The EU AI Act Is Reshaping Governance Expectations Globally

A mid-sized company I spoke with does no business in Europe. No EU customers, no EU office, no plans for either. Last quarter their largest client sent over a vendor questionnaire, and folded into the usual security questions was one they had never seen before: how do you classify the risk level of the AI systems used in delivering this service? Nobody on the team had an answer ready. The EU AI Act had reached them anyway, not as a law they were subject to, but as a question their customer had learned to ask.

That is the part that surprises people. The Act is European law, and most of the noise about it is about who is technically in scope. The bigger story for everyone else is quieter.

For a while, governance expectations were set mostly by regulators, and you could reasonably ask whether a given rule applied to you. What is changing is that the expectations are now traveling through contracts and procurement teams, which do not care much about jurisdiction. Your customers’ customers answer to someone, and the questions roll downhill. By the time they reach you, they have stopped being a legal matter and become a condition of doing business.

How a European law became everyone’s reference point

There is a recent precedent for this. Data-protection rules written for Europe ended up shaping how companies all over the world talk about personal data, not because everyone was in scope, but because the largest buyers adopted the vocabulary and pushed it down their supply chains. It became easier to meet the higher bar everywhere than to maintain two versions of everything.

The AI Act looks set to do something similar with risk. Its core move is simple to state: sort AI uses by how much they can affect people, and apply more scrutiny to the ones that matter more. You do not have to be governed by the Act to find that framing showing up in a sales process, because it gives buyers a shared language for a question they already wanted to ask.

The Act’s reach has less to do with where you operate and more to do with who your customers answer to.

What changes when you are the one being asked

For an organization that is already fairly mature, with policies and a committee and people who take this seriously, the shift is subtle. The work moves from having good intentions to being able to describe your systems in the language other people are now using. “We use AI responsibly” is no longer a sufficient answer to a structured question about risk tiers. You need to be able to say which of your uses are low-stakes, which touch decisions about people, and what you do differently for the second group.

It helps to see the shape of the framing rather than the legal text, which is genuinely not the point here. Most everyday business uses sit lower on the scale than the headlines suggest.

Getting ready without overreacting

The two failure modes here are predictable. One is to ignore it until a deal stalls on a questionnaire nobody can answer. The other is to panic and treat every spreadsheet macro as a high-risk system requiring a committee. Both are expensive in different ways. The calmer path is mostly inventory and honesty.

•      List the places AI actually touches your work, including the quiet tools that crept in without a decision.

•      Sort that list by how much each use affects a real person’s outcome, not by how impressive the technology is.

•      Document the higher-impact handful properly first, and leave the genuinely trivial ones genuinely light.

•      Write your answers in the risk language buyers are using, so a questionnaire becomes a copy-and-adjust rather than a scramble.

Doing this once, calmly, is far cheaper than doing it five times under deadline pressure for five different customers. It also tends to reveal that you are in better shape than you feared, which is its own kind of useful.

Maturity, at this stage, is less about adding controls and more about being able to show your thinking. Most organizations moving through this find the same progression.

Why this is a commercial issue, not only a compliance one

It is tempting to file all of this under risk and legal, and to wait for them to handle it. That misreads where the pressure is coming from. When the question arrives inside a sales process, the speed and confidence of your answer becomes part of how trustworthy you look as a vendor. A clear, fast response signals an organization that has its house in order. A two-week delay while everyone hunts for who knows the answer signals the opposite, regardless of how good your technology is.

There is a balance to hold here, between moving fast on AI and being able to stand behind what you have built. That tension is worth thinking about directly, and Strategies to Navigate AI’s Dual Promise of Opportunity and Risk is a useful companion read on keeping both in view.

Where to start

If your organization is mature enough to be reading this and nodding, the next step is small and concrete: get the inventory and the risk-sorting done before a customer forces the timeline. The framing is spreading faster than the regulation, which means the smart move is to be ready for the question rather than surprised by it. If it would help to map your specific situation against where expectations are heading, the AI governance experts in Compass can work through it with you, without the fear-based framing this topic usually attracts.

Worth sitting with

If a major customer asked us tomorrow to classify our AI uses by risk, could we answer in a day, or would it trigger a scramble?

Which of our AI uses genuinely affect people’s outcomes, and are those the ones getting the most attention?

Are we treating this as a legal question to wait on, when it is arriving through sales?

Where are we at risk of overreacting, applying heavy scrutiny to uses that barely matter?