The EU AI Act will not slow down the organisations that treat governance as code. It will bury the ones that understand governance as a steering committee which convenes long after the model has gone live.

Most enterprise AI governance today consists of a document and a meeting. A policy PDF nobody reads, and a committee that reviews AI initiatives once a quarter – usually after they have shipped. That satisfies an auditor for exactly one cycle and prevents none of the actual risks, because the risks arise at the moment of deployment and the committee meets by the calendar.

The organisations that absorb the EU AI Act without grinding to a halt are the ones that rebuild governance as a gate in the deployment pipeline: automated, evidenced and enforced at the moment a model goes into production – rather than debated months later. We have built this for regulated clients, and it is less effort than the committee – and far easier to defend.

The real problem: governance is decoupled from deployment

When governance lives in a quarterly meeting and deployment lives in a CI/CD pipeline, the two run on different clocks. Models ship continuously; oversight happens periodically. In the gap between them, unreviewed systems reach your customers. Worse still, the committee’s approval is a snapshot – it says nothing about the model that was retrained and redeployed three weeks later.

The EU AI Act turns that gap into a liability question. Its obligations for high-risk systems – risk management, data governance, logging, human oversight, technical documentation – are not one-off sign-offs. They are ongoing properties of a system in production. You cannot discharge an ongoing obligation with a calendar-driven meeting.

A framework: governance as a deployment gate

Treat compliance the way you treat security and testing – as checks that must pass before a model can be promoted to production, and that generate evidence automatically as a by-product. Concretely, every model deployment passes through a gate that verifies and records the following:

1. Risk classification. The system is tagged with its AI Act risk tier (prohibited / high / limited / minimal). High-risk systems trigger the full set of checks; minimal-risk systems get a lightweight path. No deployment without a recorded classification.
2. Data lineage. Which data trained this system or serves as its basis, where it came from, on what legal basis and where it is processed. Captured as metadata, not as a Word document.
3. Evaluation evidence. The model has passed its eval suite for quality, bias and safety, and the results are stored and versioned against exactly this build.
4. Human oversight design. For anything touching a consequential decision, the gate confirms that a defined human-in-the-loop or human-on-the-loop mechanism exists and is wired in.
5. Logging and traceability. The system emits the inputs, outputs and decisions needed to reconstruct any individual case later. The gate checks that logging is actually switched on.
6. Transparency obligations. Customer-facing AI identifies itself as AI; generated content is labelled. Verified, not assumed.

The shift is subtle and sweeping: governance is no longer something a committee asserts, but something the pipeline proves at every deployment – with an audit trail you did not have to assemble by hand.

A worked example: the model registry as a control point

A health insurer had eleven AI/ML systems in production and a governance process consisting of an annual review and a spreadsheet. The spreadsheet was already wrong – three systems had been retrained since the last review, and one had quietly evolved from an internal tool into a member-facing one, which changed its risk tier without anyone reassessing it.

We made a model registry the mandatory control point. Nothing reaches production except through it, and registration requires the gate’s metadata. The numbers that mattered to the board:

• Time to answer “show me every high-risk AI system, its data sources and its most recent evaluation”: from roughly 3 weeks of manual digging to a single query.
• Preparing audit evidence for a regulator’s request: from an estimated 120 person-hours to less than a day, because the evidence is generated at deployment rather than reconstructed after the fact.
• Unreviewed production models: from 3 discovered in hindsight to 0 possible – the gate does not promote an unclassified system.

The point that changed the conversation with the executive team: with the gate, you got through compliance faster than with the old committee, because an automated check that passes in minutes beats a meeting you wait six weeks for. Governance stopped being the thing that slows AI down and became the thing that lets you deploy with confidence.

The objection: “won’t a gate slow our teams down?”

That is the first question every engineering lead asks, and it rests on a false comparison. The alternative to a deployment gate is not “no governance, full speed” – it is the committee, the spreadsheet and the frantic remediation when something goes wrong. Measured against that, an automated gate is dramatically faster. A check that runs in minutes and passes when the metadata is there beats waiting weeks for a meeting slot – and it removes the far larger cost of discovering an unreviewed system in production and having to fix it under regulatory pressure.

The trick that keeps the gate fast is tiering. Most deployments carry minimal risk and should sail through a lightweight path – a classification and basic logging, checked automatically, with no human in the loop. Only the high-risk tier triggers the full set of checks, and even those are predominantly automated checks that artefacts exist and evals have passed – not subjective reviews. A human reviewer only comes into play for genuinely novel high-risk systems, and those are rare. Implemented this way, 90% of deployments experience the gate as a few seconds of CI, and the 10% that deserve close scrutiny get it consistently – instead of depending on whether someone remembered to call a meeting.

On top of that comes a cultural dividend. When governance is a predictable, automated gate, engineers stop seeing compliance as an adversary and start treating the required metadata as another part of the “definition of done”, like tests. The risk team no longer has to chase teams for documentation, because the pipeline produces it. Both sides get what they want: engineers can ship without waiting for a committee, and risk management gets complete, current evidence without manual follow-up. The friction between the two functions – usually the real bottleneck in regulated AI – goes down, because the gate replaces negotiation with a shared, automated standard.

Pitfalls

• Policy without enforcement. A governance document without a pipeline gate is theatre. If a non-compliant model can still reach production, your policy is a wish.
• Treating approval as permanent. A model is reassessed on every retraining and every change of intended purpose. A point-in-time sign-off does not cover a system that keeps evolving.
• Governing the model, ignoring the data. Most of your AI Act exposure sits in the provenance and use of the data, not in the model weights. Lineage is the heart of the evidence pack.
• Over-regulating minimal-risk systems. If every internal productivity tool has to go through the full high-risk process, teams will bypass governance entirely. Tier the rigour by risk.
• Building it as paperwork. If the evidence is assembled by hand, it will be out of date by the time of the audit. Generate it from the pipeline.

Decision checklist

1. Is there a single registry that every production model must pass through?
2. Does a deployment require a recorded risk classification?
3. Is data lineage captured as metadata at the time of deployment?
4. Are evaluation results stored and versioned per build?
5. For consequential decisions, is it verified that human oversight is wired in?
6. Can you answer a regulator’s “show me everything” with a query rather than a project?
7. Is the rigour tiered, so that minimal-risk systems are not over-regulated?

The gridz view

Governance you assert in a meeting is a burden; governance the pipeline proves at every deployment is an asset – and, counter-intuitively, the faster route into production. The thing to fear is not the EU AI Act but an unmanaged estate of eleven models that nobody can enumerate. We build governance as a deployment gate and as a model registry that generates its own evidence, so that compliance becomes a property of how you ship rather than a committee you wait for. Done properly, your auditors get a query and your engineers can deploy on Tuesday.

The pragmatic first step costs almost nothing: stand up a single registry and make registration mandatory for production – even if the only field you enforce on day one is a risk classification and an accountable person. That alone brings to light the systems nobody is tracking and ends the guessing game of “how many AI systems are we actually running?” that precedes every governance firefight. Add the checks for data lineage, evaluation and oversight incrementally and tiered by risk, so the gate gets stricter without ever becoming the bottleneck. The organisations that start with the registry experience the AI Act as a deadline they meet calmly – not as an emergency they suddenly discover. If you want to take that first step, get in touch.