Governance, compliance and the EU AI Act
AI governance is the set of rules, responsibilities and controls that frame how AI is used in your company. It also prepares you for compliance with the EU AI Act, the GDPR and the ISO/IEC 42001 standard.
Updated October 11, 2026
What's at stake
of organizations hit by a data breach have no AI governance policy, or are still developing one.
Source: IBM, Cost of a Data Breach 2025
of worldwide annual turnover: the EU AI Act's fine ceiling for prohibited practices (up to €35M). For an SME, the lower of the two amounts applies.
Source: European Commission, Article 99
new application date for the most common “high-risk” obligations (recruitment, credit…), postponed by the Digital Omnibus.
Source: White & Case
EU AI Act timeline
The Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) postponed only the “high-risk” obligations. Prohibitions, AI literacy and transparency stay on schedule.
Prohibited practices (Art. 5) and the obligation to develop staff AI literacy (Art. 4).
Obligations for providers of general-purpose AI models.
Disclose that people are interacting with AI and label generated content (Art. 50).
Marking of generated content for systems already on the market.
Recruitment, credit scoring, education… Postponed from August 2026.
AI embedded in regulated products. Postponed from August 2027.
Status as of October 11, 2026. Sources: White & Case · Usercentrics · Cooley.
Risk levels
The EU AI Act doesn't classify a company but each use of AI. A single organization can have tools in several categories: HR is often the first sensitive area.
Social scoring, behavioral manipulation, real-time biometric identification in public spaces (strict exceptions).
Recruitment, credit scoring, education, biometrics, medical devices.
Chatbots, voice assistants, AI-generated content.
Spam filters. AI literacy (Art. 4) is still expected of your teams.
Sources: RTR · DPO Consulting.
Reference frameworks
Strong governance relies on several complementary frameworks: one is binding, the others structure your practices and reassure clients and partners.
EU regulation, organized by risk level. Can apply to companies outside the EU whose AI outputs are used in the Union.
Legal basis, purpose, impact assessment, controller and processor roles for AI projects.
AI management system: responsibilities, risks, internal audit, continuous improvement. Certification by an accredited body.
Four functions: govern, map, measure and manage AI risks. Not certifiable.
In Tunisia
Sources: AllAfrica, 31/08/2026 · Business News, 27/02/2026.
Our approach
A framework inspired by the NIST AI RMF, ISO/IEC 42001 and the EU AI Act. The inventory is a recommended best practice, not a general obligation under the regulation.
List AI uses, including those teams rely on without having declared them.
Map each use to a risk level and to the personal data involved.
Write the usage policy, appoint owners, define human sign-offs.
Build your teams' AI literacy, tailored to each role.
Measure, audit, improve, and prepare for ISO/IEC 42001 if it is useful to you.
General information, not legal advice. How the EU AI Act, the GDPR or Tunisian law applies depends on your situation: have your compliance decisions validated by legal counsel. Content updated October 11, 2026.
FAQ
It is the set of rules, responsibilities and controls that frame how AI is used: usage policy, risk classification, data protection, employee training and ongoing monitoring.
The regulation also covers providers and deployers established outside the European Union when their AI outputs are used in the Union. The exact scope of this rule is not settled: legal advice is recommended for your case.
Only in part. The Digital Omnibus postponed the “high-risk” obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Prohibitions, AI literacy and transparency stay on schedule.
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other obligations. For SMEs, the lower of the two amounts applies.
No, the standard is voluntary. It structures AI governance and can reassure clients and partners. Certification is issued by an accredited body, not by ISO.
With a baseline: which AI uses exist in your company, what data they touch and what level of risk they carry. Then simple usage rules and employee training.
Go further
A conversation to map your AI uses, identify your risks and define your first rules.