The AI Act’s longer runway is an opportunity to build governance that lasts | Daily Reports Online
Transparency duties under Article 50 have begun to apply, even as the EU AI Omnibus implementation for many high-risk systems has moved to December 2027 and, for certain AI-enabled products, to August 2028. For organizations building and deploying AI in Europe, the message is clear: regulators extended the timeline on complexity, but not on transparency.
While some organizations may view the extension as welcome breathing room, the time would be far better used preparing for the future of AI. To do that, we need to frame the challenge around creating the conditions for long-term innovation, rather than around compliance deadlines.
Global Chief Privacy and AI Governance Officer at Wipro.
As AI becomes embedded in products, services and decisions that affect people’s lives, organizations need confidence in the systems they are deploying, and users need confidence in the organizations deploying them. That work cannot begin in 2027. It needs to start now.
Latest Videos FromTechRadar
Compliance is achieved at a point in time; governance is built as a capability. A deadline can be moved, but an institutional capability cannot simply be created at short notice.
Start with the AI already in use
The starting point for every organization should be an honest assessment of whether it has a reliable picture of the tools, outputs and interactions that Article 50 covers. As we have seen in recent years, AI systems can quickly become more deeply embedded in business over time as employees explore new tools and suppliers innovate and ship new updates.
This natural expansion is a normal part of adopting a new technology, but it can result in AI becoming a core part of business processes before the proper governance is in place. Governance is most effective when it shapes those decisions from the beginning.
Attempting to retrofit governance after AI has become embedded is significantly more difficult, more expensive and ultimately less effective, and the resulting loss of trust can be more costly than the upfront work required to prevent it.
Extend the controls already in place
The good news is that many of the disciplines required by the legislation should already be familiar. They build on existing practices around privacy, security, risk management, accountability and operational governance, and much of the challenge is around applying established governance disciplines to a rapidly evolving technology landscape.
Organizations that have taken data protection regulation seriously, and already understand impact assessments and effective governance processes, are well positioned to meet many of these requirements – there is considerable overlap.
The task is to extend them for AI, not replace them. A privacy impact assessment can identify data risks, but it cannot on its own establish whether a model is dependable in a particular context, whether someone can meaningfully question its output or whether an automated process disadvantages a group.
Those questions should be built into existing workflows, particularly when AI is bought rather than built. Before a capability is embedded in software or a critical process, organizations need clarity on data treatment, service and model changes, incident response, support for transparency duties and the evidence a provider can supply. Even where the underlying model comes from a third party, organizations still need to govern how it is selected, configured and used.
The sovereignty question
Alongside the AI Act, the other crucial question impacting the way we think about governance in Europe is sovereignty. As the debate gains momentum across Europe, the practical issues raised are becoming clearer. Where is data stored? Which providers do we depend on? How resilient are our technology choices? What happens if commercial, legal or geopolitical circumstances change?
It is worth being precise about what sovereignty can realistically mean for enterprises. Full compute sovereignty, including control over chips, infrastructure and supply chains, is far beyond the reach of most organizations. The more practical goal is compute resilience: understanding where critical dependencies sit, ensuring no single vendor, cloud provider or model becomes a point of leverage, and retaining control over the layers of the AI stack that remain within the organization’s influence.
Open source can support this by providing greater transparency and control over code, but it does not remove infrastructure dependency on its own. An organization may use an open model and still rely on external compute or cloud capacity to operate it.
Organizations should adopt a sovereign-by-design approach to innovation. Sovereignty should not be considered after technology decisions have been made, it needs to be embedded into decisions on data architecture, vendor selection and risk management from the outset, with resilience, not full independence, as the realistic target.
It is also important to note that not every dataset, process or workload carries the same level of risk. Organizations should take a tiered approach, applying the strongest sovereignty requirements where data sensitivity, regulatory exposure or operational importance demand it.
These are not abstract concerns. Viewing AI governance and sovereignty as interconnected challenges creates an opportunity to build a more coherent approach. This is not a case for technological isolation or for stepping back from global technology ecosystems, the aim is narrower than that. It is about ensuring organizations retain meaningful freedom of action in an increasingly complex and uncertain environment.
The real opportunity
The debate about innovation, regulation and sovereignty will continue. Europe will keep refining its approach to AI, and organizations will keep adapting to new technologies, new providers and new risks. The more important question is whether organizations use this window to build the capabilities they will need long term, rather than treating each regulatory milestone as a separate deadline.
Governance should not be viewed as a compliance exercise that slows innovation. It is an institutional capability that enables organizations to innovate sustainably, adopt new technologies with confidence, and remain resilient as markets, regulations and geopolitical conditions evolve.
The ultimate goal is innovation built on trust, and we have the ability to deliver that regardless of regulatory deadlines. The real test is not whether an organization built every part of the system it relies on, but whether it understands its dependencies well enough to change course if circumstances demand it.
Store your data in the cloud with the best cloud storage service.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here:
