Jeen says EU AI Act compliance hinges on AI evidence, not policies

Jeen says companies facing the EU AI Act’s first enforcement milestone need more than written governance plans. The company argues most enterprises cannot automatically prove why an AI system made a decision, creating a documentation and audit gap that will matter as retention and high-risk system rules phase in.

Why it matters: - Jeen argues the EU AI Act’s hardest problem for enterprises is not the disclosure rule itself, but proving how AI reached a decision when auditors ask for evidence. - The gap matters because regulators are moving from policy review to decision-level accountability, which is harder to satisfy with fragmented tools and manual records. - Noncompliance can bring fines of up to €15 million or 3% of worldwide annual turnover for many infringements, with higher penalties for prohibited practices.

What happened: - Jeen published new analysis on August 20, 2026, saying most enterprises can show a policy but cannot show why a specific AI decision happened. - The analysis focuses on Article 50 of the EU AI Act, which took effect August 2, 2026 and requires AI systems that interact with EU citizens to clearly disclose their artificial nature. - Jeen says the issue is urgent even though some high-risk system requirements were delayed under the 2026 Digital Omnibus until December 2027 and August 2028. - Moti Krispil, Jeen’s Chief Strategy and Growth Officer, said compliance teams are asking the wrong question if they only check whether a policy exists.

The details: - Article 12 requires evidence of a high-risk AI decision to be generated automatically at the moment the decision is made, not reconstructed later from screenshots or memory. - Article 26 requires deployers to retain logs for at least six months, which means audits can reach back to earlier actions. - Jeen says fragmented AI tools create incompatible log formats and retention rules, leaving enterprises without a coherent audit trail. - Grant Thornton’s 2026 AI Impact Survey of nearly 1,000 senior US business leaders found 78% lack strong confidence they could pass an independent AI governance audit within 90 days. - IBM’s 2025 Cost of a Data Breach Report found 63% of organizations still have no formal AI governance policy. - Reco’s 2025 State of Shadow AI Report found the median unauthorized AI tool stays active inside an enterprise for more than 400 days before security finds it. - Gartner projects that 80% of unauthorized AI transactions in 2026 will trace back to internal policy violations rather than external attacks. - Jeen says a typical enterprise AI estate can include thousands of agents, a dozen models, and dozens of applications across cloud and on-premises environments, with procurement visibility into only a fraction of them.

Between the lines: - Jeen is framing AI governance as an evidence problem because written policies do not help if the organization cannot reconstruct a decision in real time. - The analysis also suggests that centralized, runtime controls are becoming more important than tool-by-tool oversight as AI use spreads across business units. - ISACA research links weak AI incident-response procedures to regulatory exposure, reputational damage, and service continuity risk, adding pressure beyond direct fines.

What's next: - Jeen says enterprises will need evidence-generating architectures before the high-risk requirements fully arrive in 2027 and 2028. - The company positions its Enterprise AI Harness as a model-agnostic control layer that routes model calls, agent actions, and policy checks through one point. - Jeen says the system writes every enforcement decision, policy version, input, and output to an immutable ledger as it happens. - The company argues that a single control layer could let enterprises apply a new rule once across their AI estate instead of retrofitting each system separately.

The bottom line: - Jeen’s core message is that AI compliance under the EU AI Act will be won or lost on audit-ready evidence, not on policy documents.