The world's first AI law just passed. The deadline is not the point.
The EU AI Act passed 523–46. Before the compliance industry arrives, a simpler take: the Act's risk lens is a management tool worth borrowing today.
📜 The world's first AI law just passed. The deadline is not the point.
Last week the European Parliament approved the AI Act by 523 votes to 46 — the first comprehensive attempt anywhere to regulate AI as such. Obligations will phase in over roughly two years, the penalties reach seven percent of global turnover, and the scope is extraterritorial: if your AI touches EU users or markets, your headquarters' location does not exempt you.
The predictable response is already forming: compliance decks, readiness assessments, a countdown to enforcement. All of that will matter. But I think the more valuable move, available to any leadership team this quarter, is simpler — borrow the regulator's lens before anyone forces you to.
The Act's core idea is almost boringly sensible: classify AI systems by the harm they could do, and scale the obligations to the risk. Unacceptable uses are banned; high-risk systems need documentation, human oversight and quality controls; low-risk systems mostly need transparency. Strip off the legal machinery and that is just... good engineering management, written down.
Now ask the uncomfortable question: could your organisation produce that classification for its own AI estate today? In my experience, most could not — not because the systems are dangerous, but because nobody has ever listed them. Models accumulate in corners: a scoring model in marketing, a screening tool in HR, a forecasting pipeline in finance, each adopted locally, none inventoried centrally. You cannot risk-tier what you have not catalogued, and you cannot govern what you have not tiered.
That inventory-and-classify exercise costs a few weeks. Done now, it turns the next two years from a scramble into a schedule. Done under deadline pressure in 2026, it will cost more, teach less, and land as resentment.
And there is a commercial angle worth naming: for anyone selling into regulated industries, demonstrable AI governance is about to shift from differentiator to entry ticket. The suppliers who can show their classification, their oversight, their audit trail will walk into procurement conversations that others get walked out of.
One question for your leadership team this quarter — and it works even if the Act never applies to you: if a regulator asked tomorrow for a list of every AI system you run, ranked by the harm it could cause, how long would it take you to produce? The honest answer to that question is your actual AI governance maturity. Everything else is documentation.
Reading: https://www.cnbc.com/2024/03/13/european-lawmakers-endorse-worlds-first-major-act-to-regulate-ai.html https://www.europarl.europa.eu/topics/en/article/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence