AI is being deployed; your company’s accountability is not reduced: three questions to ask
Your teams already use ChatGPT, Claude or Copilot. What the EU regulation requires today, what the Digital Omnibus deferred — and the three questions of governance, compliance and oversight to settle before the incident.
In most of the companies we work with, artificial intelligence arrived before the decision to adopt it. Someone pasted a contract into an assistant to summarise it, someone else plugged an agent into the contact inbox, a third automated a follow-up. None of these moves is illegitimate. But none was arbitrated, and the company answers for all of them.
Where the EU regulation actually stands
The AI Act applies in stages, and its calendar moved this summer. As of 30 October 2026, the date this article was checked:
- Since 2 February 2025: prohibited practices and the duty to support AI literacy within organisations.
- Since 2 August 2025: obligations for providers of general-purpose models, governance, and the penalty regime.
- Since 2 August 2026: the transparency obligations of Article 50 — telling people they are talking to a machine, labelling AI-generated or manipulated content.
- Deferred: the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the obligations for Annex III high-risk systems from 2 August 2026 to 2 December 2027, and those of Annex I to 2 August 2028 (AI Act Explorer, Cooley).
A deferral is not an exemption. It moves a deadline for one precise category of systems; it removes nothing from what already applies, and above all nothing from what does not come from the AI Act at all: data protection law, trade secrets, employment law, contractual liability towards your clients. A company waiting for December 2027 to take an interest in its AI usage would be reading the wrong text.
On penalties, Article 99 provides for up to €35 million or 7 % of worldwide turnover for prohibited practices, €15 million or 3 % for most other breaches, and €7.5 million or 1 % for incorrect information supplied to authorities — for SMEs, the lower of the two applies. These ceilings target serious cases, but they give the scale.
First question — governance: do you know what is used, and for what?
Start with the inventory, not the policy. Which tools, by whom, on which tasks, with which accounts — personal or professional? An honest list fits on one page and almost always reveals two or three uses management did not know about: the phenomenon known as shadow AI.
The inventory exists to settle three things: what is allowed outright, what is allowed under conditions, and what is not allowed. A written rule nobody reads is worth less than a three-line list that is posted and understood.
Second question — compliance: where does the data go?
The question is not "is the tool compliant", it is "what have we given it". A client contract, a payroll file, a medical record, source code: every submission to a third-party service is a transfer, with a controller, a purpose, a retention period and sometimes a destination country. Check three concrete points: does the service reuse your inputs to train its models, where are they hosted, and how long do they stay? The answers are in the terms of service, not in the sales pitch. Our compliance page describes the framework we apply on our side (GDPR, FADP/nFADP, PIPEDA).
Third question — oversight: who reviews, who decides, who answers?
This is the question most often skipped, and the only one that matters on the day of an error. For each use, three names must exist: who checks the output, who approves sensitive actions — a payment, a message to a client, a deletion — and who steps in when an agent gets it wrong. Not a function: a person, and their backup.
An agent acting without human approval on an irreversible action is not a productivity gain, it is an operational risk with leverage. Conversely, an agent whose every output must be read in full saves almost nothing: that is the sign its scope is badly cut.
The risk is not only regulatory
Poorly governed automation exposes data, damages a client relationship or produces errors in series — a campaign sent to the wrong segment, a wrong price carried into thirty quotes, a polite and incorrect answer to a complaint. The fine is the most visible risk; it is rarely the first one to materialise.
Where to start, concretely
- Inventory the real tools and uses, without judgement, on one page.
- Classify each task: purely human, human assisted by AI, or safe to delegate to a supervised agent.
- Name, for every sensitive use, the person who reviews and the person who approves.
- Write down what must never leave the company, and in which tools.
- Put a figure on it before signing: our ROI calculator compares the full cost of an internal role with that of an outsourced service, automatable share included — and shows at what volume the answer flips.
At Workynet we help companies organise their processes, bring AI in under control, and pair automation with named human oversight. Do not wait for an incident to review your practices.
This article is general information, checked on 30 October 2026; it is neither an audit nor legal advice. Precise terms should be verified against official texts or with your own counsel.
Sources
A question about your situation?
Let’s talk about your compliance and outsourcing needs.