Book a Discovery Call
Book a Discovery CallContact us
All insights

Governance

Shipping AI under the EU AI Act: governance without the theater

Peak AI EngineeringNovember 6, 20256 min read

The AI Act is now a delivery concern, not just legal overhead. The good news: most of what it asks for — documentation, risk management, traceability — is also just good engineering.

For anyone building or selling AI into Europe, governance has quietly moved from a legal afterthought to a delivery requirement. The EU AI Act entered into force on 1 August 2024, with obligations phasing in over the following years. If you’re shipping AI into regulated or data-heavy contexts, it now shapes how you design and document systems — not just how you sign contracts.

The timeline that matters

The rollout is staged: prohibitions and AI-literacy obligations began applying in February 2025, general-purpose AI obligations from August 2025, and the bulk of the requirements — including for high-risk systems — from August 2026. The practical takeaway is that documentation, risk management, and traceability stop being optional well before the headline deadline.

Governance is mostly good engineering

Here’s the part teams miss: most of what governance frameworks ask for is what you should be doing anyway.

  • Traceability — knowing who or what produced an output, and why — is an audit requirement and the only way to debug an AI system.
  • Model-risk management — identifying risks, adding controls, and monitoring — is the NIST AI Risk Management Framework and basic reliability work.
  • Data-handling clarity — controller / processor boundaries and sub-processor controls — is compliance and good security hygiene.

Build these in from the start and compliance becomes a byproduct of doing the work well, rather than a retrofit under deadline pressure.

Avoid the theater

Governance theater — binders of policy no one follows — helps no one. What buyers and regulators actually want is evidence: traceable systems, documented risks, monitored quality, and clean data boundaries. We design for that from day one, so the honest answer to “can you show us how this works and why we should trust it?” is always yes.

Governance done right isn’t a tax on shipping. It’s part of what makes the system worth shipping.

Working on something like this?

We help teams take AI from a promising prototype to a system that ships and holds up.

Book a Discovery Call

More insights

Delivery

Why most AI projects die between the demo and production

The demo is the easy 20%. The reason AI initiatives stall is almost never the model — it’s the integration, evaluation, observability, and cost work that turns a prompt into a system.

April 22, 20266 min read
Retrieval

RAG is a retrieval problem, not a prompting problem

When a RAG system gives wrong answers, teams reach for the prompt. The fix is almost always upstream: what you retrieved, how you chunked it, and whether you can even see why.

March 11, 20265 min read
Quality

Evaluations are the only thing between you and silent regressions

A prompt tweak or model upgrade can quietly degrade quality, and you won’t know until a customer tells you. Evaluation harnesses turn that invisible risk into a number you can act on.

February 4, 20265 min read
Let’s talk

Have a workflow, product, or AI initiative that needs to work in production?

Tell us what you’re trying to ship. We’ll give you an honest read on whether AI is the right tool — and how we’d build it to last.

Book a Discovery CallSee our work