Governance and the EU AI Act

Governance as an enabler

Governance often arrives as a brake: a review board, a long form, a delay. Done well, it works the other way. Clear rules let teams build faster, because they know in advance what each kind of agent needs before launch.

The pressure to get this right is growing. In BCG’s 2026 survey, 42% of companies expect to give AI agents real decision-making authority by 2030. Only 5% have the full set of controls in place today. The companies that close that gap first will be able to give agents more room, sooner.

This chapter is a practical guide for leadership teams. It is not legal advice. For specific obligations, work with counsel who know the company’s sector and markets.

Three tiers of risk

Most agents fall into one of three tiers. The tier depends on who is affected by an error, how reversible the action is, and which rules apply, as set out in Chapter 1.

Tier 1: internal and reviewed. The agent drafts, summarises or suggests, and a person reviews every output before it takes effect. Errors are internal and cheap to catch. Examples: meeting summaries, first drafts of internal documents, search across company knowledge.

Tier 2: customer-facing or acting with approval. The agent’s work reaches customers, suppliers or the public, or it acts on company systems after a person approves. Examples: customer reply drafts, invoice processing, proposal generation, regulated communications.

Tier 3: decisions about people, money or regulated activity. The agent makes or strongly shapes decisions with significant effects on individuals, or acts on financial or regulated systems with limited ability to reverse. Examples: credit scoring, insurance pricing for life and health, screening job applicants, access to essential services. Many of these fall into the high-risk class of the EU AI Act.

Controls by tier

Each tier adds to the one before it.

Controls specific to agents

Agents act, so they need controls that a chatbot never did.

• Least privilege. Each agent has its own identity and only the permissions its task needs. Read access by default, write access only where approved.
• Action limits. Hard limits in code: payment amounts, number of emails per hour, which records can be changed. The model cannot override them.
• Approval points. Defined steps where a person must approve before the agent continues, set by tier and by the size of the action.
• Sources on every answer. Agents that answer questions cite where each claim came from, so people can check them quickly.
• A pause switch. Every agent can be paused by a named person in minutes, as described in Chapter 7.

The European RegTech platform from Chapter 4 shows sources at work. Its regulatory inquiry agent answers customer questions from the company’s document store and supplier data, cites the source for each claim, and flags the items that need a person. Compliance reps see exactly where each answer came from. Inquiries that took three to four hours now take under an hour, and the platform is used by three of the top ten European cosmetics brands.

The EU AI Act: what applies when

The EU AI Act applies to companies that provide or use AI systems in the EU, wherever they are based. Its dates were adjusted in 2026 by the Digital Omnibus, published as Regulation (EU) 2026/1744. As of October 2026, the timeline is:

Most mid-market and enterprise companies are deployers: they use AI systems built by others or with partners. For high-risk systems, deployers must use them as instructed, assign trained people to oversee them, monitor them, keep the logs they generate, and inform affected workers and individuals. Some deployers, including those using AI for credit scoring or for life and health insurance pricing, must also assess the impact on fundamental rights before use.

A company that builds its own agent, or puts its name on one, can become a provider, with heavier duties: risk management, technical documentation, conformity assessment and registration for high-risk systems.

The Omnibus also created a new category of small mid-caps, companies with fewer than 750 employees and turnover up to €150 million, with some of the relief previously given only to SMEs.

Beyond the EU

Companies working across markets face a mix of rules. Two frameworks travel well and fit alongside the EU AI Act:

• The NIST AI Risk Management Framework, a voluntary US framework widely used as a reference by companies and regulators.
• ISO/IEC 42001, an international standard for AI management systems, which can be certified.

Data protection law applies everywhere an agent handles personal data, and sector rules apply in finance, health, insurance and utilities. A single internal framework, built on the three tiers and mapped to each of these, is easier to run than separate processes per market.

The register and the evidence

Every governance programme starts with one list: every AI system and agent in use, with its owner, tier, purpose, data sources, model, status and last review date. Without it, nobody can say what is running or what it costs.

Evidence then builds up as agents run: traced decisions, recorded approvals, test results before each change, incident reviews. When a regulator, auditor or customer asks how a decision was made, the answer is already on file.

Common mistakes

• One process for every agent. Heavy controls for a meeting-notes tool slow everything down. Light controls on a credit decision create real risk.
• No register. Nobody knows how many agents exist, who owns them or what data they use.
• Governance at the end. Controls added after the build, when changing the design is expensive.
• Treating the model as the control. Limits that matter live in code and permissions, where the model cannot change them.
• Waiting for the deadline. High-risk duties apply from December 2027, and the evidence they require takes months to build.

What to do this month

1. Start the agent register, covering every AI system in use, including bought tools.
2. Place each one in a tier using the governance tiers worksheet.
3. Check every Tier 3 use case against the EU AI Act high-risk list with counsel.
4. Name the executive who owns AI governance, and set a quarterly review with the board.

Questions for the leadership team

1. How many AI agents and tools are in use across the company today, and where is the list?
2. Which of them make or shape decisions about people, credit, insurance, access to services or employment?
3. For each agent, who can pause it, and how quickly?
4. Which agents act on systems without a person approving, and what limits do they have?
5. Who in the leadership team owns AI governance, and how often does the board see it?