Relay & Co. · Briefing · 23 August 2026 · 4 min read

AI Governance Briefing: What Changes This Quarter

If you are an executive, GRC lead or CISO, here is the practical state of AI governance right now — and what actually matters.

1. EU AI Act enforcement is no longer theoretical

The framework has moved from something to prepare for into something that applies. High-risk system requirements and governance provisions now reach organisations serving EU users regardless of where those organisations are based.

The dividing line between comfortable and scrambling is simple: teams that completed an AI system inventory over the past year are in good shape. Teams that did not are now doing discovery and compliance at the same time, under a deadline. The plain-English guide covers the tiers and timeline.

2. Shadow AI is the finding, everywhere

Most organisations do not know how many AI tools their teams are using. Unapproved usage is the single most common compliance and data-protection issue surfacing in governance reviews — ahead of model risk, ahead of vendor terms, ahead of everything technical.

It is worth being precise about whose problem this is: it is an organisational leadership issue, not an IT one. The cheapest useful step remains a confidential internal survey, and the return on that afternoon is larger than any tool you could buy this quarter. More on shadow AI.

The organisations doing well are not the ones with the most sophisticated frameworks. They are the ones who wrote down what they run and gave it an owner.

3. ISO 42001 is becoming the practical spine

The AI management-system standard gives structure to work that otherwise sprawls, aligns cleanly with EU AI Act obligations, and is increasingly what auditors recognise as a credible governance approach. If you need one reference to organise around, this is currently the safest bet.

Five actions worth taking now

  1. Run a non-punitive AI tool inventory survey. Anonymous, short, and genuinely without consequences for honest answers.
  2. Name a single accountable owner for AI governance. One person, with authority, not a standing committee.
  3. Create a basic AI risk register. Systems, risks, mitigations, review dates. Template here.
  4. Write a one-page AI usage policy. Approved, needs-approval, forbidden. Anything longer will not be read.
  5. Document your regulatory exposure timeline. Which provisions apply to you, and when.

About this briefing

Relay & Co. publishes practical, no-hype AI governance and tech-trend briefings. Subscribe to get the next one, or browse the full library.