AI governance for businesses: framing AI use and preparing for the EU AI Act

In most companies, generative AI is already in use, often without any framework: employees paste extracts of contracts into a consumer tool, one department deploys a chatbot, another tests an agent. AI governance in a business means making these uses visible, setting clear rules and assigning responsibilities, without holding back what works.

The European regulation on artificial intelligence, known as the AI Act (Regulation (EU) 2024/1689), adds a regulatory dimension. For a detailed look at the text, its timeline and the obligations for each category of operator, see our article EU AI Act: obligations for businesses and timeline. This page describes how we help you turn these requirements into a practical organisation.

Why structure AI governance now

• Confidentiality: without rules, customer, HR or strategic data ends up in tools whose terms nobody has checked.
• Quality: generated content that has not been reviewed can commit the company.
• Regulation: some EU AI Act obligations already apply, others are coming, and the GDPR has always applied to personal data processed by AI.
• Scaling up: clear governance makes it possible to approve more use cases, faster, because you know how to assess them.

The EU AI Act at a glance

As of the publication date of this page (October 2026), these are the points we have checked against official sources. They may change: always refer to the texts cited.

A risk-based approach

The regulation classifies AI systems into four levels, as summarised by the CNIL (the French data protection authority, page in French):

Level	Principle	Examples of effects for a business
Unacceptable risk	Prohibited practices	Check that no use case falls within the list of prohibited practices
High risk	Stricter requirements (Annexes I and III)	Sensitive uses, for example in recruitment: human oversight, following the provider’s instructions, traceability
Transparency risk	Information obligations	Tell people they are interacting with a chatbot, label certain generated content
Minimal risk	No specific obligation	Most everyday use cases

General-purpose AI models fall under a separate regime, which mainly concerns their providers.

Provider or deployer

A company that uses an AI system in the course of its business is, as a rule, a deployer. If it develops a system and places it on the market under its own name, it may become a provider, with broader obligations. Correctly qualifying your role for each use case is the first step.

A timeline amended in 2026

According to the European Commission, the prohibitions and the AI literacy provisions have applied since 2 February 2025, and the obligations for general-purpose AI models since 2 August 2025. A simplification text, the AI “omnibus” proposed by the Commission in November 2025, entered into force on 27 July 2026 according to the Commission. It sets the application of the rules on high-risk systems at 2 December 2027 for the Annex III areas and at 2 August 2028 for AI embedded in regulated products (Annex I). The Commission states that the transparency rules apply from August 2026, with some arrangements adjusted by the omnibus.

These dates changed during 2026 and may still be clarified. Before making any decision, check the consolidated text of the regulation on EUR-Lex and the Commission’s publications.

The GDPR still fully applies

The CNIL points out that the AI regulation does not replace the requirements of the GDPR: whenever an AI use case processes personal data, lawful basis, information to individuals, data minimisation, retention period and, where relevant, a data protection impact assessment still need to be addressed. The two efforts are best carried out together.

What we put in place

Inventory and register of use cases

We identify existing use cases, including those that were never declared: consumer tools, AI features built into your software, in-house developments. Each use case is described in a register: purpose, tool and provider, data processed, users, owner, role under the EU AI Act, risk level and measures in place. This register complements your GDPR record of processing activities without duplicating it.

Risk classification

For each use case, we qualify the risk level within the meaning of the regulation and the risks specific to the company: confidentiality, error, dependence on a provider, cost. Use cases that may fall into the high-risk category are flagged for in-depth legal analysis, which we carry out with your legal counsel or your DPO.

AI usage policy

A short, practical policy: approved and prohibited tools, data that must never be entered, the human review expected, transparency towards customers and incident reporting. It is written with business teams so that it is applied, not just signed.

Roles and responsibilities

Who approves a new use case? Who maintains the register? Who decides in the event of an incident? We define an organisation proportionate to your size: in an SME, a few clear roles are often enough (an AI lead, the DPO, the IT department, an executive sponsor).

AI literacy and awareness

We design sessions tailored to each profile (executives, users, technical teams) covering approved uses, the limits of models, confidentiality and checking results. They contribute to the AI literacy required by Article 4 of the regulation.

Technical traceability

Governance must be backed by evidence: usage logs, versioning of models and prompts, evaluations, access controls. This is the link with our LLMOps production deployment approach and with the cloud security and governance of your environments.

Deliverables

• Register of AI use cases, with risk classification and EU AI Act roles.
• AI usage policy and approval procedure for new use cases.
• Roles and responsibilities matrix.
• Prioritised action plan, dated against the timeline in force.
• Awareness materials for each profile.
• Technical traceability requirements for AI projects.

For organisations that want to go further, the ISO/IEC 42001 standard provides a framework for an AI management system; our deliverables can serve as a foundation for it, without presuming any certification.

Pitfalls to avoid

• Banning without an alternative: use shifts to even less controlled tools.
• A thirty-page policy: nobody reads it.
• Addressing the EU AI Act without the GDPR, or the other way round.
• Relying on unsourced timelines: much online content has not taken the 2026 amendments into account.
• Purely paper-based governance: without technical evidence, you cannot demonstrate what is being done.

How we work with your teams

We work with your management, your DPO, your IT department and the business teams concerned, from Villeneuve-d’Ascq in the Lille metropolitan area (northern France) or remotely. We do not provide legal advice: we structure the organisation, the tools and the evidence, and we work with your legal counsel on legal qualifications. The goal is for your AI governance to run without us: register maintained, policy applied, new use cases assessed according to a known procedure.

[ YOUR QUESTIONS ]

Frequently asked questions

What is AI governance in a business?

It is the set of rules, roles and tools that frame the use of AI: which tools are approved, for which purposes, with which data, under whose responsibility and with which controls. It allows AI to be used more widely, because the risks are identified and monitored.

Does the EU AI Act apply to an SME that only uses ChatGPT or Copilot?

Yes, to some extent. A company that uses an AI system in its business is in principle a deployer within the meaning of the regulation, and some obligations, such as AI literacy of staff, apply regardless of size. The heaviest obligations concern high-risk systems, for example in recruitment.

Is AI training mandatory under the EU AI Act?

Article 4 of the regulation concerns AI literacy among the people who use or operate AI systems on behalf of the company. According to the European Commission, these provisions have applied since 2 February 2025. As the text was amended in 2026, check its consolidated version on EUR-Lex and see our dedicated article.

Does a company need an AI usage policy?

The regulation does not require a policy as such, but it is the simplest tool for setting rules of use, raising staff awareness and documenting your choices. It should stay short and practical, and come with a register of use cases.

How does the EU AI Act relate to the GDPR?

The two texts apply together. The CNIL, the French data protection authority, points out that the AI regulation does not replace the requirements of the GDPR, which continues to apply whenever an AI system processes personal data, during its development as well as its use.