The EU Artificial Intelligence Act entered into force in August 2024 and its obligations apply in stages over several years. Some provisions, including the ban on prohibited practices and the requirement to promote AI literacy among staff, already apply. Others — notably the detailed requirements for high-risk systems — follow later, and implementation guidance and standards continue to evolve.
For governance, risk, compliance and audit professionals, that uncertainty is not a reason to wait. The foundations look familiar: know what you have, assess the risk, assign accountability, design controls and test them.
Six steps to start now
- Build an AI inventory. Record AI systems in use or development, including AI embedded in purchased software.
- Classify use cases. Map each system against the Act’s categories: prohibited, high-risk, transparency obligations or minimal risk.
- Clarify your role. Obligations differ for providers and deployers. Many organisations are both.
- Assign ownership. Name accountable owners for each system and agree how AI risk reaches the board.
- Design controls. Data governance, human oversight, logging, testing for accuracy and robustness, and change management.
- Plan assurance. Decide how the second and third lines will review AI controls; frameworks such as ISO/IEC 42001 can help structure the work.
AI governance is not a new discipline built from scratch. It is the control professions applied to a new kind of decision-maker.
Check the current implementation timetable before committing to deadlines, and track guidance from the European Commission and national authorities as it is published.
