The EU AI Act Is Already in Effect – And Most Companies Aren’t Ready

Your employees are using AI right now – many with tools you haven’t approved. Some paste customer data into ChatGPT, upload strategy documents to AI summarizers, or run browser extensions that silently send session data to third-party servers. In most organizations, no one is tracking any of it.

This is the reality the EU AI Act was designed to address. And unlike most regulations, parts of it are already law.

AI Adoption Is Outpacing Governance – By a Wide Margin

Generative AI tools have moved from occasional experiments to core workflow components faster than most companies could respond. From 2023 to 2024, enterprise employee adoption of generative AI grew from 74% to 96%. The challenge isn’t adoption – it’s accountability.

According to an IDC 2025 survey, 56% of employees use unauthorized AI tools at work, while only 23% use AI tools their organization provides and governs. Put simply: the majority of AI activity in most enterprises already operates outside security controls, compliance frameworks, and visibility systems.

This phenomenon has a name: Shadow AI. Its scale in the DACH market mirrors global trends. 63% of organizations lacked AI governance policies, even as employees actively used generative AI in daily work. Shadow AI-related data breaches added an average of $670,000 to breach costs – a 16% increase compared to organizations with low or no Shadow AI.

The governance gap isn’t a future problem. It’s already costing companies through security incidents, data leakage, and regulatory exposure.

Why the EU AI Act Matters Right Now

The EU AI Act is the first comprehensive legal framework for AI worldwide, addressing AI risks and positioning Europe as a regulatory benchmark. For Mittelstand companies and multinationals operating in the DACH region, this isn’t a distant event – it’s a phased reality with active obligations already in force.

EU AI Act: Key Milestones for Companies Using Generative AI

The key insight for business leaders: the EU AI Act distinguishes between AI providers (who build models) and deployers (companies that use AI tools). If your business uses or integrates generative AI, assessing the associated risks is mandatory. Even if a model provider assumes certain obligations, deployers remain responsible for how AI results are used. Contractual clarity and supplier due diligence are essential components of compliance.

Using ChatGPT, Copilot, or AI-powered analytics tools makes your organization a deployer. That comes with accountability.

The Real Problem: You Can’t Govern What You Can’t See

Most companies know the EU AI Act is here. Fewer understand the actual gap between where they stand today and what the regulation requires operationally.

The problem isn’t irresponsible AI use – it’s that companies have no visibility into how AI is being used at all.

Consider what’s typically missing:

• No AI tool inventory: Most organizations don’t know which AI tools are actually in use across teams.

• No usage policies: More than half of surveyed employees said their company has no official AI policy (23%), they’re unaware whether one exists (16%), or that unauthorized AI use is actively encouraged (16%).

• No data controls: According to Cisco’s 2025 study, 46% of organizations reported internal data leaks through generative AI – data that flowed out via employee prompts rather than traditional exfiltration.

• No accountability structure: Without assigned ownership, AI governance doesn’t happen – it gets deferred.

A key element of AI governance: ensuring adequate AI literacy among employees and contractors who operate AI systems on your organization’s behalf. This is a legal obligation under the EU AI Act, effective since February 2025.

The most exposed companies aren’t the ones experimenting aggressively with AI – they’re the ones that let adoption happen organically, without structure, documentation, or ownership.

Why Data Governance Is the Foundation of AI Governance

Here’s the angle often missed in compliance discussions: AI governance cannot be separated from data governance.

The EU AI Act demands accountability and traceability. It requires organizations to know what data AI systems process, how AI outputs influence decisions, and who is responsible when things go wrong. None of that is achievable without a solid data governance foundation.

At KEMB, this is the connection we make with every client navigating AI adoption. The questions regulators will ask – What data did this AI system use? Who authorized it? How was the output verified? – are the same questions a well-structured data governance framework should already answer.

Companies with clean, documented, and lineage-tracked BI infrastructure are significantly better positioned for EU AI Act compliance than those operating on fragmented data landscapes. If your reporting data is already transparent, governed, and auditable – as part of a strong data strategy roadmap – applying those principles to AI usage is a natural extension.

Conversely, companies that can’t answer basic questions like “Which teams use which AI tools?” or “What customer data has been shared with external AI services?” are starting from zero – operationally and in regulatory terms.

What Companies Should Do Now: A Practical Governance Roadmap

The EU AI Act isn’t a legal project to delegate to a compliance team. It’s an operational challenge that touches marketing, BI, data, IT, HR, and leadership. The good news: the steps are practical, sequential, and directly beneficial beyond compliance.

Test your organization’s readiness with our assessment:

AI Inventory

• Do you have a complete inventory of all AI systems used in your organization?
  

• Are your AI systems categorized by risk level (high/limited/minimal)?

• Do you document the purpose and impact of each AI system?

Policies

• Have you established internal policies for AI usage?

• Are these policies aligned with EU AI Act requirements?

• Do you regularly review and update your AI policies?

Ownership

• Is there a clearly designated person responsible for AI compliance?

• Are roles and responsibilities for AI governance clearly defined?

• Is there an escalation process for AI-related incidents?

AI Literacy

• Have your employees received training on responsible AI use?

• Are your teams aware of the EU AI Act risk categories?

• Do you have ongoing education programs for AI literacy?

Data Governance

• Have you implemented a data governance framework?

• Do you ensure data quality and provenance for AI training data?

• Are appropriate data protection measures (GDPR) in place for AI systems? 

Out of 15 questions total:

12–15 Answers “Yes”: You’re AI-ready. Strong foundations across inventory, governance, and literacy. The work now is making it bulletproof — document what you’ve built, validate it against the Act’s specific obligations, and set a review cadence.

9–11 Answers “Yes”: You’re on track, but gaps remain. Solid progress in several areas, real holes in others. Most organizations at this level need 6–12 months of structured work to reach full compliance. The EU AI Act timeline is active — start with your weakest area now.

5–8 Answers “Yes”: You’re at an early stage. Some awareness, but limited formal structures. Without action, your organization carries real compliance risk as EU AI Act obligations phase in. A focused 90-day sprint can close the foundational gaps.

0–4 Answers “Yes”: Compliance work hasn’t started. Very few or no foundations in place. The EU AI Act is already in force for high-risk systems. Starting today is materially better than waiting — even three basic steps reduce your exposure significantly.

Key Takeaways

The EU AI Act is not a future concern – it’s an active regulatory framework with obligations already in force and a major enforcement deadline on August 2, 2026. For most DACH companies using generative AI tools like ChatGPT, Copilot, or AI-powered business software, the immediate priorities are:

• Gain visibility into which AI tools are used, by whom, and with what data

• Define clear policies – vague or absent guidelines directly increase regulatory and security risk

• Build AI literacy across your organization (legally required since February 2025)

• Anchor AI governance in data governance – transparency, lineage, and accountability start with your data infrastructure

Companies that treat this as an operational and strategic priority – rather than a legal checkbox – will move faster, govern better, and build a data foundation that serves them well beyond compliance.

Want to understand where your organization stands today? Start with an honest AI tool audit. If your data infrastructure isn’t built for transparency and accountability, that’s the foundation to lay first.