automate what proved necessary. Organizations that buy platforms first usually end up paying twice.

Yes. iTutorGroup paid $365,000 to settle the EEOC’s first AI hiring discrimination action. SafeRent settled tenant screening bias claims for over $2 million. Mobley v. Workday was certified as a collective action in May 2025 over age discrimination in AI screening, and the Department of Justice has settled with employers over AI generated job ads that excluded protected groups. The enforcement era is not coming, it is here.

Existing law, not new AI statutes. Discrimination claims under Title VII, the ADEA, and the Fair Housing Act, consumer protection actions, and privacy violations are where AI cases are actually being brought. If your AI touches employment, credit, housing, or health data, your exposure predates every AI law on the books.

A growing patchwork: Colorado’s AI Act, New York City’s Local Law 144 requiring bias audits for hiring tools, Illinois biometric and video interview laws, state attorney general activity, and sector regulators from the FTC to state insurance commissioners. The patchwork is harder to track than one comprehensive law, which is exactly why a framework beats point solutions.

Algorithmic tools in admissions and enrollment that create discrimination exposure, research data flowing into AI systems outside IRB visibility, FERPA implications of third party edtech AI, and no institutional structure connecting any of it. Universities govern research rigorously and often govern AI not at all, and the gap between the two is widening every semester.

Inference risk: AI drawing health conclusions from purchasing patterns, device outputs, and aggregated signals that were never classified as health data. Device telemetry ethics, supply chain AI, and HIPAA adjacent uses that fall outside existing compliance structures round out the list. The data infrastructure carries the risk long before a clinical algorithm does.

Arguably more than for enterprises: the same laws apply, but with fewer controls, no compliance department, and less margin to absorb a six figure settlement. Governance for a mid sized organization is right sized, a lean framework and a clear accountability map, not an enterprise bureaucracy. That is what our Governance Fundamentals tier exists for.

Know what you have and how mature you are. Take the free AI maturity assessment to locate yourself on the five level scale, then build the model inventory. Those two artifacts turn governance from an abstract worry into a prioritized to do list, and both can exist within two weeks.