The Preparation Window Won’t Stay Open
Tales from the Hat — EU AI Act series, Part 3 of 3
This is the last post in a three-part series on the EU AI Act and what it means for boards and senior leaders. In the first, I made the case for why this is a board-level issue that can’t be deferred. In the second, I laid out what good AI governance actually looks like in practice. In this one, I want to be direct about what happens next.
The EU AI Act’s transition period is not a grace period. It’s a preparation window. There’s a meaningful difference between the two.
A grace period is time to delay. A preparation window is time to build. The organisations that use this period well will have governance frameworks in place before enforcement pressure arrives. They’ll be making AI decisions with confidence rather than anxiety. They’ll have boards that can exercise genuine oversight, and leadership teams that can show compliance the moment they’re asked.
The organisations that treat this as a grace period will be scrambling — building under pressure, in the middle of regulatory scrutiny, with too little time and the wrong starting point.
The window’s open now. What matters is what you do with it.
Where to Actually Start
The starting point is the same for every organisation: understand where you actually stand.
That means a proper AI risk and readiness review — a systematic look at how AI is being used across your institution, what risk profile those uses carry under the Act’s classification framework, and what governance gaps sit between where you are and where you need to be.
This isn’t the kind of thing that goes well as an internal exercise handed to whoever happens to be most interested in AI. It benefits from an outside pair of eyes and a structured methodology, precisely because it’s hard to mark your own homework objectively when you’re the one who built the thing being assessed. Whoever does it, the output needs to be something a board can actually act on: a clear, prioritised picture of what needs to change and in what order.
From there, the work runs in three parallel streams: building the governance structure and policy framework, embedding it in day-to-day operational process, and training the people who need to understand and apply it.
None of this is especially complicated. It does need to be done properly, and it does need to be done now rather than later.
What the Window Actually Looks Like in Practice
Organisations that take this seriously over the next six to twelve months aren’t just ticking a compliance box. They’re building a capability — the ability to make AI decisions with confidence, to show responsible governance to anyone who asks, and to innovate with AI from a position of strength rather than exposure.
That capability compounds. A board that understands AI risk asks better questions. A leadership team with clear governance frameworks makes faster, more defensible decisions. Staff who understand the policies, and the reasoning behind them, are more likely to flag concerns, follow process, and use AI in ways that benefit the institution rather than expose it.
The cost of not building this isn’t just a fine or a regulatory finding. It’s the slower, harder-to-quantify erosion of confidence, reputation, and institutional control that comes from operating without a framework while everything around you keeps moving.
The Honest Case for Acting Now
I’ll end this series with the most direct version of the argument I’ve made across all three posts.
The EU AI Act isn’t going away. The compliance timeline is running. The organisations that build their governance infrastructure now, during the preparation window, with time to do it properly, will be in a fundamentally better position than the ones that wait.
Because ultimately this isn’t only about avoiding risk. It’s about being able to say, with genuine confidence, that your organisation is using AI responsibly. That your board understands what it’s overseeing. That your staff have the knowledge and the framework to innovate safely. And that when someone asks you to show your AI governance — a regulator, an inspector, a parent, a student — you’ve got something real to put in front of them.