The AI Act's longer runway is an opportunity to build governance that lasts

The EU AI Act's extended timeline presents a valuable opportunity for organizations to establish lasting governance practices. While the regulation has pushed back deadlines for implementing transparency duties and compliance for many high-risk systems, it is crucial for companies to focus on building institutional governance capabilities rather than merely meeting compliance deadlines.

The extension provides valuable time to assess existing AI systems, ensure reliable documentation of tools and processes, and develop governance frameworks that can adapt to the rapidly evolving technology landscape. Organizations that have already implemented robust privacy, security, risk management, accountability, and operational governance practices are well-positioned to leverage these disciplines to meet AI Act requirements.

By extending and adapting these existing governance practices to AI, rather than starting from scratch, companies can more effectively navigate the complexities of the regulation. A key aspect of AI governance is understanding data treatment, service and model changes, incident response, support for transparency duties, and providing evidence to regulators.

Even when using third-party models, organizations must still govern their selection, configuration, and usage. The concept of sovereignty remains relevant, but it should be approached as a realistic goal of compute resilience rather than full control over technology supply chains. Organizations should implement a sovereign-by-design approach, integrating sovereignty considerations into decisions regarding data architecture, vendor selection, and risk management from the outset.

Recognizing that not all datasets, processes, or workloads carry the same level of risk, a tiered approach to sovereignty requirements can be adopted, applying the strongest measures where necessary. Viewing AI governance and sovereignty as interconnected challenges allows organizations to develop a more cohesive and effective approach, ensuring they retain meaningful freedom of action in an increasingly complex and uncertain environment.

Ultimately, the AI Act's extended timeline offers a unique opportunity for organizations to build long-term governance capabilities, rather than treating each regulatory milestone as an isolated deadline. By proactively addressing these challenges, companies can better position themselves for the future of AI and the evolving regulatory landscape.