Unprecedented threefold regulatory pressure
Organizations deploying AI in 2026 operate in a regulatory environment unlike any before. Three frameworks overlap, interact and sometimes contradict each other. Ignoring them is not an option. Handling them separately, even less so.
The European AI Act, which came into force in August 2024, phases in its obligations over three years. It classifies AI systems into four risk levels (unacceptable, high, limited, minimal) with proportionate requirements: transparency, traceability, human oversight, and conformity assessment before market placement for high-risk systems. The vast majority of AI systems deployed in companies fall into the limited or high-risk categories. Few organizations have grasped what that means.
GDPR remains the reference foundation. The AI Act does not replace it. It is layered on top. The obligations of data minimization, legal basis, management of individuals' rights and Data Protection Impact Assessments (DPIAs) apply in full to AI systems that process personal data. And almost every enterprise AI use case does.
Digital sovereignty, finally, is a less formal but equally real pressure. The US CLOUD Act and Section 702 of the Foreign Intelligence Surveillance Act (FISA) allow US authorities to access data hosted by providers subject to US law, including through their European subsidiaries. For sensitive data, personal data and data in regulated industries, this extraterritorial risk is no longer acceptable.
What is new: these three frameworks apply simultaneously, on different timelines. The AI Act is phased in over 3 years. GDPR has been in force since 2018, but its application to AI systems still has major gaps. Sovereignty has no regulatory deadline. But every data leak incident increases the political and contractual pressure.
The false dilemma: agility vs. compliance
The most common reaction we see in organizations facing this threefold pressure: putting it on hold. "We'll look at that once the MVP has shipped." "Compliance is for phase 2." "We can't afford to slow down for legal questions."
That is a miscalculation. And above all, it is a timing mistake.
Handling compliance after the fact (once systems are designed, data collected and architectures deployed) always costs more than building it in from the start. We have seen it with GDPR since 2018: organizations that practiced privacy by design take weeks to become compliant. Those that ignored it face projects lasting months, sometimes years.
The AI Act repeats exactly the same pattern, with added complexity: qualifying an AI system after it has been built is difficult. Modifying its architecture to meet high-risk requirements after deployment is expensive. And taking over lifecycle management of an existing AI system with no initial documentation is, in practice, often impossible without starting from scratch.
Compliance by design is not a luxury for large organizations with sprawling legal teams. It is the only economically rational approach at the scale of an AI program.
The 4 pillars of compliance by design
Mapping data processing activities comes before any AI system rollout. Every processing of personal data is documented: purpose, legal basis, retention period, transfers. Data minimization is a design constraint, not a communication principle. DPIAs are carried out in a targeted way, on high-risk use cases, before going into production. The record of processing activities is maintained continuously, not updated at audit time.
Every AI system is inventoried and qualified according to the AI Act's four risk levels. This qualification determines the applicable obligations: technical documentation, human oversight, robustness, transparency toward users. The AI system's lifecycle (from design to decommissioning) is documented and auditable. Internal tools (ethics charter, risk analysis grids, documentation templates) make it possible to handle this qualification at industrial scale, without recreating an ad hoc process for every project.
Sensitive data and personal data are stored within the European Union. Transit outside the EU is prohibited for the most sensitive categories of data. Encryption keys remain under the organization's control (BYOK - Bring Your Own Key, or HYOK - Hold Your Own Key). Cloud providers are selected from qualified sovereign operators: OVHcloud, Bleu (owned by Orange and Capgemini), S3NS (Thales). This location requirement is not just a contract clause. It is verified in the architecture and audited.
AI compliance is not a silo. It fits into existing governance frameworks: data governance, IT governance, industry-specific regulatory compliance. Roles are clear: data owners per business domain, AI compliance officers, a DPO involved from the moment AI systems are qualified. This cross-functional governance avoids two symmetrical pitfalls: over-bureaucratization (an AI compliance committee that blocks everything) and lack of accountability (everyone assumes someone else is handling it).
The 3-phase approach
Putting these four pillars in place does not happen in a single intervention. The Niji Data & Trust approach is structured in three complementary phases:
Framing the regulatory requirements that apply to the organization (GDPR + AI Act + industry constraints). Building a common language between legal, technical and business teams. Defining the AI compliance RACI. Drawing up a prioritized roadmap by risk level and remediation effort. This phase produces a clear view of the starting point and the target.
Setting up the AI system lifecycle: qualification, documentation, validation before production. Rolling out compliance tooling: AI ethics charter, risk analysis grids, DPIA templates adapted to AI systems, a data location reference framework. Addressing the existing backlog: retrospective qualification of AI systems already in production. This is the most intensive phase, and the one with the most immediate effect on actual risk levels.
Building compliance into operational routines: periodic reviews, updating qualifications as models or use cases evolve. Setting up active regulatory monitoring (the AI Act keeps evolving through delegated acts and harmonized standards). Building a lasting operating model: AI compliance is no longer a project. It is an in-house capability.
What it looks like in the field
A critical infrastructure operator (a heavily regulated industry, sensitive data involving millions of users, security constraints at ANSSI level) launched an AI compliance program in 2025. The numbers speak for themselves.
In three months, with a squad of 3 Niji FTEs (a GDPR/AI Act expert, a data architect and a governance consultant), more than 200 AI use cases were analyzed and qualified according to the AI Act's risk levels. A compliance roadmap was produced, prioritizing the 40 high-risk use cases. Remediation of the existing backlog was structured. A standardized AI system lifecycle was rolled out, with its associated tooling.
What made this speed possible: a dedicated full-time team, a proven method and, above all, an internal sponsor who understood that compliance was not a constraint to manage but an asset to build. Compliant systems are easier to evolve, simpler to audit and legally more robust in the event of an incident.
What this field experience teaches us: AI compliance is not an impossible 18-month project. With the right method and the right resources, the preparatory work and initial qualification of a significant portfolio of use cases can be completed in a quarter. What takes time is making it last. But that is built in parallel, not afterward.
What Niji brings in practice
Niji's Data & Trust offer covers the full spectrum, from initial assessment to ongoing operational governance. Here is what organizations ask us for most often, and what we bring:
| Need | What Niji brings |
|---|---|
| Qualify my AI systems under the AI Act | AI system inventory + qualification - analysis grids, risk levels, applicable obligations per system |
| Address my GDPR backlog on existing AI processing | Audit + remediation plan - processing map, legal bases, targeted DPIAs, updated record of processing |
| Secure where my data is located | Architecture diagnostic - identification of non-EU flows, BYOK/HYOK recommendations, qualification of sovereign cloud providers |
| Set up lasting AI governance | Operating model - RACI, roles and responsibilities, integration into existing frameworks, tooling (ethics charter, templates) |
| Train my teams on the new obligations | Upskilling programs - by profile (legal, technical, business), hands-on qualification workshops |
| Ensure continuous regulatory monitoring | Active monitoring unit - tracking AI Act delegated acts, harmonized standards, GDPR case law applicable to AI |
Niji is a member of the Positive AI initiative, committed to responsible and sovereign AI. Our Cyber unit brings together more than 100 experts, with PACS/PASSI qualifications and ISO 27001 certification. Our Data & AI team counts more than 130 experts. This depth of expertise lets us treat AI compliance not as an isolated legal topic, but as a matter of architecture, governance and trust, working directly with the teams that build and operate the systems.