Topic starter
21/08/2026 4:46 pm
TL;DR: The EU AI Act creates a risk-based compliance regime for AI systems, including embedded functions in third-party software and cloud platforms, and KOBIL says companies now need systematic inventory, documentation, transparency, human oversight, and AI literacy controls. For practitioners, the key issue is that AI governance is becoming an identity, access, and accountability problem, not just a legal one.
Editorial analysis by NHI Mgmt Group, based on content published by KOBIL: “The EU AI Act: What companies need to know in 2026”.
By the numbers:
- Violations of the EU AI Act can result in fines of up to €35 million or 7% of global annual turnover, whichever is higher.
Key questions
Q: How should organisations govern embedded AI in third-party software under the EU AI Act?
A: Treat embedded AI as part of your own governance perimeter, even when the model or platform is supplied by a third party.
A: SMEs should start with core controls that address their highest risks, then expand as needs grow.
Q: What breaks when AI agent governance is treated as access control?
A: The control boundary breaks first.
Practitioner guidance
- Inventory every AI system and embedded AI function Build a live register that includes internal models, SaaS features, cloud-hosted capabilities, and third-party embedded AI so ownership and risk classification are never inferred.
- Separate AI development, approval, and production access Limit who can train, change, test, approve, and deploy AI systems, and make those roles visible in IAM and PAM workflows.
- Bind AI actions to verified identities in logs Require identity-bound logging for model changes, data access, approvals, and overrides so audit trails support both governance and regulatory evidence.
Bottom line: The EU AI Act turns AI oversight into a governance problem that depends on identity, access, and auditable responsibility, not just policy language.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:06 pm
AI Act compliance is becoming an identity governance test, not just a legal checklist. The regulation only works in practice when organisations can prove who accessed, changed, approved, and monitored AI systems. That shifts AI governance into the same control territory as privileged access, logging, and accountability. For identity teams, the compliance question is no longer whether AI exists, but whether each AI action can be tied to a verified identity and an authorised role.
A question worth separating out:
Q: How should security teams separate oversight of AI systems from normal user access?
A: Use distinct roles for development, testing, approval, and production operation, then require review workflows that cannot be bypassed by the same person or team. Oversight needs procedural separation and technical enforcement, not just policy statements.
👉 Read our full editorial: EU AI Act compliance exposes the identity gap in AI governance