Topic starter
21/08/2026 4:46 pm
TL;DR: Embedded AI in third-party software expands EU AI Act compliance scope, with KOBIL framing inventory, classification, and oversight as governance tasks that must cover systems companies do not fully control. Identity-bound logs and traceable approvals are what make that wider perimeter defensible in practice.
Editorial analysis by NHI Mgmt Group, based on content published by KOBIL: “The EU AI Act: What companies need to know in 2026”.
By the numbers:
- Violations of the EU AI Act can result in fines of up to €35 million or 7% of global annual turnover, whichever is higher.
Key questions
A: SMEs should start with core controls that address their highest risks, then expand as needs grow.
Q: What breaks when AI agent governance is treated as access control?
A: The control boundary breaks first.
Q: How should organisations govern embedded AI in third-party software under the EU AI Act?
A: Treat embedded AI as part of your own governance perimeter, even when the model or platform is supplied by a third party.
Practitioner guidance
- Inventory every AI system and embedded AI function Build a live register that includes internal models, SaaS features, cloud-hosted capabilities, and third-party embedded AI so ownership and risk classification are never inferred.
- Separate AI development, approval, and production access Limit who can train, change, test, approve, and deploy AI systems, and make those roles visible in IAM and PAM workflows.
- Bind AI actions to verified identities in logs Require identity-bound logging for model changes, data access, approvals, and overrides so audit trails support both governance and regulatory evidence.
Bottom line: The EU AI Act turns AI oversight into a governance problem that depends on identity, access, and auditable responsibility, not just policy language.
Glossary terms: AI Governance, Identity-bound logging, High-Risk AI System, Human Oversight
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/08/2026 5:06 pm
AI Act compliance is becoming an identity governance test, not just a legal checklist. The regulation only works in practice when organisations can prove who accessed, changed, approved, and monitored AI systems. That shifts AI governance into the same control territory as privileged access, logging, and accountability. For identity teams, the compliance question is no longer whether AI exists, but whether each AI action can be tied to a verified identity and an authorised role.
A question worth separating out:
Q: How should security teams separate oversight of AI systems from normal user access?
A: Use distinct roles for development, testing, approval, and production operation, then require review workflows that cannot be bypassed by the same person or team. Oversight needs procedural separation and technical enforcement, not just policy statements.
👉 Read our full editorial: EU AI Act compliance exposes the identity gap in AI governance