AI governance is no longer a voluntary framework. It is a legal obligation, one that most European enterprises have not yet operationalised, with the primary enforcement deadline four months away.
Only 31% of European organisations have a formal, comprehensive AI policy - ISACA AI Pulse Poll, June 2025. For organisations operating across the EU, that gap isn’t just a risk - it’s an existential liability.
The AI Adoption - Governance Gap Is Widening
AI adoption in the enterprise has reached near-universal levels.
According to McKinsey, 88% of companies now use AI regularly in at least one function, up from 78% the previous year. But governance hasn’t kept pace.
The 2024 IAPP Governance Survey found that only 28% of organisations have formally defined oversight roles for AI governance. That highlights a deeper issue: uncertainty around who actually owns responsibility for compliance, ethics, and accountability.
This gap extends all the way to leadership.
- Only 28% of CEOs are directly responsible for AI governance
- Just 17% of boards are involved
- Fewer than 1 in 10 organisations integrate AI risk into development pipelines
This isn’t just a governance issue - it’s a market risk.
While 77% of organisations are working on AI governance, that number jumps to nearly 90% among AI-active companies (IAPP AI Governance Profession Report 2025). The message is clear
The organisations that move early will gain a durable advantage. Those that don’t will face fines, reputational damage, and disruption, and without a functioning AI governance framework, the gap between intent and enforcement exposure only widens.
The Regulatory Stack: What Enterprises Must Navigate
AI compliance today isn’t defined by a single regulation. It’s a stack of overlapping frameworks that organisations must navigate simultaneously.
The EU AI Act: The World’s First Comprehensive AI Law
The EU AI Act (Regulation EU 2024/1689) is the first comprehensive legal framework for AI.
It introduces a risk-based classification model, dividing AI systems into:
- Unacceptable risk - prohibited
- High risk - strictly regulated
- Limited risk - transparency obligations
- Minimal risk - no specific obligations
As of February 2025, prohibited systems such as social scoring and manipulative AI became illegal. By August 2026, high-risk system requirements will be fully enforceable.
Fines range from €7.5M to €35M, or up to 7% of global turnover - exceeding even GDPR in some cases.
For enterprises, the implication is immediate:
Any AI used in HR, credit scoring, healthcare, biometrics, or critical infrastructure must be:
- Classified
- Assessed
- Documented
- Continuously monitored
GDPR: Still the Data Foundation
GDPR remains the baseline for all AI systems processing personal data.
Cumulative fines have already reached €5.88 billion, and enforcement continues to intensify.
AI introduces a fundamental tension: GDPR requires data minimisation, while AI systems perform best with large datasets. Navigating that contradiction is now a core compliance challenge.
NIS2: Cybersecurity Meets AI Infrastructure
The NIS2 Directive expands cybersecurity obligations across critical sectors.
- Penalties: up to €10M or 2% of global turnover
- Direct accountability for senior management
Executives can face fines, legal action, or even bans for failures. As AI systems increasingly sit inside infrastructure and supply chains, they fall directly into NIS2 scope.
DORA: Digital Resilience in Finance
The Digital Operational Resilience Act (DORA) became enforceable on January 17, 2025.
It applies across:
- Banks
- Insurance firms
- Investment platforms
- Fintechs
Any AI or SaaS provider serving financial institutions must demonstrate:
- Operational resilience
- Incident reporting
- Third-party risk management
Failure to do so doesn’t just create risk - it can make clients non-compliant by association.
Core Themes Driving Modern AI Regulation
Accountability: The Leadership Imperative
AI is now embedded in critical decisions - from hiring to healthcare.
Regulators are no longer asking for intent. They are demanding proof of accountability.
Under the EU AI Act:
- High-risk systems require human oversight
- Clear responsibility must be defined
Under NIS2:
- Executives face personal liability
Yet most organisations still distribute AI responsibility across teams without a single owner. That diffusion of enterprise AI governance accountability is exactly what regulators are designed to penalise.
Data Usage and Privacy: Where GDPR Meets Generative AI
Every AI system processing personal data creates GDPR exposure.
Organisations must now evaluate:
- Whether training data was lawfully collected
- Whether outputs reveal personal data
- Whether user rights can be enforced
Enforcement is already happening. AI-specific data practices are no longer theoretical risks - they are actively enforced.
Explainability: The Transparency Mandate
Regulators increasingly require organisations to explain how AI decisions are made.
For high-risk systems, explainability is not optional - it’s a legal requirement.
But this creates tension: Detailed documentation may expose intellectual property, forcing companies to balance transparency with protection.
The Challenge of Multi-Jurisdictional Compliance
For global enterprises, complexity multiplies quickly.
- 550+ AI-related bills introduced across US states
- The UK developing its own AI framework
- India launching an AI Safety Institute
- China advancing AI governance rules
The result is a fragmented landscape with no unified global standard. This isn’t just a legal problem, it’s operational.
The organisations that struggle the most with multi-jurisdictional compliance are not the ones that ignored it; they are the ones that built their AI governance programme around a single framework and then realised that each subsequent regulation required a separate programme rather than an extension of the first. The inventory built for GDPR did not capture what DORA needed. The classification done for the EU AI Act did not satisfy NIS2's supply chain requirements. Three programmes, three teams, and the same AI systems mapped three different ways, and none of the three were complete enough to satisfy any one regulator on its own. - Namita Razdan, Co-Founder, Montro |
Each region requires:
- Separate risk assessments
- Documentation
- Compliance evidence
Without centralised systems, AI compliance becomes a constant bottleneck.
Operationalising Compliance: From Policy to Practice
This is where most organisations fail. Having a policy is not the same as being compliant.
Only one in four organisations have fully operational AI governance - AuditBoard, From Blueprint to Reality, 2025.
Policy without execution is compliance theater.
Real operationalisation requires four capabilities:
1. Application Discovery: A complete inventory of all AI systems, including shadow AI and vendor tools.
2. Risk Classification: AI risk management against EU AI Act, GDPR, NIS2, and other frameworks.
3. Continuous Monitoring: AI systems evolve. Compliance must be ongoing - not point-in-time.
4. Audit-Ready Documentation: Maintaining evidence for regulators across all systems.
This is where AI governance platforms become critical - automating what would otherwise be fragmented, manual work.
The Market Is Responding
AI governance is no longer niche, it’s a growing market.
- Valued at $197.9M in 2024
- Growing at ~49% CAGR through 2034
Large enterprises dominate adoption, but SMEs are catching up as regulations expand.
At the same time:
- Only 1.5% of organisations believe they have enough governance talent (IAPP 2025)
- 23.5% cite lack of expertise as a major barrier (IAPP 2025)
Which is why automation is becoming essential.
What “Compliance Ready” Actually Looks Like
Being compliance-ready isn’t about documentation, it’s about capability.
Organisations must:
- Maintain a live inventory of all AI systems
- Align systems to regulatory risk categories
- Implement human oversight mechanisms
- Continuously monitor system behaviour
- Maintain audit-ready AI compliance records across all systems.
For multinational organisations, this also means navigating country-level variations in NIS2 enforcement, adding another layer of complexity.
The Strategic Case for Proactive Governance
According to Gartner, organisations with mature AI governance are more than twice as likely to sustain AI initiatives beyond three years than those without.
The difference? Governance.
AI governance is not just compliance overhead.
It determines whether AI initiatives:
- Scale
- Survive audits
- Maintain trust
- Avoid multimillion-euro penalties
Final Thought: The Window Is Closing
The next major deadline is August 2026, when high-risk AI obligations under the EU AI Act become fully enforceable.
Organisations that treat governance as an afterthought will struggle.
Those that treat it as an enabler of AI adoption will move faster, safer, and with confidence.
Because in the end:
The companies that win in AI won’t just be the ones who build it fastest - but the ones who can prove it’s controlled, compliant, and trustworthy.
Frequently Asked Questions
What is the difference between AI governance and AI compliance?
Compliance is the minimum, meeting specific regulatory obligations by a deadline. Governance is the operational infrastructure that makes compliance possible and sustainable: the policies, oversight structures, and monitoring mechanisms that keep an organisation on the right side of regulation as tools and rules evolve. An organisation can be compliant on a given date and ungoverned a month later if that infrastructure is not in place.
Which regulation should we prioritise - EU AI Act, GDPR, NIS2, or DORA?
The frameworks are not mutually exclusive, the same AI system can trigger obligations under all four simultaneously. The practical starting point is an AI inventory mapped to the frameworks that apply to each system. For most European organisations, GDPR provides the foundational data governance framework upon which AI compliance obligations are layered, with the EU AI Act's August 2026 deadline the most time-sensitive for organisations with high-risk systems. The inventory determines which frameworks are relevant and in what order.
What does "operationalising" AI governance actually mean in practice?
Having a policy is not the same as being compliant. Operationalising means four things: a complete AI inventory, risk classification mapped to applicable frameworks, continuous monitoring as systems evolve, and audit-ready records available on demand. Each requires a process, an owner, and a mechanism for keeping it current, not just a document.
How does multi-jurisdictional AI regulation affect European organisations operating globally?
The EU AI Act applies extraterritorially, any organisation placing AI systems on the EU market is in scope regardless of where it is headquartered. US state bills, the UK's developing framework, and China's governance rules add further complexity. Some obligations are jurisdiction-specific and cannot be addressed by adopting a single framework - DORA, NIS2, and UK operational resilience rules each contain requirements that sit outside the EU AI Act's scope. Compliance programmes need to map each jurisdiction's obligations independently rather than assuming the strictest framework covers all.
