Table of Contents
Most enterprises now have more AI systems than they have records of. Somebody in marketing is running a generative tool on a corporate card, a team has embedded a model in a customer-facing flow, and nobody can produce a list. That is the practical problem AI governance solves, before any question of regulation arises.
The regulatory question arrived anyway. Article 50 transparency duties under the EU AI Act applied from 2 August 2026, so EU-facing chatbots must disclose that they are AI and synthetic media must be labelled. The high-risk regime, by contrast, was deferred to December 2027. Both facts are true, and confusing them produces either panic or complacency.
This guide sets out how to build a governance framework that is defensible without stopping the business: the four pillars, how to tier risk, which oversight model to apply where, what belongs in the AI register, and how to stand it up in 90 days.
Where the EU AI Act Actually Stands
Most content on this subject still shows the pre-Omnibus dates. Here is the current position.
| Obligation | Applies from | Note |
| Prohibited practices, AI literacy | 2 February 2025 | Unchanged |
| GPAI model obligations | 2 August 2025 | Unchanged |
| Article 50 transparency | 2 August 2026 | Chatbot disclosure, synthetic media labelling |
| Article 50(2) machine-readable marking | 2 December 2026 | Four-month extension for systems already on the market at 2 Aug 2026 |
| High-risk, Annex III stand-alone | 2 December 2027 | Deferred from 2 August 2026 |
| High-risk, Annex I embedded in regulated products | 2 August 2028 | Deferred |
The deferral came through Regulation (EU) 2026/1744, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force from 27 July 2026, six days before the deadline it moved.
Deferred is not cancelled. The high-risk regime is coming, and the work it requires, namely risk management systems, data governance, technical documentation, logging, human oversight, accuracy and robustness evidence, takes longer than the eighteen months now remaining for Annex III systems. Teams reading the deferral as a reprieve will discover in 2027 that it was a runway.
And transparency is live now. If you have an EU-facing chatbot that does not disclose it is AI, or generative output that is not labelled, that is a present obligation rather than a future one.
The Four Pillars
Policy sets what is allowed, what needs approval, and who approves it. It should be short enough that people read it and specific enough that it answers real questions: can I paste customer data into a public model, who signs off a customer-facing deployment, what happens when a vendor embeds AI in a tool we already use.
Risk tiering decides how much scrutiny each system gets. Without it, governance either blocks everything or nothing.
Human oversight keeps a named person accountable for each system’s outcomes, with the authority and the information to intervene.
Assurance proves all of the above happened: the register, the audit logs, the evaluation evidence. This is the pillar that converts governance from a set of intentions into something you can show a regulator, a customer or a board.
How to Tier AI Risk
Tiering by regulatory category alone is a common mistake; the AI Act’s high-risk definition is narrower than most organisations’ actual risk. Tier on consequence and autonomy together.
| Tier | Characteristics | Controls |
| Prohibited | Banned under Article 5, e.g. social scoring, most emotion inference at work | Do not build. Detect and stop |
| High | Decisions materially affecting people: hiring, credit, health, education, essential services | Full documentation, human oversight, logging, evaluation, DPIA, register entry, named owner |
| Limited | Interacts with people but low consequence: customer chat, content drafting | Transparency disclosure, escalation path, sampling QA, register entry |
| Minimal | Internal productivity, no external effect, no personal data | Acceptable use policy, register entry |
Two rules make this workable. Autonomy escalates a tier: a system that acts rather than recommends moves up. Personal data escalates a tier: anything processing it inherits your existing DPIA obligations regardless of AI classification.
Choosing an Operating Model
| Model | How it works | Suits | Fails when |
| Centralised | One team reviews and approves everything | Regulated, low volume, high consequence | Becomes a queue and gets bypassed |
| Federated | Central policy, business units execute, central assurance samples | Most mid-size and large enterprises | Standards drift without real assurance |
| Embedded | Governance built into the delivery pipeline as gates | Engineering-mature organisations | Misses AI bought rather than built |
Most organisations should aim at federated with embedded gates for anything built in house. The failure mode to design against is the review queue that becomes so slow that teams route around it, because shadow AI is the outcome governance exists to prevent.
Human Oversight That Is Real
The AI Act requires human oversight; it does not require it to be theatre. Three models, applied by tier.
Human in the loop. A person approves each action before it takes effect. Appropriate for high-tier and irreversible decisions. Expensive, and it collapses into rubber-stamping if volume is too high, so measure override rates. An approver who never overrides is not providing oversight.
Human on the loop. The system acts; a person monitors and can intervene or roll back. Appropriate for limited-tier, reversible, high-volume work. Requires real monitoring and a tested rollback.
Human in command. No per-decision involvement, but a named owner sets scope, reviews aggregate performance and can withdraw the system. Appropriate for minimal-tier.
The test for whether oversight is real: can the named person actually stop the system today, and would they know they needed to?
The AI Register
The register is the single highest-value artefact in AI governance and usually the first thing missing. It is also what makes the other pillars auditable.
| Field | Why |
| System name and purpose | Identifies what is in scope |
| Owner, named individual | Accountability with a person, not a department |
| Risk tier and justification | Shows the tiering decision was made, not assumed |
| Data used, including personal data | Links to DPIA and residency obligations |
| Model and vendor | Supply-chain visibility when a provider changes behaviour |
| Human oversight model | Which of the three applies |
| Evaluation evidence and date | Proves quality was measured, not assumed |
| Deployment status and regions | Determines which regimes apply |
| Review date | Governance decays without one |
Start with discovery rather than a form. Ask procurement what AI-adjacent tools have been bought, ask engineering what models are called in production, and check expense data for AI subscriptions. The first pass typically finds systems nobody at the centre knew about, which is the point.
Mapping the Standards
Three frameworks come up, and they are complementary rather than competing.
| Framework | What it is | Use it for |
| EU AI Act | Binding law with extraterritorial reach | Legal obligation where you serve the EU |
| ISO/IEC 42001 | Certifiable AI management system standard | Demonstrating governance to customers and auditors |
| NIST AI RMF | Voluntary risk framework: Govern, Map, Measure, Manage | Structuring internal practice, common in the US |
The practical route for most organisations: use NIST AI RMF to structure how you work, ISO/IEC 42001 if customers or procurement ask for certifiable assurance, and treat the AI Act as the compliance floor wherever you have EU exposure.
Standing It Up in 90 Days
- Days 1 to 30, discover and decide.Build the first register through discovery. Draft the policy. Agree the tiering criteria and the operating model. Name owners.
- Days 31 to 60, tier and control.Tier everything in the register. Apply oversight models by tier. Close the gaps on anything high-tier or EU-facing, prioritising live Article 50 obligations.
- Days 61 to 90, assure and operationalise.Stand up audit logging and evaluation evidence. Run the first assurance sample. Set review cadences. Embed gates into the delivery pipeline so new systems arrive governed rather than being retro-fitted.
The most common failure is starting with the policy document. A policy written before the register exists governs an imagined estate rather than the real one.
Conclusion
AI governance is not a compliance project that ends. It is an operating capability: knowing what you run, how risky each system is, who is accountable, and being able to prove it.
The regulatory calendar gives a clear sequence. Article 50 transparency is live now. The high-risk regime lands in December 2027 for stand-alone systems, which sounds distant and is not, given the documentation and evaluation evidence it requires.
If you need this built rather than described, our AI governance implementation practice runs the register, tiering and assurance work, and AI consulting covers the readiness assessment if you are earlier than that.
FAQ
Q: What is an AI governance framework?
A structure with four pillars: policy setting acceptable use and approval routes, risk tiering deciding how much scrutiny each system gets, human oversight keeping a named person accountable, and assurance proving compliance through an inventory, audit logs and evaluation evidence. It is what lets an organisation say what AI it runs, how risky each system is, and who is responsible.
Q: When do the EU AI Act obligations actually apply?
Prohibited practices and AI literacy applied from 2 February 2025 and GPAI obligations from 2 August 2025. Article 50 transparency duties applied from 2 August 2026, with a four-month extension to 2 December 2026 for machine-readable marking of synthetic content on systems already on the market. High-risk obligations were deferred by the Digital Omnibus, Regulation (EU) 2026/1744, to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in regulated products.
Q: Does the EU AI Act deferral mean we can wait?
No. Deferred is not cancelled, and the high-risk regime requires risk management systems, data governance, technical documentation, logging, oversight and robustness evidence, which takes longer than the time now remaining. Transparency duties are also already live, so EU-facing chatbots must disclose they are AI today.
Q: How do you tier AI risk?
On consequence and autonomy together, rather than on regulatory label alone. Prohibited systems must not be built. High tier covers decisions materially affecting people. Limited tier covers systems interacting with people at low consequence. Minimal tier covers internal productivity use. Two escalation rules: a system that acts rather than recommends moves up a tier, and anything processing personal data moves up a tier.
Q: What is an AI register and what goes in it?
An inventory of every AI system in the organisation. Each entry should carry the system name and purpose, a named owner, the risk tier and its justification, the data used, the model and vendor, the human oversight model, evaluation evidence and date, deployment status and regions, and a review date. Build the first one through discovery rather than by circulating a form.
Q: What is the difference between ISO 42001, NIST AI RMF and the EU AI Act?
The EU AI Act is binding law with extraterritorial reach. ISO/IEC 42001 is a certifiable management system standard used to demonstrate governance to customers and auditors. The NIST AI RMF is a voluntary framework structuring internal practice around Govern, Map, Measure and Manage. They are complementary: NIST for how you work, ISO for provable assurance, the AI Act as the legal floor.
Q: What does meaningful human oversight look like?
One of three models applied by risk tier: human in the loop approving each action, human on the loop monitoring and able to intervene or roll back, or human in command setting scope and reviewing aggregate performance. The test is whether the named person can actually stop the system today and would know they needed to. Measure override rates, because an approver who never overrides is not providing oversight.
Q: How long does it take to set up AI governance?
About 90 days for a working framework on an existing estate: discovery and policy in the first month, tiering and controls in the second, assurance and operationalisation in the third. Starting with the policy document rather than the register is the most common cause of it taking longer.
