Follow us
Add us as a preferred source on Google
Transparency duties under Article 50 have begun to apply, even as EU AI omnibus implementation has moved to December 2027 for many high-risk systems and, for certain AI-enabled products, to August 2028. For organizations building and deploying AI in Europe, the message is clear: regulators have extended the timeline on complexity, but not on transparency.
While some organizations see the extension as a welcome breathing space, the time would be much better spent preparing for the future of AI. To do that, we need to frame the challenge around creating the conditions for long-term innovation, rather than around compliance deadlines.
Global Chief Privacy and AI Governance Officer at Wipro.
As AI becomes embedded in products, services and decisions that affect people’s lives, organizations need trust in the systems they deploy, and users need trust in the organizations that deploy them. Those works cannot start in 2027. It has to start now.
Latest Videos FromTechRadar
Compliance is achieved at some point; Governance is built as a skill. A deadline can be postponed, but an institutional capacity cannot be easily created in the short term.
Start with the AI already in use
The starting point for any organization should be an honest assessment of whether it has a reliable picture of the tools, outputs and interactions that Article 50 covers. As we’ve seen in recent years, AI systems can quickly become more deeply embedded in business over time as employees discover new tools and suppliers innovate and ship new updates.
This natural expansion is a normal part of adopting a new technology, but it can lead to AI becoming a core part of business processes before proper governance is in place. Governance is most effective when it shapes these decisions from the start.
Attempts to retrofit governance after AI has been embedded is significantly more difficult, more expensive and ultimately less effective, and the resulting loss of trust may be more costly than the anticipated work required to prevent it.
Extend the controls that are already there
The good news is that many of the disciplines required by the legislation should already be familiar. They build on existing practices around privacy, security, risk management, accountability and operational governance, and much of the challenge is around applying established governance disciplines to a rapidly evolving technology landscape.
Organizations that have taken data protection regulation seriously, and already understand impact assessments and effective governance processes, are well positioned to meet many of these requirements – there is significant overlap.
The task is to extend them to AI, not replace them. A privacy impact assessment can identify data risks, but it cannot alone determine whether a model is reliable in a given context, whether someone can meaningfully question its output, or whether an automated process disadvantages a group.
These questions should be built into existing workflows, especially if AI is bought rather than built. Before embedding a capability in software or a critical process, organizations need clarity about data handling, service and model changes, incident response, support for transparency duties and the evidence a provider can provide. Even where the underlying model comes from a third party, organizations still need to govern how it is selected, configured and used.
Sovereignty question
Next to the AI law, the other crucial issue affecting the way we think about governance in Europe is sovereignty. As the debate begins across Europe, the practical issues being raised are becoming increasingly clear. Where is data stored? What vendors do we depend on? How resilient are our technology choices? What happens if commercial, legal or geopolitical circumstances change?
It is worth being precise about what sovereignty realistically means for businesses. Full computing sovereignty, including control over chips, infrastructure and supply chains, is well beyond the reach of most organizations. The more practical goal is accounting resilience: understanding where critical dependencies sit, ensuring that no single vendor, cloud provider or model becomes a point of leverage, and maintaining control over the layers of the AI stack that remain within the organization’s influence.
Open source can support this by providing more transparency and control over code, but it does not remove infrastructure dependencies by itself. An organization can use an open model and still rely on external computing or cloud capacity to operate it.
Organizations should adopt a sovereign-by-design approach to innovation. Sovereignty should not be considered after technology decisions have been made, it must be embedded from the start in decisions about data architecture, vendor selection and risk management, with resilience, not full independence, as a realistic goal.
It is also important to note that not every dataset, process or workload has the same risk. Organizations should take an orderly approach, applying the strongest sovereignty requirements where data sensitivity, regulatory burden or operational importance require it.
These are not abstract concerns. Seeing AI governance and sovereignty as interconnected challenges creates an opportunity to build a more coherent approach. This is not a case for technological isolation or for withdrawing from global technology ecosystems, the goal is narrower than that. It is about ensuring the organizations meaningful freedom of action in an increasingly complex and uncertain environment.
The right opportunity
The debate about innovation, regulation and sovereignty will continue. Europe will continue to refine its approach to AI, and organizations will continue to adapt to new technologies, new suppliers and new risks. The more important question is whether organizations are using this window to build the capabilities they need long-term, rather than treating each regulatory milestone as a separate deadline.
Governance should not be seen as a compliance exercise that slows down innovation. It is an institutional capacity that enables organizations to sustainably innovate, adopt new technologies with confidence, and remain resilient as markets, regulations, and geopolitical conditions evolve.
The ultimate goal is innovation built on trust, and we have the ability to deliver that regardless of regulatory deadlines. The real test is not whether an organization has built every part of the system it relies on, but whether it understands its dependencies well enough to change course when circumstances demand it.
Store your data in the cloud with the best cloud storage service.
This article was produced as part of TechRadar Pro PerspectivesOur channel to showcase the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in participating, find out more here: