Enterprise AI Governance

The EU AI Act applies to US enterprises the moment their AI output reaches an EU customer, employee, or counterparty. Under Article 2(1)(c), jurisdiction follows the output, not the infrastructure. A credit scoring system hosted in Virginia that processes EU counterparties is in scope, with penalties reaching 7% of worldwide annual turnover calculated against the global parent company.
Two obligations are already enforceable. Prohibited AI practices and AI literacy requirements took effect February 2025. The full high-risk regime arrives August 2, 2026. Credit scoring, patient triage, and employment screening are explicitly high-risk. Fraud detection and algorithmic trading are not. Forty percent of enterprise AI systems fall in an ambiguous middle where Article 6(3)’s profiling override reclassifies most as high-risk.
The liability exposure goes beyond fines. The Product Liability Directive adds strict liability for non-compliant AI. Major insurers are moving to exclude AI-related coverage. All three can land simultaneously.
This article covers jurisdiction triggers, high-risk classification across banking, insurance, and healthcare, the collision of US state AI laws with the EU deadline, human oversight architecture (HITL, HOTL, HOVL), documentation-as-code, crypto-shredding for multi-framework logging, and six engineering decisions enterprises must make before August 2026.