EU AI Act Forum session explored how organisations can move beyond abstract regulatory awareness towards practical, risk-based governance that works across legal, technical and business functions. The discussion was led by Professor Andrej Savin, Professor of Information Technology and Internet Law at Copenhagen Business School, Alexander Deicke, Interim Head of Legal and Chief Compliance Officer at Concept Mobility, and Sid Ali Boutellis, Co-Founder of Expanse Trade and Legal AI Applications & AI Governance Specialist. Together, they examined how to move organisations beyond abstract regulatory awareness towards practical, risk-based governance that can work across legal, technical and business functions.
Overview
The priority is understanding that the EU AI Act is not a complete AI regulatory regime. Savin described it as risk-based product safety legislation, with many key issues (including liability, GDPR, IP, and sector rules) sitting outside it. For legal teams, this means AI compliance requires broader regulatory mapping rather than treating the Act in isolation.
Deicke translated this into a practical starting point: build an AI inventory and classify the organisation’s role (provider, deployer, etc.). This helps identify obligations and can build on existing IT asset registers. He stressed that AI compliance should not be siloed, as it increasingly overlaps with GDPR, IP, cybersecurity, and sector regimes such as DORA and NIS2.
The discussion then shifted to organisational readiness. Savin emphasised that technology cannot replace board-level ownership and clear governance across legal, compliance and technical teams. Deicke added that organisations must first understand their business and data, then assess and prioritise risks. This is especially important with AI agents, where autonomy and variability make oversight more complex, as seen in controlled-use approaches in regulated sectors like banking.
Key Takeaways
- Do not treat the EU AI Act as the whole regulatory picture. Liability, data protection, IP, cybersecurity and sector rules may all apply.
- Start with an AI inventory. You cannot assess obligations without knowing what systems you use and your role.
- Build on existing processes. Use IT asset inventories and current governance structures rather than creating new silos.
- Treat AI compliance as risk management. Identify business context first, then prioritise and manage risks.
- Ensure cross-functional ownership. Legal, compliance, tech and leadership must work together from the outset.
- Technology supports, but does not replace accountability. Responsibility must remain at board and organisational level.
