ChatGPT
Perplexity AITL;DR
- The EU AI Act implementation is a phased rollout, not a single switch. Knowing which obligations apply to your organization right now is step one.
- Reading the regulation by the book is the wrong approach. The intention matters as much as the letter.
- AI governance is not an IT problem. It’s a company-wide responsibility that most organizations haven’t fully distributed yet.
- Shadow AI is the governance gap nobody planned for. A framework tied to one approved tool is not a framework.
The clock didn’t start on August 2
Most coverage of the EU AI Act treats August 2, 2026 as the moment EU AI Act implementation began in earnest. The Act’s main transparency obligations and enforcement powers over GPAI providers did become active on that date. But that framing undersells how long this has been building.
The Act entered into force on August 1, 2024. Prohibited AI practices and AI literacy obligations applied from February 2025. Governance rules and GPAI model obligations became applicable in August 2025. This is a phased rollout that has been active for two years, and organizations that filed it under “problem for later” are now at the sharp end of it.
The enforcement machinery is now active.
From August 2, 2026, the EU AI Office holds formal powers to investigate GPAI providers, request technical documentation, demand access to training data, and restrict or withdraw models from the EU market. National supervisory authorities are simultaneously empowered to audit and fine deployers in their jurisdictions. The fine tiers are real: up to €35 million or 7% of global annual turnover for prohibited AI practices, up to €15 million or 3% for high-risk AI violations. These are not hypothetical numbers, they are live and enforceable today.
EU AI Act implementation starts with reading the intention, not just the letter
Jakob Lindström, CIO at Afa Försäkring, one of Sweden’s largest occupational insurers, has spent the past year building out the organization’s AI governance program in a heavily regulated environment. His view on how to approach the regulation is worth sitting with.
“If you just read the regulation by the book, that would be very expensive and need a lot of people,” he says. “You have to read the intention, and also how it fits our world and the other regulations we’re under.”
This is the practical reality of compliance in a complex regulatory environment.
Afa Försäkring already operates under GDPR, DORA, insurance regulation, and a range of other frameworks. The AI Act doesn’t sit in isolation from any of that.
Evelina Kalmnäs Lindqvist, Head of IT Compliance and Risk at Afa Försäkring, draws a useful distinction between the Act and GDPR: “GDPR is from a person’s point of view, how to protect a person’s specific data. The AI Act is more about how to use an AI tool with information that can be personal or not.”
The comparison to GDPR is instructive in another way too. Jakob points out that it took years before organizations truly understood what GDPR intended, not just what it said. The AI Act will follow the same curve, with one added complication. “The technology market is changing so rapidly,” says Evelina. “Even if this is a very new regulation and it’s still changing, the technical market is changing even faster.”
AI governance is not an IT project
One of the most common mistakes organizations make is treating EU AI Act implementation as an IT problem. It lands in IT’s inbox, IT brings in some consultants, and a framework gets built around the tools IT already manages. Jakob is direct about where this leads: “That’s the normal behavior. But AI is not an IT project.”
The Act’s requirements reach across the entire organization. Vendor contracts, risk classification, employee responsibilities, board oversight, and operational processes are all in scope. Evelina puts it plainly: “It’s not clear that you can say one unit or area is responsible for the whole regulation. It’s something you have to do across departments.”
What both Jakob and Evelina advocate for is a cross-functional governance structure, a squad with a clear mandate from leadership, pulling together regulatory, technical, and operational expertise. “You have to have a mix,” says Jakob. “A virtual organization that says: we take care of the AI journey as of now, on the mission from the CEO. Because you’ll have pieces of information, regulations, IT, different kinds of data that you need to collect to know where you’re standing.”
One function that more organizations are standing up is a dedicated AI committee, reporting directly to the CEO or board. But having a committee isn’t the same as having distributed accountability. Every level of the organization has to own a piece of the governance.
The shadow AI problem nobody planned for
Even organizations with strong AI governance frameworks face a challenge that no policy document fully addresses: the AI they know about isn’t all the AI that’s in use.
Shadow AI is different from shadow IT. The distinction matters. Shadow IT was usually an employee spinning up a tool the organization hadn’t approved. Shadow AI lives inside tools the organization is already paying for. Canva, Miro, and most SaaS products employees use every day. That consumption is happening whether it’s tracked or not.
But Jakob points to an even more immediate version of the problem. “Let’s say we started out with Copilot. I can assure you that people will not stop with Copilot. People will want to use other models as well, because they’ve used them privately or somewhere else.”
A governance model built around one approved tool is not a governance model. “The governance model can’t be tied to a specific technology or model. It has to be open enough that you can bring any AI into your company. Because otherwise, if you say ‘Copilot you can use, this one you cannot,’ the only thing that happens is that you have shadow AI the day after.”
This is where the cultural dimension of the Act matters as much as the technical one. Evelina describes Afa Försäkring’s approach: company-wide education, AI ambassadors who can support colleagues, and a deliberate effort to make it easy to do the right thing rather than easy to do the wrong one. “Have a checklist with five questions that you can answer yes or no to, just so you have something to rely on,” she says. “Make it as easy as possible for all your employees.”
Looking closer to home
The EU AI Act isn’t the only pressure pushing organizations toward rethinking their AI supply chain. The question of AI sovereignty, which models to rely on, and where they sit, is becoming a governance decision in its own right.
Jakob visited Mistral’s Paris office this spring. What struck him wasn’t just the quality of the work. “It made me incredibly proud of Europe,” he says. “We have more things within Europe than I knew, and that isn’t really spelled out either.”
The practical concern is dependency. If a US-based AI provider’s service goes down, or the provider cuts access, organizations that have built that provider into their production lines have a problem that no governance framework can immediately fix. “All of a sudden you have a kill switch in the business,” says Jakob. “That’s not acceptable for our customers.”
For Afa Försäkring, this is shaping a longer conversation about in-house AI hosting, particularly for sensitive data that can’t leave the organization. “That’s not just because of sovereignty,” says Evelina, “but mostly because of the cost of tokens, and to make sure we can use AI on sensitive information that isn’t allowed to leave the house. Because then you can use AI in areas that we hadn’t thought of.”
Where to start with EU AI Act implementation
The organizations getting EU AI Act implementation right are the ones that started working through it and kept going when the answers got complicated.
Jakob’s framework for starting is simple: “Why AI, how, and who? Because the ‘who’ is who is responsible, the governance part, who does what in terms of responsibility for employees, management, the board. Pulling all of this together, and how to manage it as you evolve.”
Evelina’s practical advice for making governance stick at the operational level: start small, with a process that isn’t critical and doesn’t use sensitive data. Get the education right before the tools. And when it comes to day-to-day decisions, make the right thing the easiest thing. A five-question checklist that employees can run through is worth more than a hundred-page policy nobody reads.
The regulation will keep changing. The EU AI Act has already been amended by the Digital Omnibus regulation, and further updates are expected. The technology will keep changing faster. What doesn’t change is the underlying question every organization needs to answer: do you know where AI is being used in your organization, what it’s doing, and who is accountable for it?
Want to hear how Afa Försäkring is working through this first-hand?
Jakob Lindström and Evelina Kalmnäs Lindqvist share what the process has looked like from the inside: the decisions made, the grey areas, and what they’d approach differently now. If the answer isn’t clear yet, that’s the work.