AI governance and the EU AI Act
Roles, overview and risk assessment around AI use, and what the EU regulation on artificial intelligence means in practice.
What AI governance is
AI governance is the roles, rules and routines that make sure AI is used deliberately: who may decide, which uses exist, what risk they carry and how they are followed up. It is part of wider IT governance and builds on the same disciplines as risk management, data protection and supplier governance.
Frameworks such as COBIT and ISO standards for AI management systems can support the work, but they must be scaled to the company. A mid-sized company rarely needs a heavy system, but a manageable set of agreements.
The EU AI Act in brief
The Artificial Intelligence Act (Regulation (EU) 2024/1689) classifies AI systems by risk: prohibited uses, high-risk systems with stricter requirements, systems with transparency obligations and systems with minimal risk. It is phased in step by step, and the obligations depend on whether the company develops, imports or merely uses a system.
Most production and logistics companies are in the role of user. For them the first steps are to get an overview of which AI systems are in use, assess whether any could be high-risk, ensure AI literacy among those who use the systems, and know the supplier's responsibilities. Concrete deadlines and requirements should always be checked against the current text.
An overview as the first step
A register of AI uses with purpose, data, owner and risk assessment is the most useful single tool. It makes it possible to answer questions from management, customers and authorities, and it is the basis for everything else.
The register is tied to existing processes so that new uses are seen before they go live.
Other topics
Get in touch
If you have a question or a comment about anything on this site, you are welcome to write. We reply when we can.
Your message was not sent. Check the email address and try again — or write to [email protected].