AI Governance based on EU AI Act

“A computer can never be held accountable, so a computer must never make a management decision.”
This quote from an IBM training presentation from 1979 is more relevant today than ever.

Today, it is not computers in the traditional sense, but AI systems that are increasingly preparing or influencing management-related decisions. Some companies see significant risks in this, while others see, above all, great potential.

Woodmark Consulting helps companies harness this potential safely, responsibly, and effectively through AI governance.

AI is constantly evolving and is increasingly becoming a management issue. It is providing ever-greater support to people in their daily lives and in the workplace, becoming more complex, and increasingly influencing business processes and decisions - whether in marketing, software development, customer service via chatbots, or management decisions. The EU AI Act establishes a regulatory framework for this. Within companies, AI governance is responsible for implementing these requirements while ensuring that the company remains compliant with new laws, regulations, and requirements in the future.

How can management steer the use of AI in a way that enables innovation while reliably ensuring security, accountability, auditability, and compliance with regulatory requirements such as the EU AI Act?

AI governance provides the essential framework for this and makes AI initiatives transparent, controllable, and future-proof for management. This applies today with regard to the EU AI Act and in the future when dealing with additional regulatory, business, and organisational requirements.

What companies must specifically do

From an AI governance perspective, the EU AI Act plays a central role, as it requires companies to ensure transparency, risk management, accountability, documentation, and traceability.

Woodmark Consulting’s AI governance framework therefore considers the EU AI Act to be the primary regulatory framework. At the same time, it integrates the requirements of related governance areas such as data protection, risk management, compliance, and information security to enable holistic and sustainable management of AI systems.

The requirements of the EU AI Act cannot be met through technical measures alone.
Companies need clear structures, defined responsibilities, repeatable processes, and appropriate control mechanisms to manage the use of AI in a sustainable manner.

The EU AI Act affects nearly every company that develops, offers, or uses AI systems.

However, the specific requirements that apply depend on the role a company plays in relation to an AI system. Therefore, before any governance assessment, it should first be determined whether the company acts as a provider or an operator, as this results in different obligations, responsibilities, and documentation requirements. Before any governance assessment, it must therefore be determined what role the company plays in relation to the respective AI system. Ultimately, the company’s specific role determines which regulatory requirements must be met and where the focus of AI governance lies.

The EU AI Act distinguishes, in particular, between two key roles

The EU AI Act defines clear responsibilities for different roles in dealing with AI systems. At the heart of the EU AI Act are, in particular, the roles of the provider and the operator.

Providers develop AI systems, place them on the market under their own name, and put them into operation. They bear the most comprehensive regulatory obligations, particularly for high-risk systems.

Operators deploy AI systems within the EU under their own responsibility and ensure their safe, compliant, and monitored use within the organization. In addition, the AI Act establishes audit and due diligence obligations for other roles, such as distributors and importers. Clearly defining one’s own role is therefore a key prerequisite for any effective AI governance, as it determines which obligations apply.

What role do we play: provider or operator?

Answering this question is the first step toward understanding your obligations under the EU AI Act. The requirements for governance, risk management, documentation, monitoring, and record-keeping depend on your specific role. Companies should therefore conduct this assessment as early as possible in order to correctly identify regulatory requirements and derive appropriate governance measures.

To provide initial guidance, the European Commission offers a free tool called the EU AI Act Compliance Checker. This tool allows companies to determine whether they are considered a provider or operator of an AI system in a given use case and what regulatory obligations arise from that.

European Commission Compliance Checker:
EU AI Act Compliance Checker | AI Act Service Desk

The use of AI is not a one-time project, but rather a continuous process of change. Two aspects are particularly crucial in this regard:

New AI systems must be integrated into existing governance processes, from risk assessment through to approval. At the same time, AI governance must not be based exclusively on the EU AI Act, as additional requirements such as those stemming from the GDPR or industry-specific regulations may be introduced at any time. Effective AI governance ensures that both new AI systems and regulatory requirements are monitored and consistently integrated into existing structures.

It is crucial for management to identify regulatory developments early on and firmly embed them in AI governance. Guidance is provided by the European Commission’s AI Office and the European AI Board, while the Federal Network Agency in Germany plays a central role in oversight. Companies should therefore systematically evaluate new requirements, define responsibilities, and implement necessary measures in a timely manner.

The EU AI Act will not take full effect immediately but will be phased in gradually through 2030. This overview shows which obligations take effect and when, so that companies can plan ahead, establish the necessary governance structures, and avoid time pressure during implementation.

By understanding the relevant deadlines, companies can integrate regulatory requirements into their processes, responsibilities, and control mechanisms in a timely manner, thereby minimizing compliance risks and the need for subsequent corrective actions.

Violations of the EU AI Act can have significant financial and business consequences.

What is AI Governance?

Definition

AI governance refers to the organizational and technical framework consisting of policies, processes, roles, responsibilities, and controls that companies use to manage the use of AI and ensure the safe operation of AI systems. It specifies which AI systems may be used, which risks must be assessed, what documentation is required, and who is responsible for decisions and operations. AI governance extends existing governance areas such as data protection, information security, and IT governance to include AI-specific requirements such as risk classification, transparency, human oversight, and traceability.

Objectives

The goal of AI governance is to provide management with a robust framework for managing the use of AI. AI systems should be deployed in a manner that is traceable, controllable, verifiable, and legally compliant throughout their entire lifecycle. This includes transparency regarding the AI systems in use, a shared understanding of relevant risks, compliance with legal requirements, effective control mechanisms, and the ability to document and audit decisions and processes. This provides management with the necessary foundation to make informed assessments of and manage the opportunities and risks associated with AI.

Why This Is Important for Management

For management, AI governance means one thing above all else: transparency, control, and the ability to act.
Those who understand and can manage risks, responsibilities, and the AI systems in use create the conditions necessary to deploy AI safely, efficiently, and with measurable business benefits. In particular, this involves:

• Determining risk tolerance: The basis for informed decisions
• Making clear decisions: Instead of uncertainty in AI deployment
• Promote in a controlled & scalable manner: Expand AI deployment in a targeted way
• Avoid heavy penalties: Reduce financial risks early on

Effective AI governance helps management combine innovation with control. It creates the conditions necessary not only to use AI in compliance with regulations, but also to leverage its potential for the company in a targeted and sustainable manner.

This is exactly where AI governance comes in: It creates transparency, control, and traceability before risks turn into costly damages.

For many companies, AI governance is initially driven by regulatory requirements such as the EU AI Act.

Structures, processes, and responsibilities are not separate tasks.

Structures without active processes remain theoretical, and processes without clear responsibilities lose their effectiveness. Only their interaction creates the foundation upon which the requirements of the EU AI Act can be effectively implemented within the company. The following chart illustrates how these three pillars interact and why their foundation extends far beyond mere compliance with regulatory requirements.

The EU AI Act makes AI governance a top priority. This summary highlights the key takeaways companies should draw from the previous sections and explains why the effort is worthwhile even beyond mere compliance with regulations.

Woodmark Consulting helps your company establish effective AI governance from defining the target vision and determining roles and responsibilities to implementing an organization that complies with the EU AI Act.