The European Union’s AI Digital Omnibus has extended deadlines to meet some of the most demanding requirements of the AI Law. However, more time does not eliminate the governance challenges that companies must address to adapt to the European Union’s regulatory framework and ensure responsible use of artificial intelligence.
The requirements for high-risk AI systems used in areas such as employment, education, critical infrastructure and access to essential services will apply from December 2, 2027. For high-risk systems embedded in regulated products, such as machinery and medical devices, the date is extended to August 2, 2028. These deadlines are part of the regulatory calendar that organizations will need to take into account to comply with the provisions of the European Union.
«I value this additional time positively. Companies have been preparing for the AI Act for some time, but technical standards, guidelines, oversight and enforcement mechanisms have continued to evolve. This extension allows organizations to advance the necessary preparations to comply with the regulations, instead of rushing to reach a deadline for which many were not yet prepared,” says Francisco Molero, CEO of Confluent for Spain and Portugal.
Four priorities to strengthen AI governance
One of the main challenges for companies is to be able to explain how a decision made with the help of artificial intelligence was reached. Identifying the model that generated a result is not enough to know what data it used, whether it was up to date, or what happened after issuing a recommendation. In the regulatory context of the European Union, having this information is essential to reinforce transparency and accountability.
Faced with this challenge, Confluent identifies four priorities that organizations can address to strengthen the governance of their AI systems and advance compliance with European Union regulations.
Priority 1. Identify where AI is used
Artificial intelligence is not always incorporated through specific tools. It can also be integrated into recruitment platforms, fraud detection systems, customer services or third-party applications. Additionally, a vendor update can introduce relevant changes without the company identifying them as a new deployment.
Therefore, the first step is to prepare an inventory that allows us to locate these systems and determine which processes influence decisions or generate recommendations. This identification helps organizations evaluate their obligations and determine which requirements established by the European Union may be applicable to each system.
Priority 2. Track the data that supports each decision
Knowing what result an AI system has generated is not enough to explain how it arrived at it. Companies need to know what information was used, whether it was up to date at the time, and what factors influenced the decision. This traceability is especially important in areas such as granting credit, risk assessment or personnel selection, where it is essential to be able to reconstruct the process and justify its results.
The ability to document the origin and route of the data also allows for the preparation of evidence that facilitates the evaluation of compliance with the regulatory obligations of the European Union and the response to possible audits or incidents.
Priority 3. Monitor systems once they go into production
The control of AI does not end with the tests prior to its implementation. Once deployed, systems may exhibit deviations or unexpected behavior. Companies need monitoring mechanisms that allow these changes to be detected, relevant events to be recorded and possible incidents to be analyzed.
For high-risk AI systems, the European Union AI Law includes requirements such as activity logging and human supervision. Therefore, organizations must establish procedures that allow problems to be identified, reconstruct what happened and take corrective measures when necessary.
Priority 4. Integrate AI governance into existing controls
Creating specific structures for AI governance can duplicate processes and make it difficult to coordinate with controls that already exist for data, security, procurement, and operational risk. Confluent is committed to an integrated approach that connects these areas and prevents AI monitoring from operating in isolation.
This approach allows the requirements of the European Union to be addressed from a transversal perspective, taking advantage of existing control mechanisms and facilitating collaboration between the teams responsible for technology, security, data and regulatory compliance.
These measures will also help companies adapt to future guidelines and application criteria of the European Union
An example is Siemens, which uses a central data streaming platform to connect its operating systems and business applications with its data warehouses and AI and machine learning platforms. This way, your teams can access and manage data consistently across a complex organization.
Prepare now to demonstrate compliance
With standards still in development and some aspects of AI Law enforcement yet to be finalized, companies have room to prepare, but will need to demonstrate that their systems are operating in compliance when deadlines arrive. The evolution of the European Union’s regulatory framework makes it especially important that organizations do not confuse the extension of deadlines with a reduction of obligations.
Anticipating involves identifying the systems used, documenting the data involved in decisions, establishing supervision mechanisms and preserving evidence to prove compliance. These measures will also help companies adapt to future guidelines and application criteria that will be finalized within the European Union.
“We have to start building these tests now,” concludes Francisco Molero, CEO of Confluent for Spain and Portugal.
