If you lead a company in healthcare, energy, financial services or any sector where compliance is part of the licence to operate, this article is for you. It gives you a practical way to put AI into production without audit failures, regulatory fines or sleepless nights in the compliance team, and it explains why the recent delay to the EU AI Act is a reason to start now.
Ask yourself one question: if your regulator called tomorrow and asked which AI systems your company runs, who approved them and how you monitor them, how long would it take to answer? For most organizations the honest answer is days, sometimes weeks. That delay is where the business risk sits. The technology usually works. What slows regulated companies down is governance, and governance is a leadership decision.
Why do regulated industries struggle to deploy AI?
Most AI projects in regulated sectors stall because the organization cannot answer basic compliance questions. Where did the training data come from? Who approved this model for production? What happens when it makes a wrong decision, and who is accountable?
The EU AI Act turns these questions into obligations. Organizations that provide or deploy high-risk AI systems must be able to show risk management, technical documentation, human oversight and appropriate levels of accuracy and cybersecurity. Fines for breaching the high-risk obligations can reach 15 million euros or 3 percent of global annual turnover, whichever is higher. For prohibited AI practices the ceiling is 35 million euros or 7 percent.
The AI Act does not replace anything. In healthcare it sits on top of GDPR obligations for patient data, information security certification requirements and clinical safety expectations. Energy companies add critical infrastructure protection, and financial institutions have had DORA in application since 17 January 2025. The combined compliance matrix makes many technology teams freeze, and a frozen team hands the advantage to competitors who have already sorted out their governance.
Did the AI Act delay give companies more time?
Yes. The deadline for the most demanding requirements moved, and the work needed to meet them stayed the same. The AI Omnibus amendments entered into force on 27 July 2026. They moved the obligations for high-risk systems in sensitive areas, the Annex III use cases, from 2 August 2026 to 2 December 2027. High-risk AI embedded in regulated products, such as medical devices, now has until 2 August 2028.
Other parts of the Act already apply. The prohibitions on unacceptable AI practices have applied since February 2025 and the rules for general-purpose AI models since August 2025. General enforcement began on 2 August 2026, including the transparency obligations for AI systems that interact with people or generate content.
From a board perspective, the extra 16 months are a planning window. Conformity assessments, technical documentation and monitoring take time to build, and the companies that use this window well will deploy AI faster when their competitors are still scrambling in 2027.
What does compliance-ready AI deployment look like?
Compliance-ready AI means governance is built into the development lifecycle from day one. In practice, every model that reaches production has a documented lineage: where the data came from, how it was processed, what the model does, who approved it and how it will be monitored.
Think of it as a paper trail a regulator can follow. The organizations that deploy AI successfully in regulated environments rarely have the most sophisticated models. They have the most mature governance process.
Four elements make up that process.
Data governance comes before any training. You need documented data sources, data quality assessments and clear data ownership. In healthcare that means knowing exactly which patient data sets were used, on what legal basis and with what anonymization or pseudonymization. In energy it means tracing operational data through its whole lifecycle.
Every model needs documentation. A technical specification should describe the intended use, known limitations, training method and expected performance boundaries. The AI Act requires this for high-risk systems. Teams that write the documentation before building the model tend to build better models and get through compliance reviews faster.
Human oversight has to be designed. Regulated AI systems need clear decision boundaries: where the model recommends and where a person makes the final call. That boundary is an architectural decision. Define it in the system design, test it in deployment and keep it auditable in production.
Monitoring has to be continuous. A model that passes its initial assessment and then drifts in production is still a compliance risk. Monitoring should be active, automated and connected to alerts that bring people in when performance falls below agreed thresholds.
How does the AI Act risk classification affect your deployment?
The AI Act sorts AI systems into four tiers: unacceptable risk, high risk, transparency risk and minimal risk. Your first job is to classify every AI system in your organization. It sounds simple, and in client work it is often one of the most contested internal discussions we see.
High-risk systems face the strictest requirements. Annex III lists areas such as safety components in the management of critical infrastructure, education, employment, access to essential public and private services, law enforcement, migration and the administration of justice. AI built into regulated products such as medical devices is high risk through a separate route.
The details matter. A tool that analyses and filters job applications is explicitly high risk. So is an emergency healthcare patient triage system. A chatbot that sorts routine patient questions may fall outside the list, depending on what it decides and for whom. In energy, an AI system that predicts equipment failures becomes high risk if it acts as a safety component in the operation of electricity, gas, heating or water supply. These distinctions decide how much work each system needs, which is why classification deserves senior attention.
The practical implication: if you have not classified your AI systems yet, start now. Providers of Annex III high-risk systems also have to register them in the EU database before placing them on the market, and conformity assessment plus technical documentation for a single system can take months.
Where do organizations get stuck?
We see three failure patterns again and again.
The first is compliance as an afterthought. The technology team builds the model, shows impressive results and hands it to compliance for approval. Compliance finds gaps in documentation, unanswered questions about data provenance and unclear accountability. The project goes back to the drawing board and months are lost.
The second is a governance vacuum. Technology thinks compliance owns AI governance, compliance thinks technology owns it, and risk management thinks both do. In practice nobody owns it, and models reach production through informal channels without proper oversight.
The third is a monitoring gap. The model passed its review and went live, and nobody has looked at it since. Drift goes unnoticed while data distributions change, and a model that was compliant six months ago now makes decisions based on patterns that no longer reflect reality.
All three share the same root cause: governance was treated as a barrier to deployment, when it should have been built in as part of it.
How do you build a practical AI governance structure?
A governance structure that works in regulated environments has to be clear more than it has to be complex. This is what we recommend.
Start with ownership. Name one accountable person for AI governance, with the authority to approve or reject model deployments and the responsibility to keep the process running. A committee can advise, but one person has to decide. In most organizations this person sits where technology leadership and risk management meet.
Define the model lifecycle. Every stage from idea to retirement needs governance checkpoints. Which approvals are needed before training data is collected? Who signs off on the model architecture? What testing is required before production? What triggers a review or retirement?
Build a model registry. Catalogue every production model with its purpose, data sources, performance metrics, risk classification and approval history. When a regulator asks which AI systems you run, the registry is your answer.
Automate the compliance checks. Manual reviews do not hold up once you run more than a handful of models. Data quality, model performance, bias detection and drift monitoring should be tested automatically. The checks your team runs by hand on model number one need to be automated by model number ten.
Test your incident response. What happens when a model makes a harmful decision? Who is notified, how is the model taken offline, and how is the incident documented and reported? Answer these before the incident happens.
Why does it matter where your models run?
In a regulated environment, the location of your AI workloads is a compliance decision as much as a cost decision.
GDPR does not require personal data to stay inside the EU, but it restricts transfers outside the European Economic Area. Data can only leave under an adequacy decision or other safeguards such as standard contractual clauses. Many healthcare and financial organizations add stricter contractual or national requirements on top, and operators of critical infrastructure may face national security expectations as well.
AWS, Azure and Google Cloud each offer different sovereign cloud capabilities and data residency commitments. Choosing the right platform, or combination of platforms, for regulated AI workloads means understanding the contractual and regulatory implications of each option alongside the technology.
This is where a multi-cloud approach earns its keep beyond cost. If a provider changes its data processing terms, or a geopolitical event changes the legal status of data transfers, workloads spread across providers give you options. In a regulated business, options work like insurance.
What should you do this quarter?
If you run AI in a regulated environment, or plan to, these are the concrete steps for the next three months.
Audit your current AI systems. List every model in production or development, classify each one under the AI Act risk tiers and flag the ones that may be high risk.
Assign governance ownership. Name the person responsible for AI governance and give them real authority, resources and time for the role.
Check your documentation. For each production model, make sure you can answer the basic questions: what data was used, who approved the deployment, how the model is monitored and what the escalation path is when something goes wrong.
Review your cloud contracts. Find out where your AI workloads process data, what residency commitments your providers make and whether those commitments meet your regulatory requirements.
If you are not sure where your AI governance stands, a Cloud2 Health Check is a practical starting point. It covers security and compliance as well as data and AI readiness, and it gives you a snapshot of the current state, prioritized recommendations and an action plan. Better to find the gaps now, while December 2027 still leaves you time to close them.
