Topic starter
19/08/2026 3:24 pm
TL;DR: A possible EU AI Act delay changes deadlines, not the need for governance, because safety, trust, and accountability depend on what organisations do internally rather than on regulatory timing, according to Holistic AI. The broader lesson is that compliance can set a floor, but it cannot replace inventory, ownership, testing, and operating discipline.
Editorial analysis by NHI Mgmt Group, based on content published by Holistic AI: “If Compliance is Soley your North Star, You’ve Already Lost”.
Key questions
Q: What breaks when AI adoption outpaces governance?
A: What breaks first is attribution.
Q: Why does a delay in AI regulation not remove the need for internal controls?
A: Because regulation sets external obligations, but it does not create the organisation’s operating discipline.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Establish a full AI inventory Catalogue every model, embedded AI feature, workflow and externally sourced system in use, and assign a named owner for each one.
- Map risk and accountability before policy refinement Record the intended use, affected users, material risks and decision owner so governance discussions start from evidence rather than assumptions.
- Run recurring red teaming and jailbreak testing Test systems on a schedule for unsafe outputs, prompt abuse, drift and boundary failures, then track remediation through to closure.
Bottom line: AI regulation delay does not change the fact that organisations still need inventory, ownership and testing for the systems they already run.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:09 pm
Compliance is a floor, not a governance model. A delay in the EU AI Act may change enforcement timing, but it does not change the operational reality that AI systems still need ownership, testing and accountability. Organisations that treat regulation as the end state will always run behind the actual risk surface. The practitioner conclusion is simple: govern the system first, then map the regulation onto it.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations structure AI governance before focusing on compliance?
A: Start by defining ownership, risk tolerance, approval paths, data access boundaries, and monitoring responsibilities. Compliance becomes achievable when those controls already exist in day-to-day operations. Without that structure, teams end up chasing requirements reactively and cannot prove that AI systems were controlled when decisions were made.
👉 Read our full editorial: Compliance is not governance in AI regulation, and delay changes little