AI Act Readiness: Why Companies Need More Than an AI Policy

In short: An AI policy is no substitute for visibility into how AI is actually used. The EU AI Act, autonomous agents and growing assurance demands point to the same question: can you show that your controls work? The starting point is a structured inventory.

Many companies now have an AI strategy. Fewer can reliably answer which AI systems are actually in use, which decisions they are allowed to make, and how compliance with internal and regulatory requirements is checked.

As generative AI and autonomous AI agents spread, this gap becomes a management question. It is no longer only about whether a company may use AI. It is about whether it can control its use, demonstrate that control, and answer for it to customers, procurement, IT security and regulators.

The EU AI Act provides a regulatory framework. At the same time, a market for independent AI assurance and specialised security solutions is emerging. Both point to a shift: trust in AI increasingly has to be backed by solid evidence.

1. The first problem is a lack of visibility into your own AI use

An AI policy does not yet answer how AI is actually used in the company.

Employees use external AI tools, business units embed AI features into existing software, and IT teams test specialised solutions. AI agents add another dimension: systems can retrieve information, call tools and carry out multi-step tasks largely on their own.

This creates three typical visibility gaps:

• Inventory: Which AI systems, embedded features and self-set-up applications are actually in use?
• Accountability: Who is responsible for each use, and what role does the company hold under the EU AI Act?
• Control: Which data, systems and processes can an application reach, and how is its activity monitored?

Without this information, risk assessments stay incomplete. Companies can neither prioritise reliably nor show that their governance measures cover actual use.

The first step is therefore not another policy, but a structured inventory.

2. The EU AI Act turns governance into a concrete management task

The regulatory requirements depend, among other things, on the company’s role, the type of AI system and its specific use.

The transparency obligations under Article 50 of the EU AI Act have applied since 2 August 2026. Depending on the use case, they include duties to inform affected persons as well as requirements for certain AI-generated content. For generative AI systems already on the market before that date, a transition period until 2 December 2026 applies to machine-readable marking under Article 50(2).

The timing for high-risk AI has also changed. The postponement rests on the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026). Under the current transition rules, the obligations for high-risk AI in the areas listed in Annex III generally apply from 2 December 2027. For certain high-risk AI systems embedded in regulated products under Annex I, the date is 2 August 2028.

These deadlines buy planning time. They do not replace the check of which requirements apply to a specific use case.

For management, this yields five central questions:

1. Which AI systems and applications are in use?
2. Which role does the company hold in each case: provider, deployer, or several functions?
3. Which information, transparency and documentation duties apply?
4. Where is data processed, and which data protection and security requirements must be considered?
5. Who is responsible for approval, monitoring, escalation and contractual commitments?

Not every one of these questions corresponds to a separate legal obligation. Together, however, they form a practical starting point for robust governance.

3. AI agents sharpen the question of control

In classic software, functions and permissions are usually fairly clearly bounded. AI agents, by contrast, can combine several tools, access different data sources and carry out tasks across system boundaries.

That changes the risk profile.

An agent that only summarises information needs different permissions than one that sends customer communication, changes records or triggers transactions. The greater its room for action, the more important clear limits, traceable activity and effective ways to intervene become.

In its June 2025 analysis of autonomous AI agents, McKinsey already pointed to the importance of governance, defined tasks, performance measurement and safeguards. The management task is not only to make agents work technically, but to embed them in a controllable operating model.

Five practical requirements follow:

• Limited permissions: Each agent receives only the access rights its task requires.
• Binding guardrails: Critical actions are limited by technical rules, not by prompt instructions alone.
• Traceability: Access, executed actions and relevant decisions are logged appropriately.
• Human intervention: Critical steps have defined approvals, escalations and ways to stop.
• Ongoing monitoring: Performance, misbehaviour, cost and changes to system configuration are monitored.

An important distinction: a documented safeguard is not the same as a demonstrably effective control. A rule is only reliable once it can be shown to work in its intended use.

4. Trust is becoming a market requirement in its own right

It is increasingly not enough for companies to consider their own AI use justifiable internally. They must also be able to substantiate their claims to others.

In its post Who Will Become The Trusted Assurer Of Your Enterprise AI? of 23 September 2026, Forrester describes an emerging landscape of independent AI assessment and assurance. The central question is which assessors, methods and evidence different stakeholders can actually trust.

This matters directly for enterprise customers. Procurement, IT security, data protection and business units do not necessarily need the same information. But they all want traceable answers to their own questions.

A practical distinction follows:

These levels are not a formal certification scale. They simply illustrate why policies, implemented controls and robust evidence should not be confused with one another.

In sales, too, this difference can be decisive. Depending on industry and customer situation, traceable information on data processing, permissions, responsibilities and security measures can become part of the purchase decision.

5. The market for agent security is forming around specific control points

The spread of AI agents creates new demands on existing security architectures. At the same time, specialised vendors are emerging that address individual control problems.

In a guest article by Itay Sagie, The Emerging M&A Map For AI Agent Security, published on 23 September 2026, Crunchbase News outlines one possible structure for this market. The focus is, among other things, on agent identities, data access, permissions, interfaces and the traceability of activity.

This matters for procurement as well. Companies should not simply search for a broad category such as “AI security”. What matters is which specific risk a solution addresses and how it fits into the existing architecture.

Before buying, four questions are worth asking:

1. Which specific control point does the solution cover?
2. Which security and governance functions already exist?
3. How are events, permissions and policies enforced and documented technically?
4. How does the solution fit the existing operating model without creating new uncontrolled interfaces?

Not every company needs an additional product right away. Often the first task is to clarify which controls already exist, where real gaps are, and which of them are business-critical.

All of these questions presuppose an inventory. Without one, it is impossible to judge what is missing or what should be bought.

6. From inventory to a robust readiness model

Effective AI Act readiness should not start with the longest possible list of measures. It should capture the starting position, assess relevant gaps and derive a prioritised decision.

A pragmatic approach has four steps.

Step 1: Capture inventory and context of use

Record the AI systems in use, their functions, responsible units, data access and key dependencies. Include embedded AI features and applications outside formal procurement processes.

Step 2: Classify roles and requirements

For relevant use cases, check which role the company holds, which risk category applies and which regulatory, contractual and internal requirements are relevant.

The classification should rest on the specific intended purpose and the actual system configuration. A general classification of the product alone is not always enough.

Step 3: Test controls and evidence

Assess whether responsibilities, permissions, transparency measures, monitoring and escalation paths are defined and implemented. Also check whether the effectiveness of critical controls can be demonstrated in a traceable way.

Step 4: Prioritise measures and decide

Rank identified gaps by regulatory relevance, potential harm, business importance and effort to implement. Set owners, deadlines and decision points.

The result should enable a clear management decision: Which measures are needed immediately? Which must be in place before scaling further? Which risks remain open, and who may accept them?

Conclusion: Readiness means being able to explain and control your own AI use

The EU AI Act, the growing autonomy of AI agents and the development of independent assurance methods point to the same management task: companies must organise their AI use to be transparent, controllable and traceable.

That takes more than a policy and more than a collection of technical security products. It takes a clear picture of actual use, a robust allocation of roles and responsibilities, and evidence that the relevant controls work.

For companies that use AI or want to expand its use, the decisive question is therefore not only whether they have an AI strategy.

It is this: can they show which AI they use, which risks arise from it, and how they control those risks?

That is where AI Act readiness begins.

Further reading

• EU AI Act: Regulation and regulatory framework
• Forrester: Who Will Become The Trusted Assurer Of Your Enterprise AI?
• Crunchbase News: The Emerging M&A Map For AI Agent Security
• McKinsey: When can AI make good decisions? The rise of AI corporate citizens

Next step

The Market Launch AI Act Readiness Framework takes you from inventory to implementation. You receive a documented overview of your AI systems with role and risk classification, a prioritised gap analysis, a 30-60-90-day action plan with clear responsibilities, and sales-ready material for procurement and security reviews in the DACH market.