Artificial intelligence is transforming the way organisations operate, from recruitment and customer service to cybersecurity, legal services and product development. As AI adoption accelerates, so too does regulatory scrutiny, with the EU AI Act in particular marking a significant shift in how organisations are expected to manage AI risks.
The legislation is about far more than technical compliance. It requires organisations to establish clear governance, accountability and oversight for the AI systems they develop, procure and use. This means that, as regulators continue to refine the framework through implementing measures and guidance, organisations should view AI governance as a business priority rather than simply another compliance exercise.
What is the EU AI Act?
The EU AI Act introduces a risk-based approach to regulating AI systems. Rather than applying identical obligations to every AI system, the Act imposes requirements based on the level of risk an AI system presents to individuals and society.
The four risk categories are:
- Unacceptable risk – AI practices that are prohibited
- High risk – AI systems subject to extensive compliance, governance and documentation requirements
- Limited risk – AI Systems with transparency obligations
- Minimal risk – AI systems with limited regulatory requirements
This proportionate framework seeks to encourage innovation while ensuring AI systems are developed and deployed responsibly, safely and transparently.
Does the AI Act apply to your organisation?
The AI Act applies far more broadly than many organisations initially assume. It is not limited to AI developers.
Your organisation may be in scope if you:
- use AI within recruitment or HR processes;
- deploy AI-powered customer service tools;
- use generative AI platforms;
- procure AI-enabled software from third-party vendors; or
- develop AI applications internally.
Importantly, organisations established outside the EU may also be subject to the Act where their AI systems are placed on the EU market, or their outputs are used within the EU.
What changed from 2 August 2026
Although the detailed compliance obligations for many high-risk AI systems have been postponed, 2 August 2026 remains one of the most significant implementation dates under the AI Act. From this date, several important provisions become operational, meaning organisations should now be focusing on governance, accountability and ongoing compliance rather than simply preparing for future obligations.
Key developments taking effect from 2 August 2026 include:
- The European Commission and national authorities begin active enforcement of transparency rules, prohibited practices, and general-purpose AI (GPAI) model rules.
- Organisations will become subject to the transparency obligations set out in Article 50 of the EU AI Act
- Measures in support of innovation start to apply
Recent legislative updates, however, provide organisations with additional time to prepare for certain obligations while also introducing new measures to address emerging AI risks. The latest amendments extend implementation timelines for certain high-risk AI systems, allowing supporting technical standards and guidance to mature before compliance obligations fully apply. Requirements for standalone high-risk AI systems will apply from 2 December 2027, while obligations for AI systems embedded as safety components under EU sectoral legislation will apply from 2 August 2028.
The legislation also postpones AI-generated content watermarking obligations until 2 December 2026. From that date, AI-generated content will need to be labelled in a machine-readable format to enhance transparency and help distinguish synthetic content.
Separately, the amendments introduce an explicit prohibition on AI systems designed to generate child sexual abuse material or non-consensual intimate images, videos or audio. Organisations developing or using AI systems must implement appropriate safeguards before the new rules take effect on 2 December 2026.
In addition, Member States have until 2 August 2027 to establish AI regulatory sandboxes, providing governments with additional time to create controlled environments that support responsible innovation and regulatory engagement.
Governance is becoming the cornerstone of AI compliance
While many organisations have focused on identifying high-risk AI systems, one of the most significant aspects of the AI Act is its emphasis on governance.
Compliance is no longer limited to technical controls. Organisations are increasingly expected to demonstrate structured decision-making, clear accountability, effective oversight, risk management and documented governance throughout the AI lifecycle.
For many organisations, this means moving beyond ad hoc AI adoption towards establishing formal governance structures capable of overseeing AI strategy, risk, legal compliance, procurement, ethics, security and business implementation.
The role of AI Governance Councils
An AI Governance Council can play a critical role in achieving this by bringing together key stakeholders, including legal, privacy, information security, compliance, HR, technology and business leaders, to provide coordinated oversight of AI initiatives.
An effective AI Governance Council can help organisations:
- establish AI governance policies and standards;
- review and approve new AI use cases;
- oversee AI risk assessments and impact assessments;
- monitor compliance with the EU AI Act and other emerging AI regulations;
- define accountability and human oversight mechanisms;
- manage third-party AI vendor risk; and
- provide ongoing governance as AI technologies and regulatory expectations evolve.
As AI regulation continues to develop globally, organisations with mature governance frameworks will be better positioned to demonstrate compliance, respond to regulatory change and build trust with customers, employees and regulators.
Preparing your organisation
Organisations should begin preparing now by taking practical steps to strengthen AI governance and compliance.
- Identify AI usage: develop a comprehensive inventory of AI systems and tools currently being used across the organisation, including internally developed systems, third-party solutions and generative AI platforms.
- Assess risk: determine which AI systems may fall within the AI Act’s risk categories and identify the applicable legal and governance obligations.
- Establish governance: develop an AI governance framework supported by clear policies, approval processes, defined roles and responsibilities, documented risk assessments and appropriate human oversight. Consider establishing a cross-functional AI Governance Council to oversee AI strategy, risk and regulatory compliance across the organisation.
- Monitor third-party AI: review contracts and due diligence processes for AI vendors to ensure appropriate transparency, governance and compliance commitments are in place.
- Train employees: provide role-specific training to ensure employees understand the responsible use of AI, governance expectations, regulatory obligations and emerging risks.
How HewardMills can help
The EU AI Act introduces a new era of AI accountability. To comply, organisations need more than legal and technical advice. They also need practical and robust governance that enables innovation while managing risk.
HewardMills works with organisations to design and implement AI governance frameworks that align with regulatory requirements and industry best practice globally. Through our own AI Governance Council and wider team of multidisciplinary experts, we bring together expertise across legal, privacy, information security, compliance and technology to help organisations establish effective governance, assess AI risks, develop policies, support responsible AI adoption and prepare for evolving global AI regulation.
