By Mike Macauley
As AI regulation evolves, are firms prepared to balance innovation with stronger data governance, transparency, and accountability for compliant, future-ready adoption?
No executive can say with certainty what their AI compliance obligations will be a year from now.
Technology is advancing rapidly, while legal frameworks struggle to keep pace. For organisations investing in AI, the key question is not what regulators will do, but whether your data architecture can withstand scrutiny under any regulatory environment.
That is why governance is so important: bring your AI onto a unified, governed foundation where data, access and decisions sit in one controllable place, rather than scattered across systems that were never built to work together.
Why is AI regulation a moving target?
The European Union AI Act took effect in 2024 with a risk-based structure and phased implementation. However, the timetable has already shifted. This year, the European Commission approved amendments, known as the “AI omnibus”, which delay the strictest requirements for high-risk systems until December 2027 and August 2028. Transparency rules, including the obligation to inform the public when interacting with AI, will still take effect next month (August 2026). Penalties can reach €35 million or 7% of global turnover. Although the law is in force, deadlines continue to change.
Britain has chosen a different approach. Rather than a single statute, the government has established five cross-sector principles: safety, transparency, fairness, accountability, and contestability. Existing regulators, such as the Information Commissioner’s Office (ICO), the Financial Conduct Authority, and Ofcom, are responsible for applying these principles within their areas.
Companies operating in both the UK and EU must comply with both regulatory regimes. The EU Act applies if a company’s system output is used within the bloc. Data protection laws also apply: Article 22 of the UK GDPR restricts decisions made solely by automated means, and the ICO requires meaningful human involvement.
Legal challenges are already testing these boundaries. In a landmark case against the German credit agency SCHUFA Holding, Europe’s highest court ruled that a credit score constitutes an automated decision if a bank uses it to reject a loan. Responsibility lies with both the scoring agency and the lender, bringing routine credit scoring and profiling under strict AI privacy laws.
What does a fragmented foundation cost?
Few enterprises planned their current IT infrastructure. Most inherited a patchwork of disconnected software through growth and acquisitions. As a result, customer or product data often appears inconsistent across applications.
This was manageable when software only stored and served data. AI changes this dynamic because every model built on a fragmented system inherits its complexity at scale. As technology evolves, from large language models to multimodal and agentic AI, each advancement introduces new compliance risks. If systems communicate effectively and draw from a single data source, audits become straightforward. A governed foundation provides clear answers about AI decision-making, data usage, and traceability. A disjointed foundation leaves you uncertain and exposed.
What does getting it right look like in practice?
Consider the Council of Europe. As the continent’s leading human rights organisation, it spans 46 member states and has operated for over 70 years. Over time, however, it grew into a messy web of separate operations, where every department ran its own programmes. By 2010, this setup had created roughly 150 separate websites with no shared editorial direction. Users struggled to find information among thousands of scattered pages.
The Council fixed this by consolidating everything behind a single, managed platform. Today, one main portal runs 85 of those sites, and the Council is moving the remaining 115 sites into this same structure and consistent look. Now, around 300 contributors manage nearly 40,000 pieces of content. The system grants specific permissions to each user, ensuring they only add, edit, or publish what they should. Thanks to these improvements, monthly website visits jumped by 22%.
The real gain is control. On one platform, you know exactly who can touch what, and you keep a single record of who did. That is the governed foundation regulators now expect, and the base you need before layering AI on top. When every action is traceable and every permission explicit, an audit becomes a quick search instead of a dig through disconnected systems. This discipline also allows the Council to run sensitive services safely. For example, they host a secure platform where journalists report threats to their safety, protecting data with tight access controls.
The Council also patiently built this platform. Instead of trying to rebuild everything at once, they rebuilt sites one by one, starting in 2010, then extended the platform to their internal network.
Universal lessons
These principles apply to any organisation. Systems need consistent interfaces and clear boundaries. Make data contracts explicit, so a change in one place can’t cause issues elsewhere. Access has to be built in from the start, defining who can do what and when, not patched on afterwards. Keep a human in the loop on important decisions. And log everything, so you can reconstruct events and respond to auditor requests. If you do that, you’ll have a foundation you can govern rather than software you can only operate.
The future
Delaying action is not advisable, as technology will continue to advance and penalties will increase. Build a solid foundation now, before regulations require it and before the next wave of AI increases the stakes. As we are all experiencing, things are moving fast. Establishing a strong foundation accelerates AI deployment and ensures regulatory compliance.
Achieving this requires three steps. First, prioritise interoperability over intelligence; data must flow cleanly before adding advanced models. Second, build resilience alongside speed. Third, treat governance and ethics as strategic assets.
Good governance is becoming increasingly important, especially when your clients are regulated and your weak spots become their problem.
As the Commercial Director and Regional Sales Lead for Liferay in the UK and Ireland,
