Topic starter
24/10/2026 8:46 pm
TL;DR: December 2027 marks the later timetable in Anjuna's case work on the EU AI Act, which says transparency duties are already enforceable while high-risk obligations follow later. AI governance now needs current inventories, traceable ownership, and audit-ready oversight to stay defensible as systems change.
Editorial analysis by NHI Mgmt Group, based on content published by Anjuna: “The EU AI Act Compliance Guide: Best Practices for Enterprises”.
By the numbers:
- The EU AI Act carries maximum fines of €35 million or 7% of annual turnover for prohibited AI practices, according to Anjuna.
- High-risk AI system or GPAI non-compliance can trigger maximum fines of €15 million or 3% of global annual turnover, according to Anjuna.
- Providing incorrect or misleading information to authorities can result in maximum fines of €7.5 million or 1% of global annual turnover, according to Anjuna.
Key questions
Q: Why do high-risk AI systems require stronger governance than ordinary AI tools?
A: High-risk systems can affect employment, finance, health, or other sensitive outcomes, so regulators expect traceability, transparency, and human intervention.
Q: What breaks when AI governance is only a one-time review?
A: A one-time review breaks as soon as the agent gains a new tool, a new dataset, or a new workflow.
Q: How should organisations prove EU AI Act compliance across the AI lifecycle?
A: They should treat compliance as a continuous evidence chain that spans design, development, deployment, and post-market monitoring.
Practitioner guidance
- Map every AI system in scope Inventory all models, chatbots, decision tools, and embedded AI services.
- Classify systems by EU AI Act risk tier Assign each AI use case to minimal, limited, high, or unacceptable risk, then tie required controls to that classification before production use.
- Build evidence into the AI lifecycle Collect technical documentation, logging, disclosure records, and human-oversight evidence during development and change management, not after deployment.
Bottom line: The EU AI Act turns AI governance into a standing operational requirement rather than a one-time legal exercise.
Glossary terms: Risk tiering, High-Risk AI System, AI Transparency, Confidential Computing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
EU AI Act compliance is now a continuous governance problem, not a deadline problem. The article is right to emphasise that annual review cycles are too slow for systems that can change function, user impact, and legal tier over time. For identity and governance teams, the key question is whether AI ownership, logging, and decision traceability are maintained as live controls. Practitioners should treat AI governance as a standing operational discipline.
A question worth separating out:
Q: Should organisations use existing security and privacy frameworks for EU AI Act compliance?
A: Yes, but only as a baseline. Frameworks such as GDPR, ISO 27001, SOC 2, and NIST AI RMF cover overlapping controls, but the Act also introduces AI-specific duties around tiering, transparency, and prohibited practices. The practical task is to map overlap clearly and fill the AI-specific gaps rather than starting from scratch.
👉 Read our full editorial: EU AI Act compliance shifts from policy to continuous governance
This post was modified 6 days ago by NHI Mgmt Group