Topic starter
10/07/2026 9:07 pm
TL;DR: The EU AI Act’s high-risk deadlines were pushed back to December 2027 for standalone systems and August 2028 for product-embedded systems, but the underlying obligations for risk management, data governance, logging, transparency, and human oversight did not change, according to JupiterOne. The delay buys time only for organisations that use it to build live AI inventory and evidence-ready controls, not for those treating compliance as a filing exercise.
Editorial analysis by NHI Mgmt Group, based on content published by JupiterOne: “The AI Act Slowed Down. Your AI Didn't”.
Key questions
Q: How should organisations prepare their AI inventory for EU AI Act compliance?
A: Start by building a complete inventory of every AI system in use or development, then classify each one by risk level and business purpose.
Q: Why does AI governance fail when asset discovery and compliance attestation are separate?
A: Because discovery tells you what exists, while attestation tells you what you believe is controlled.
Q: What are the signs that an AI compliance programme is not evidence-ready?
A: Common signs include shadow AI in business units, model records that do not match cloud reality, undocumented datasets feeding production systems, and access paths that security cannot trace to named owners.
Practitioner guidance
- Build a continuously updated AI inventory Track each model, dataset, AI service, owner, deployment location, and connected workload as a living record rather than a one-time register.
- Map AI controls to live evidence Tie each high-risk obligation to technical checks that validate current logging, transparency, oversight, and data governance state in production.
- Include machine identities in AI governance scope Review service accounts, API keys, tokens, and workload identities that can invoke or feed AI systems, then assign ownership and review cadence.
Bottom line: The article shows that the EU AI Act delay mostly buys time for organisations that still need a live AI inventory, not for those already able to prove control state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:30 pm
Live AI inventory is now a governance control, not an asset-management convenience. The article is right to frame the inventory gap as the hidden dependency beneath risk management, logging, transparency, and oversight. If an AI system is not continuously known, those obligations become aspirational statements rather than testable controls. Practitioners should treat inventory freshness as a compliance boundary, not a reporting preference.
A question worth separating out:
Q: Why do AI governance rules increase the importance of identity and access management?
A: Because AI rules depend on proving who approved use, who can change the system, and who can access the data it touches. IAM and IGA provide the audit trail for those questions. Without identity-linked ownership and entitlement control, organisations cannot demonstrate accountability when regulators request evidence of decisions or incidents.
👉 Read our full editorial: EU AI Act delay exposes the AI inventory gap in enterprise governance