The EU AI Act is now in force. Most organisations subject to it are not ready. That gap is not primarily a technical problem. It is a governance problem, and it will not be resolved by the same compliance machinery that organisations have applied to every regulation that came before it.
AI regulation is different in kind from what most compliance functions have encountered. The obligations it creates do not map cleanly onto controls that can be documented, audited, and signed off. They require ongoing human judgment about systems that behave probabilistically, that change over time, and that produce outputs that cannot always be predicted or explained. Treating this as a standard compliance exercise produces an illusion of readiness that regulators will not find convincing.
What the Act actually demands
The EU AI Act establishes a risk-tiered framework. High-risk AI systems, those used in credit decisioning, employment screening, critical infrastructure management, and a range of other regulated contexts carry significant obligations around transparency, human oversight, data governance, and ongoing monitoring.
The obligations themselves are not the hard part. The hard part is that they require institutional accountability structures that most organisations have not built. Who owns the decision to deploy a high-risk AI system? Who is responsible for monitoring its performance against the criteria that justified its approval? Who has the authority to suspend it when performance degrades or context changes?
These are governance questions. The AI Act does not answer them. It requires organisations to answer them, and to demonstrate that the answers are operational rather than theoretical.
Why existing compliance models fail here
The compliance approach most organisations will reach for first is documentation. Map the AI systems in use. Classify them by risk tier. Produce conformity assessments for those in scope. File the paperwork. Repeat at the next review cycle.
This model has a structural flaw when applied to AI. AI systems are not static. A model trained on data from one period behaves differently when the underlying distribution shifts. A system that performed within acceptable parameters at deployment may drift outside them without any change to the system itself. Documentation that was accurate at the time of conformity assessment may be misleading six months later.
The Act anticipates this. Its requirements for post-market monitoring and logging are not administrative formalities. They reflect a regulatory view that AI compliance is a continuous operating condition, not a point-in-time certification. Organisations that treat it as the latter will find themselves technically compliant and practically exposed.
The governance operating model that is missing
What most organisations lack is not awareness of the AI Act. It is a governance operating model that makes compliance sustainable.
A governance operating model for AI requires, at minimum, clear ownership of each high-risk system at a named individual level rather than a function level. It requires decision rights that are explicit about who can approve deployment, who can escalate concerns, and who has authority to withdraw a system from use. It requires a monitoring cadence that is proportionate to the risk the system carries and the rate at which its operating context changes.
It also requires that the organisation has resolved a foundational question that many have not: what does human oversight actually mean for their AI deployments? The Act requires meaningful human oversight of high-risk systems. Meaningful is doing significant work in that sentence. An override button that nobody exercises, or a review process that rubber-stamps model outputs, does not satisfy the intent. Regulators will probe this directly.
The implications for decision-makers
Boards and executive teams that treat AI Act compliance as a project to be delivered by the legal or compliance function are setting themselves up for a difficult regulatory conversation.
The obligations the Act creates sit at the intersection of technology, operations, and governance in a way that no single function can own. The compliance function can map requirements. It cannot, on its own, build the accountability structures, the monitoring infrastructure, or the decision-making processes that genuine compliance requires.
Organisations that navigate this well will be those that recognise AI governance as a cross-functional operating discipline rather than a compliance deliverable. They will invest in the institutional capacity to make and record decisions about AI systems on an ongoing basis, not just at the point of deployment.
The EU AI Act will expose a divide between organisations that have built this capacity and those that have produced documentation in its place. That divide will be visible to regulators, and increasingly to the organisations themselves, well before any formal enforcement action arrives.
