The governance arc: the EU AI act white paper by Kore.ai × BAI Europe
Foreword
Tags
Share
"56% of organizations spend between 6 to 18 months moving a generative AI project from intake to production, and 44% identify the governance process itself as the primary source of delay." — ModelOp AI Governance Benchmark Report, 2025
Governance debt costs organizations months and millions, and most don't see it coming until a regulator, an acquirer, or a lost RFP forces the question. The EU AI Act changes the stakes entirely. More ambitious than GDPR, it governs how you build, deploy, and stay accountable for AI that acts on your behalf, and its reach extends well beyond Europe.
The organizations building now will deploy faster, win more contracts, and earn supervisory relationships competitors cannot replicate. Built once, it compounds everywhere. Those that wait pay for it on every deployment that follows.
The Governance Arc, co-authored by Kore.ai and BAI Europe, tells you exactly where your organization stands and gives you the diagnostic, the practitioner intelligence, and the 90-day plan to act on it.
What you'll learn
- Which of your AI systems are already in regulatory scope and what supervisors will test first
- What examiners actually look for that never appears in the regulatory text
- Why most governance frameworks fail when AI stops recommending and starts acting
- How governance accelerates deployment, strengthens valuations, and becomes a competitive moat
- A 90-day sprint and board self-assessment with specific decisions, named owners, and clear trade-offs
What’s on this page
Five things to know about EU AI Act governance
- Governance maturity is a competitive asset: The guide argues that supervisory relationships, examination track records and documented AI governance architecture take years to build, making them the one advantage a well-funded new entrant cannot replicate at speed.
- AI governance is becoming a condition of revenue: Enterprise RFPs in regulated industries increasingly require documented Annex III classification and Article 14 human oversight evidence, and acquirers now price governance maturity into M&A due diligence.
- Governed AI delivers stronger returns: Research cited in the guide links centralized, governed AI to up to 3x higher ROI than siloed deployments.
- Most AI governance frameworks were built for AI that recommends, not AI that acts: The EU AI Act's high-risk obligations expose this gap in agentic AI systems rather than creating it.
- The 2028 Article 112 review will reward operational evidence: Organizations with proven governance will help shape the next EU AI Act regulatory cycle.
Beyond EU AI Act compliance: why governance compounds
The Governance Arc is a whitepaper for enterprise leaders on building an AI governance framework that goes beyond EU AI Act compliance. Its central argument is that compliance is the floor, while governance maturity is the building. Organizations that treat the regulation as a paperwork exercise will keep stalling at proof-of-concept, while those that build governance into their AI architecture will deploy faster, win more regulated-industry contracts and protect their valuation.
Most boards can confirm they have an AI policy, a governance framework and oversight of their AI systems. The guide shows why those are not the questions a supervisory authority, procurement team or acquirer will ask, and why the gap between perceived and actual readiness is often wider than leaders expect.
Authored by Cathal McCarthy with Lee Schlenker of the Business Analytics Institute, the guide is written for CEOs, boards, CDOs, CROs and compliance leaders in financial services, insurance, healthcare and other regulated sectors, including organizations outside Europe with EU exposure. It does not argue for caution. It argues for architecture.
The CEO overview: EU AI Act strategy for leadership teams
1. The window that only incumbents can hold
A competitor can hire AI talent, move quickly and price aggressively. What it cannot do is manufacture a supervisory relationship or years of tested operational evidence. The guide explains why established organizations hold a time-limited window to turn EU AI Act readiness into a durable market position.
Digital Omnibus: position note
The proposed Digital Omnibus would move most Annex III high-risk AI obligations from August 2026 to December 2027. The guide treats this as additional runway, not a reason to defer. It distinguishes governance as engineering, built into deployment architecture and compounding with every use case, from governance as insurance, applied after the fact and building no lasting value.
2. The business case for AI governance
The guide sets out four commercial pressures on AI governance that apply regardless of the EU AI Act enforcement date:
- Revenue: procurement teams in regulated industries are already scoring AI governance evidence in vendor selection.
- Valuation: AI governance is now a standard item in M&A due diligence, and gaps can lead to valuation compression.
- Deployment velocity: ModelOp's 2025 benchmark found 56% of organizations take 6 to 18 months to move a generative AI project into production, with 44% citing governance as the main source of delay.
- Pre-market certification: under the Omnibus proposal, certain high-risk AI systems may undergo pre-market conformity assessment, giving early movers examiner-endorsed evidence.
3. The accountability gap in AI governance
According to the guide, the most revealing finding in supervisory examinations is not a documentation gap but an accountability gap. It maps AI governance across three connected layers. The engineering layer covers what the AI system currently does across its data sources, outputs and user groups. The policy layer decides what kind of change is significant enough to trigger a new Article 9 risk assessment. The operational layer tracks whether the system is being used beyond its documented scope, and whether anyone in governance knows.
Each layer is usually owned by a different function, and failures happen when no one owns the connection between them. The guide identifies the governance role most frequently left unassigned in supervisory examinations and explains why assigning it is one of the most consequential decisions a leadership team can make.
EU AI Act examination insights: what supervisors actually test
Supervisory authorities do not publish their examination playbooks. The guide shares three anonymized patterns from real examinations that no published guidance describes.
Article 14 human oversight: the simulation problem
A financial institution tested its human oversight mechanism twice before examination, both times under simulated load. The examiner accepted none of it. The guide explains what "tested under operational conditions" really means for agentic AI.
Article 12 logging: the reasoning chain question
An insurer's decision-level logs could show what its AI system decided over a 72-hour window, but not why, because the retrieval layer was never captured. The guide explores why Article 12 compliance for agentic AI depends on logging the full reasoning chain.
Article 9 risk management: the scope creep problem
A bank's AI risk assessments were up to 22 months old by the time of examination, while four systems had quietly expanded beyond their documented scope. The guide reveals the root cause, and it was not a missing document.
A practitioner perspective from technology leader Prasanna Arikala adds detail on decision-level logging, substantive human oversight and where the risk boundary sits between AI platform providers and deployers.
The three moves: building an AI governance framework for agentic AI
The full whitepaper develops its argument in three stages:
- The Reckoning: a diagnosis of where organizations actually stand, covering Annex III classification of high-risk AI systems, the four questions every supervisory authority will ask and the three structural gaps behind most failures.
- The Crossing: a strategy for acquiring the practitioner intelligence held by executives who have already faced EU AI Act examination, and turning it into named governance commitments.
- The Advantage: the case that AI governance maturity does not depreciate, compounding across deployment velocity, regulatory trust, and policy influence.
Five organizational archetypes help readers benchmark their own position, from a European bank that cleared its first examination with no material findings to organizations that have yet to begin classification.
EU AI Act governance tools for boards
The guide includes three ready-to-use EU AI Act governance tools:
- Six-question board self-assessment: if any question cannot be answered in 30 seconds with a named system, gap and owner, the organization is not yet ready.
- 90-day AI governance sprint template: covers Article 9, Article 12, Article 14 and the GPAI Code of Practice, each with a named owner, deliverable and trade-off.
- Board script: five responses for questions from the CFO, CRO, CDO, board and chair.
Download The Governance Arc for the full diagnostic, sprint template, archetypes, and examination patterns.
FAQ
1. What is the EU AI Act?
The EU AI Act is the European Union's regulation governing artificial intelligence. It classifies AI systems by risk level and sets strict obligations for high-risk AI, including risk management, logging, transparency and human oversight. It applies to organizations placing or using AI systems in the EU, including companies based outside Europe.
2. When do EU AI Act high-risk obligations apply?
Most Annex III high-risk AI obligations were originally set to apply from August 2, 2026. The proposed Digital Omnibus would move this to December 2027 if formally adopted. Procurement and due diligence requirements, however, are already applying regardless of the final enforcement date.
3. What is Annex III of the EU AI Act?
Annex III lists the use cases classified as high-risk AI, including credit scoring, employment screening, critical infrastructure, biometric identification, education, law enforcement and access to essential services. Systems in these categories must meet the requirements of Articles 9 to 15.