AI Compliance Is the Next Frontier. Most Aren't Ready

The regulatory perimeter around AI just hardened. And for most organisations, the gap between what they are deploying and what they can defend to a regulator is now commercially material.

The EU AI Act is in force. ISO 27001:2022 has been extended with AI-specific and cloud controls. DORA is fully enforceable across financial services. NIST AI RMF is becoming the de facto reference point for enterprise governance in the US. Individually these are compliance obligations. Collectively they are a signal: AI is moving from experiment to regulated infrastructure.

Where the real exposure sits

The risk is rarely in the flagship AI project. It is in the dozens of shadow deployments: marketing tools, recruiting filters, customer service copilots and internal code assistants, all adopted at team level without a governance wrapper. Each one is a potential in-scope system the board has never seen on a risk register.

What 'ready' actually looks like

• An AI inventory. Every system, vendor, data source, and use-case documented, classified by risk tier.
• A governance owner. A named accountable executive, not a rotating committee.
• Integrated controls. AI risk mapped into the existing ISMS rather than bolted on as a separate workstream.
• A board-ready narrative. Exposure, mitigation, and residual risk translated into commercial language.

The commercial angle

Firms that treat AI compliance as a cost will move last and pay most. Firms that treat it as a trust asset, provable to customers, regulators, insurers, and acquirers, will convert it into a procurement advantage. In regulated sectors, that advantage is already showing up in RFP scoring.

The window between voluntary preparation and mandatory enforcement is closing. The organisations that act inside it will define the standard. Everyone else will comply to it.