For a while, AI governance was something firms could treat as a future problem. Write a policy eventually, once things settled down. That window is closing, because the regulation now has dates attached, and some of them are close.
The environment is moving faster than most firms’ internal frameworks. Obligations that were abstract a year ago are becoming concrete, with compliance expectations that assume you already know things most firms haven’t checked.
What’s actually changing
There are now mandatory safeguards around automated decision-making that materially affects individuals. In practice that means being able to tell someone a significant decision was made about them, letting them challenge it, and providing genuine human review rather than a nominal sign-off. Guidance on what counts as meaningful human involvement is still being finalised, which is itself worth watching, because the bar may end up higher than a quick human glance at a model’s output.
For firms with EU employees or customers, a further set of obligations covering higher-risk AI systems comes into force in August 2026. It runs in parallel to the domestic framework and isn’t automatically satisfied by it. So a firm that’s handled its local obligations can still be exposed on the EU side without realising the two are separate.
The problem most firms have
The requirement that trips people up isn’t complicated. It’s that you have to know where AI is making or influencing significant decisions about individuals. Not roughly. Specifically, and currently.
Most firms can’t produce that list. AI has crept into processes incrementally, a tool here, an integration there, and no one has a complete, current map of where it’s actually shaping outcomes that affect real people. You can’t demonstrate compliance for something you haven’t mapped. And the discovery that you’re already inside a regulated activity, without the infrastructure to show you’re handling it properly, is not one you want to make during an incident or an audit.
This isn’t a reason to panic
It’s a reason to do a specific, unglamorous piece of work: find out where AI is influencing decisions about people in your firm, and get honest about whether you could explain and defend those decisions if asked. That exercise is useful regardless of the regulation, because the places where AI is quietly making consequential calls are exactly the places where an ungoverned error would hurt most.
The firms that map this before they’re required to end up in a better position on two fronts. They’re ready for the compliance requirement, and they’ve found the risky spots in their own AI use before those spots found them. The ones treating governance as paperwork to generate later usually generate it in a hurry, after something has already gone wrong, which is the worst time to start thinking clearly about it.