AI Regulation

For an organisation that serves EU markets, yes: the obligations follow the market, not the registered office, and 450 million consumers make the EU a non-optional market for most organisations serving global markets. The Act’s risk-based tiers, phased from February 2025 to August 2028 after the 2026 deferral, determine what each of the organisation’s systems must demonstrate, so the first step is a comprehensive exposure assessment that maps every AI system, including those embedded in third-party tools, against those tiers.

Both are defensible, and so is deliberately specialising in a single regime; what is not defensible is failing to choose. I set out three strategic stances: principled standardisation works when stakeholders value consistency over optimisation, adaptive localisation when the organisation can carry the complexity without losing its identity, and sovereign specialisation when regional depth matters more than global breadth. The test is which currency the organisation’s markets actually reward: trust, speed, or control.

The argument runs the other way more often than Boards expect. Clear rules give organisations the certainty to invest, the stringent requirements concentrate on high-risk uses while leaving most applications lightly touched, and compliance capability itself can become a differentiator: organisations that govern AI efficiently reduce the compliance tax on innovation and earn a trust premium in markets where trust determines access. The organisations at a disadvantage are those paralysed by regulatory uncertainty, not those equipped to navigate it.

Quite possibly. Since 5 February 2026 the UK regime has required four safeguards for any significant decision taken solely by automated processing: information, representations, human intervention, and the right to contest. Rule-based systems carry that capability on the surface; probabilistic systems do not, and most were approved on accuracy metrics rather than on evidence they could explain a decision to the person it affected. The Board’s move is to inventory approved systems by the character of their decision logic and treat the four safeguards as capability tests, not policy positions.

Less than the compliance industry suggests. The GPAI Code rewards demonstrable progress and good faith rather than perfection, and the AI Act’s tiers build proportionality in. The operating principle I recommend is Minimum Lovable Governance: documentation proportionate to risk, governance embedded in how work happens rather than bolted on, and Board reporting focused on material risks and opportunities rather than compliance metrics. Most systems need a paragraph, not a dissertation; the discipline is knowing which systems need more.

Less than the headlines suggest. The 2026 amendment moved the obligations for standalone high-risk systems, hiring, credit, and education among them, from 2 August 2026 to 2 December 2027, and those for high-risk AI embedded in regulated products to 2 August 2028. The rest held: from 2 August 2026 people must be told when they are interacting with AI, the AI literacy duty has applied since February 2025, and two new prohibitions arrive on 2 December 2026. The more revealing question is what changed in the organisation’s oversight when the date moved: anything beyond filing dates means the governance was anchored to the statute, not the systems in production.

The Act reserves the high-risk tier for systems that can affect people’s health, safety, or fundamental rights: in standalone form, the software that screens job applicants, scores credit, or selects students; in embedded form, AI inside regulated products such as machinery, medical devices, and vehicles. By the Act’s own design most deployments land in the limited or minimal tiers. The answer takes an exposure assessment that maps every system, including those inside third-party tools, against the tiers, and a written, defensible determination for each. In my experience classification is where organisations are furthest behind, and the deferral bought time to do it properly, not permission to stop.

No. The UK has declined to pass an AI statute and asks its existing regulators, the FCA, ICO, CMA, and Ofcom among them, to govern AI at the point of use, so obligations arrive by sector, not in one Act. Some are already hard law: since 5 February 2026 the UK GDPR, as amended by the Data (Use and Access) Act 2025, has required four safeguards for any significant decision taken solely by automated processing, with an ICO statutory code on AI in preparation. Beneath it sit directors’ duties under the Companies Act 2006, which never depended on an AI law. Less legislation means more judgement, not less obligation.