Topic starter
02/06/2026 12:58 pm
TL;DR: The EU AI Act applies to organisations that place AI systems or general-purpose AI models on the EU market, put them into service, or use them in the EU, and it sets staggered obligations from February 2025 through August 2027, according to Delinea. Policy alone is not enough; identity visibility, access control, and auditability now determine whether AI can be governed in motion.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “EU and AI: What you need to know about AI regulations”.
By the numbers:
- The AI Act entered into force on August 1, 2024, and the broader regime applies from August 2, 2026, while certain high-risk systems embedded in regulated products follow on August 2, 2027.
- The law can fine organisations up to €35 million or 7% of worldwide annual turnover for certain infringements.
Key questions
Q: How should organisations classify AI systems for EU AI Act compliance?
A: Start with intended use, not technical complexity.
Q: Why is policy alone not enough for AI compliance?
A: Because the EU AI Act asks for evidence of controlled operation, not just stated intent.
Q: What do security teams get wrong about AI governance reviews?
A: They often treat every use case as if it needs the same level of scrutiny.
Practitioner guidance
- Inventory all AI uses across the business Include embedded SaaS features, copilots, internal assistants, and third-party tools so the organisation can classify what is in use and who owns it.
- Classify AI systems by role and risk Separate provider, deployer, and general-purpose model obligations, then map use cases to risk category, geography, and business impact.
- Map identity and access behind each AI system Document what identity each AI capability acts under, what data it can touch, and which permissions are overprivileged for the use case.
Bottom line: The EU AI Act changes AI governance from a policy exercise into a control challenge that depends on inventory, access scope, and auditability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 1:00 pm
The EU AI Act is converting AI governance into an identity and control discipline. That is the real shift beneath the legal language: organisations now have to prove who or what acted, under which authority, with what access, and with what evidence afterward. Policy documents cannot answer those questions on their own. The implication is that AI governance now belongs inside access governance, auditability, and ownership models, not alongside them.
A few things that frame the scale:
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: What should teams do when vendor AI is embedded in internal workflows?
A: Treat it as part of your own control surface and assign a clear owner, because deployer obligations do not disappear when the model comes from a supplier. Teams should document what the AI can reach, what data it processes, and how they would explain the action later. That is the only way to preserve accountability through procurement and legal delegation.
👉 Read our full editorial: EU AI Act turns AI governance into a control challenge