AI & DATA GOVERNANCE · EXPERT ARTICLE
EU AI Act: the five obligations that matter now
Between the prohibitions and the high-risk requirements, the real effort arises where companies have so far documented little: roles, evidence and data provenance.
Ali Kenan Nohut, LL.M.·6-minute read
The EU AI Act is not an IT project. It requires a governance decision: who is responsible for which AI application, with which risk classification, on which data basis — and who can prove it if in doubt. Five obligations determine the effort involved.
1. A complete AI inventory
No inventory, no classification. In practice, the first finding almost always concerns volume: AI is embedded in specialist applications, in standard software and in assistance functions that nobody has ever listed as an AI system. The pragmatic starting point is a survey across business units and procurement, not via IT alone.
2. Risk classification with justification
What matters is not the result but the traceable reasoning: purpose, context of use, persons affected, degree of automation. Anyone who documents the classification can defend it in an audit — and update it when things change instead of starting again.
3. Roles and responsibilities
Provider or deployer, first and second line of defence, business approval: the question of roles determines which obligations apply in the first place. A dedicated AI Officer function with a clear mandate has proven its worth — staffed internally or provided as a service.
‘The most expensive option is the late one: anyone who only documents at audit time pays for reconstruction instead of governance.’
4. Data quality and evidence of provenance
Training, validation and testing data must be suitable for the intended purpose — and that is a data management task. Data provenance, legal basis and quality metrics belong in the same evidence structure as the model documentation, not in a separate tool.
5. AI literacy across the organisation
Building competence is not optional but mandatory — and the most effective lever against shadow AI. Role-specific formats work best: short for the broad workforce, in-depth for development, procurement and approval bodies.
CHECKLIST FOR THE NEXT 90 DAYS
- Compile an AI inventory across business units and procurement
- Derive and document risk classes for each use case
- Establish the AI Officer mandate and approval process
- Record data provenance and quality metrics for each model
- Adopt a role-based training plan
CONTACT
Questions about the AI Act? Let’s talk
Use our contact form to arrange an initial consultation on your AI Act project.
AUTHOR
Ali Kenan Nohut, LL.M.
Director Digital Strategy & Governance · Cert. AI Officer · Cert. Data Protection Officer · Author of the book ‘Einfach Governance’.
