Shadow AI is a governance-readiness problem, not a deadline
The first artifact three separate AI frameworks all demand is the same: a register of the AI systems in use, their data posture, and an owner. Build that register now for the governance value, and let the shifting AI Act dates be a secondary driver.
The pressure to "do something about AI" tends to fixate on a single enforcement date. That is the wrong anchor. The first thing the EU AI Act, the NIST AI RMF MAP function, and ISO/IEC 42001 all ask for is identical: a register of the AI systems actually in use, their data posture, and an accountable owner. That register is worth building now for the operational value, whatever the final calendar turns out to be.
Last verified: 2026-08-03.
The readiness artifact
The ITSailor AI Act register turns the AI tools discovered across a tenant into an audit-ready inventory. For each tool it records category, a baseline tier, data sensitivity, whether it trains on customer data, EU data residency, a data-processing terms link, an accountable owner, the observed access risk from its OAuth scopes, and the concrete gaps to close. It is discovered from the same shadow-IT lens that joins service principals to delegated grants and flags known AI vendors.
# Governance priority is derived, not guessed
if access risk is high OR the tool trains on customer data:
priority = act-now
elif unclassified OR access risk medium OR no DPA on record OR data sensitivity high:
priority = review
else:
priority = monitor
Recommendation
Stand up the AI-system register first and treat it as the readiness deliverable. It is useful the day it exists: it surfaces which AI tool holds broad tenant access, which one trains on data by default, and which one has no data-processing terms on file. NIS2 Article 21, which is already in force and enforced, is the near-term reason a regulated operator needs this inventory, well ahead of any AI-specific date. The register lives inside the SaaS auditor at /tools/saas-auditor.
Trade-offs
A register is a living document, so it trades a one-time build for an ongoing keep-it-current cost. The counter is that the same scan that discovers shadow SaaS produces the AI inventory as a by-product, so the marginal cost is small once the scan runs. The register records evidence for these frameworks; it does not assert a high-risk classification, because that depends on the deployment use and must be confirmed per tool.
Where this does not apply
This does not apply as a compliance verdict: it is evidence for the AI-system register those frameworks expect, not a statement that any obligation is met. It also stops applying as a reason to wait. The high-risk dates are settled now rather than contested: the Digital Omnibus on AI passed the European Parliament on 16 June 2026 and the Council on 29 June 2026, moving Annex III standalone high-risk systems to 2 December 2027 and Annex I embedded systems to 2 August 2028. The Article 50 transparency obligations were not deferred and have applied since 2 August 2026. A later deadline buys time to build the register, not permission to skip it.
Sources and further reading
Turn the trade-off into a scoped brief.
Share the constraints that differ in your environment. Michal will identify the next check needed before a delivery decision.
Start a scoped briefMore from Ops Log
The licence you keep paying for after the seat goes dark
License waste in Microsoft 365 has two honest layers: seats you can reclaim from hard data today, and a term premium you can model but not read from Graph. Here is how I separate them so the number I quote is defensible.
The offboarding evidence pack, control by control
An auditor does not ask whether an offboarding SOP exists. They ask for the artifact that proves each control ran. Here are the twelve controls I build the evidence pack around and the proof each one needs.
What a Microsoft 365 offboarding scan finds after the account is disabled
Disabling an Entra account is the start of offboarding, not the end. Here are the eight access residues a read-only Microsoft Graph scan reads back, and why each one matters to an auditor.