Most governance teams spent 2024 and 2025 doing the right first thing: classifying their AI systems, writing acceptable-use policies, and standing up review committees. That work matters. But the EU AI Act — like SOC 2, ISO 27001, and HIPAA before it — is not satisfied by the existence of a policy. It is satisfied by a record.
Article 12 of the Act requires automatic logging across the lifetime of a high-risk system. Article 17 requires a quality management system that is demonstrably in operation, not merely documented. Article 72 requires post-market monitoring that someone can actually inspect. Each of these is, in plain terms, an evidence obligation.
01 / The screenshot era is ending
The traditional answer — export a report, take a screenshot, store it in a shared drive named “Audit 2026” — was already strained under SOC 2. Under the AI Act it fails structurally, because AI systems change weekly. A screenshot of a model register taken in January says nothing about February. Point-in-time proof and continuously-changing systems are incompatible by definition.
Regulators understand this. So do the enterprise customers now pushing AI-governance addenda into their vendor contracts. The standard being set is not “show me a document.” It is “show me the record, and show me it was kept independently.”
A policy says what should happen. Evidence says what did. The AI Act is the first major framework written, top to bottom, for the second category.
02 / Where the proof actually lives
Here is the under-appreciated fact: for most mid-market companies, the proof already exists. It lives in the platforms you already run. Salesforce knows who accessed which records and when Einstein features were enabled. Microsoft 365 knows where Copilot is deployed and what your retention policies actually enforce. Your identity provider knows who can reach the model endpoints. Your ticketing system knows whether the human-oversight review actually happened.
The problem has never been the existence of evidence. It is that the evidence is scattered across a dozen systems, owned by different teams, and collected by no one — until an auditor, a regulator, or an enterprise customer asks.
Consider what a single AI Act obligation touches in practice. Demonstrating human oversight of one high-risk system requires proof from identity (who holds reviewer access), from workflow (that the reviews occurred on schedule), from the platform itself (that the feature configuration matches what was approved), and from HR or training systems (that the reviewers were competent to review). Four systems, four owners, one obligation. Multiply by every obligation in scope and the coordination problem becomes obvious — and so does why a quarterly screenshot exercise was never going to survive contact with it. The companies handling this well are not the ones with the thickest policy binders. They are the ones who treated proof collection as an operating function, running continuously, the same way they treat payroll or backups.
03 / The trap of solving it with more data ingestion
The reflexive answer from the GRC software market is familiar: connect everything, ingest everything, and let the tool hold a copy. For AI governance this is precisely backwards. The systems under scrutiny are the ones processing your most sensitive data — handing a compliance vendor a second copy of that data widens the attack surface the framework exists to narrow.
The defensible architecture is the opposite one: observe the control at its source, record the proof that it was met, and never take possession of the underlying content. An auditor does not need your customer records. They need confidence that your controls operated. Those are different things, and the difference is the entire design question of the next decade of business governance — a question much bigger than the GRC industry that named it.
04 / What the request will actually look like
It is worth being concrete about how this lands on a mid-market company, because it rarely arrives as a regulator at the door. It arrives as a security questionnaire from your largest enterprise prospect, with a new section on AI governance that wasn’t there last year. It arrives as a renewal call where procurement asks who reviews your model changes and how they would verify it. It arrives as your own auditor — already engaged for SOC 2 or ISO 27001 — extending scope because your product now ships an AI feature and your controls map says nothing about it.
In each case the request has the same shape: not “do you have a policy,” but “walk me through the record.” Who approved this system for deployment? Show me the review. When did a human last verify the oversight control? Show me the timestamp. Has your AI inventory changed since the document you sent us? Show me the history. A policy answers none of these. A continuous record answers all of them in minutes, and — this is the commercial point — answering them in minutes is what keeps a seven-figure renewal from stalling in legal review for a quarter.
The penalty structure of the Act gets the headlines, scaled as it is to global turnover. But for most companies the real enforcement mechanism is quieter and faster: enterprise buyers are writing the Act’s evidence obligations into their vendor contracts, which means the deadline isn’t a regulator’s calendar. It’s your next sales cycle.
05 / What to do before the next request arrives
Three moves, in order. First, make your governance operable: clean the policies, and map how controls actually depend on each other — most AI obligations inherit from access, retention, and vendor controls you already have. A company with a working access-review control in Okta and a working retention control in Microsoft 365 is closer to AI Act readiness than it thinks; the work is connecting the inheritance, not starting over.
Second, turn the written rules into checkable ones, tied to the systems where the work happens. “We maintain human oversight of high-risk AI systems” is a sentence. “Every flagged decision is reviewed within 48 hours, the review lives in our ticketing system, and the completion rate is checked daily” is a control. The distance between those two statements is the distance between a policy binder and a defensible position.
Third, start the record now. Continuous evidence has a property nothing else in compliance has: it gets stronger the longer it runs. A control proven daily for a year is a fundamentally different asset than the same control attested to once. It cannot be reconstructed after the fact, which means every month of delay is a month of proof that will never exist.
Companies that begin in 2026 will face their first AI Act inquiry with a year of unbroken proof. Companies that wait will face it with a folder of screenshots. Both will have policies. Only one will have an answer.
See it on your company.
This is the desk work of the office we embed. A structured governance review shows you, on your own documents and systems, exactly where your proof is strong, fragile, and missing — in plain language, no data required.