AI Governance & Responsible Innovation
Your organisation is already using AI. The question is whether its leadership is governing it.
Knowing where AI is used, who owns the risk, and what the AI Act requires.
Why it's on the leadership agenda
The EU AI Act is already in force. Prohibited practices have been banned since 2 February 2025, and obligations for general-purpose AI models have applied since 2 August 2025.
The Digital Omnibus, adopted in June 2026, delayed the high-risk deadlines but did not remove them. Standalone high-risk systems now fall due on 2 December 2027, which gives leadership teams time to prepare and no more.
Most leadership teams cannot yet say where AI is used across the business, which uses are high-risk, or who owns the risk. That gap is where regulatory, reputational and commercial exposure sits.
What the module covers
Where AI sits in your organisation today, including tools adopted by staff without approval
Risk classification under the AI Act: prohibited, high-risk, transparency and minimal-risk uses
Provider or deployer: how your role changes your obligations
Setting an AI risk appetite the board can approve and defend
Who owns AI risk, how it is escalated, and how it reaches the board
Transparency duties for AI-generated content and customer-facing AI
What your leadership team will be able to answer
Do we have a complete inventory of the AI systems we build, buy and use?
Are any of them prohibited or high-risk, and are we ready for December 2027?
Who in the executive team is accountable for AI risk, and how does it reach the board?
Where does AI touch personal data, and how does that interact with GDPR?
What have we told customers, staff and regulators about our use of AI?
The regulatory frame
Certain AI uses are banned outright. The highest penalties apply here.
Applied from 2 Feb 2025
Obligations on providers of GPAI models, and supervision by the AI Office.
Applied from 2 Aug 2025
Disclosure duties for AI that interacts with people or generates content. Marking of AI-generated content has a grace period to 2 Dec 2026.
Applied from 2 Aug 2026
Risk management, data governance, human oversight and registration for high-risk uses.
Annex III: 2 Dec 2027; Annex I: 2 Aug 2028
Providers and deployers must support AI literacy among staff.
In force
Dates reflect the position as of September 2026. Every engagement begins with a current regulatory review.
What you leave with
A first-pass inventory of AI systems built, bought and used, with owners
A risk classification of those uses against the AI Act categories
A draft AI risk appetite statement for board approval
A clear accountability line for AI risk, from executive owner to board
A readiness plan working back from 2 December 2027