Learn

AI Governance Brief · 03 EU AI Act · Regulation (EU) 2026/1744 Provider & Deployer Roles Updated 20 Sep 2026 Insights · EU AI Act Readiness The Act doesn’t ask who you are. It asks what you did. Provider and deployer are not company types. They are roles assigned per system, and an organization can

California’s ADMT requirements bind on 1 January 2027, and they reach employees and applicants, not just customers. The organizations that miss it won’t miss it for lack of a policy — they’ll miss it because they started by asking which products contain AI. A scoping test, a readiness sequence, and the evidence an assessor will ask for.

The question arrives from sales, not compliance. A prospect’s vendor questionnaire has a line item — “Is your organization certified to ISO/IEC 42001?” — and the deal is large enough that someone forwards it upward with a note asking how quickly we can get that. That framing is the right one, and almost nobody uses

A customer asks whether you’re a provider or a deployer under the EU AI Act, and nobody in the company can answer. That question is the whole compliance analysis in one line. Where the Act reaches, how to classify without over-classifying, the four facts that decide your role, and what the revised 2027 high-risk dates change.

AI security isn’t about replacing your existing cybersecurity program. It’s about extending governance, risk management, and security practices to address the unique risks introduced by artificial intelligence. Over the past few years, nearly every conversation I’ve had with organizations about AI adoption eventually lands on the same question: how do we actually know our AI

A model goes to production in March. In September a customer sends a questionnaire asking which data the system was trained on, who approved its deployment, and how outputs are reviewed before they reach a person. Nobody kept the training data lineage. The approval happened in a Slack thread. There is no review step, because