Topic starter
11/11/2026 6:00 pm
TL;DR: 16 months is the window IndyKite cites for most high-risk AI systems to meet Articles 10 to 15, including data governance, documentation and oversight. AI governance has to be enforced at runtime, or compliance evidence will not survive operational use.
Editorial analysis by NHI Mgmt Group, based on content published by IndyKite: “How to prepare for EU AI Act compliance”.
Key questions
Q: Why do MCP-based AI workflows need runtime authorization checks?
A: They need runtime checks because the right to call a tool can change as the session evolves, the task expands, or the risk of an action rises.
Q: Why is traceability so important in AI governance?
A: Because AI decisions are difficult to defend without evidence of what data was used, what system acted, and who approved the workflow.
Q: How should security teams structure EU AI Act compliance for AI systems?
A: Start with a complete AI inventory, then classify each system by risk tier and map the required controls to that tier.
Practitioner guidance
- Map high-risk AI systems end to end Inventory each system's data sources, tools, connected services and delegated workflows so Articles 10 to 15 can be assessed against actual operation, not architecture diagrams.
- Bind access decisions to runtime context Use purpose, sensitivity, consent, workflow state and prior actions to decide whether an AI system should continue, escalate or stop at each step.
- Preserve decision evidence across workflows Record the initiator, participating systems, data accessed, policies evaluated and resulting actions so compliance evidence survives operational use and review.
Bottom line: The EU AI Act turns many enterprise AI deployments into governed systems that must prove how they access data and make decisions.
Glossary terms: High-Risk AI System, Context-Aware Policy, Human Oversight, Runtime Authorisation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
EU AI Act readiness is now an evidence engineering problem. The hard part is not understanding that high-risk systems need controls. The hard part is proving those controls operated continuously across data access, tool use and output generation. Enterprises that separate governance policy from runtime enforcement will struggle to show compliance when a system is asked to justify a specific decision.
A question worth separating out:
Q: What should security teams prioritise first for EU AI Act readiness?
A: Security teams should first inventory AI systems, classify their risk, and map the data, models, vendors and human owners behind each one. From there, they can assign governance controls such as access logging, model change control, supplier reviews, and restricted use of training data or prompts where sensitive information is involved.
👉 Read our full editorial: EU AI Act high-risk AI needs evidence for live compliance