AI governance and ESG reporting have merged into a single evidence problem. The sustainability report now has to describe how models are governed; the AI governance file now has to carry environmental numbers — energy per workload, water per facility, emissions per training run. In Europe both halves run on law: the EU AI Act (Regulation (EU) 2024/1689) supplies the governance machinery, and CSRD/ESRS plus the ISSB baseline supply the disclosure frame. What the regimes jointly demand is not policy prose but records: logs, metrics, lineage, incident clocks. This guide lays out the timeline as it actually stands after the 2026 Digital Omnibus moved it, the audit metrics that generate defensible evidence, and the compute accounting that connects AI to the E in ESG.
The timeline, as amended
| Date | What applies |
|---|---|
| Feb 2, 2025 | Prohibited practices banned; AI literacy duties live |
| Aug 2, 2025 | General-purpose AI (GPAI) model obligations apply |
| Aug 2, 2026 | Article 50 transparency applies — users told they are interacting with AI; synthetic content marked machine-readably. The Commission’s GPAI enforcement and fining powers also begin |
| Dec 2, 2027 | Annex III high-risk obligations — deferred 16 months by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) |
| Aug 2, 2028 | Annex I high-risk (AI inside regulated products) — also deferred by the Omnibus |
The Omnibus lesson generalises: dates move; substance doesn’t. The high-risk duties arriving in December 2027 are the same duties that were due in August 2026 — risk management (Art 9), data governance (Art 10), record-keeping (Art 12), human oversight (Art 14), post-market monitoring (Art 72). Organisations that read the deferral as a holiday will rebuild in a panic; organisations that read it as schedule relief will arrive with evidence that has already run in production. Note what did not move: Article 50 transparency is live now, and systems already on the market before August 2026 have only a short grace — to December 2026 — to bring content-marking into line.
The governance skeleton
Accountability. A cross-functional AI governance body (sustainability, AI engineering, security, legal) over a three-lines model: system owners in the first line log risk and lineage as they build; risk and compliance in the second line validate independently, set bias thresholds and own the model risk taxonomy; internal audit in the third line tests whether the controls work. A RACI per deployed model — production, fine-tuned and API-integrated alike — is the artefact that makes accountability inspectable rather than asserted.
Risk classification and impact assessment. Every system is tiered against the Act’s categories (prohibited / high-risk / transparency / minimal). Fundamental Rights Impact Assessments (Art 27) are mandatory for specified deployer classes — public bodies and deployers of certain Annex III systems such as credit scoring and insurance pricing — and are sound practice well beyond that set. Threat modelling for AI-specific attacks (prompt injection, data poisoning, membership inference) belongs in the same file.
Data governance. Lineage manifests that record origin, licence, consent attributes and transformations for training, fine-tuning and RAG corpora; automated scanning for personal data, copyrighted material and known bias patterns; and validation that synthetic data has not amplified the skew it was meant to dilute.
Transparency. Article 50 executed technically, not rhetorically: machine-readable marking of synthetic outputs (C2PA content credentials are the working standard), interaction disclosure at the point of use, and model cards that state architecture, intended use, boundaries and known limitations.
Human oversight. Human-in-the-loop approval for high-consequence decisions (credit, hiring screens, medical triage, tenancy decisions); human-on-the-loop monitoring with real override capability elsewhere; and — the part programmes skip — operator training and rotation designed against automation bias and fatigue, because an overseer who rubber-stamps is a control that exists only on paper.
Post-market monitoring and the incident clock. Runtime telemetry on output distributions, drift and guardrail triggers; re-validation on defined drift thresholds; and an incident pipeline wired to Article 73’s tiered deadlines: report immediately once a causal link is established, and in any event within 15 days — 10 days where a death may have been caused, 2 days for widespread infringements or serious disruption of critical infrastructure. Those clocks ride with the high-risk regime, and they are days, not the 72 hours GDPR trained everyone to expect.
Audit metrics: evidence, quantified
Fairness metrics — with their anchors stated honestly. The Adverse Impact Ratio (selection rate of a protected subgroup ÷ selection rate of the benchmark group) carries the one genuinely regulatory threshold in this field: below 0.80 breaches the four-fifths rule from US employment practice and should freeze the workflow pending investigation. The other common metrics — equalized odds difference (working target ≤ 0.05), demographic parity difference (≤ 0.10), toxicity classifiers (a < 1% flag rate as an internal clean baseline) — are practitioner thresholds: defensible, widely used, and chosen by the operator rather than imposed by a regulator. An audit file that distinguishes the two kinds reads as credible; one that dresses internal targets as law does not.
Logging — the substrate everything else stands on. For high-risk systems the Act’s record-keeping (Art 12, with deployer duties in Art 26) expects automatic event logs retained at least six months. A working log record carries: timestamp, model ID and exact version, prompt and response hashes, confidence scores, and guardrail flags. Retention on write-once storage is an implementation choice that earns its cost the first time a supervisor asks for an unaltered history.
Escalation circuits. Low-confidence or guardrail-tripped outputs route to a human reviewer, and the review itself is logged — reviewer ID, decision, rationale code, response time. An illustrative trigger bound is a confidence score under 0.85; the number matters less than the property that the circuit is automatic, recorded and tested.
The E pillar: compute accounting
AI’s environmental ledger has two entries — the carbon embodied in hardware, and the carbon emitted running it — and ESG reporting increasingly wants both, at workload granularity.
- Operational carbon = energy consumed (kWh) × grid emission factor (gCO₂e/kWh) × PUE. Location-based and market-based figures both belong in the file; they answer different questions.
- Embodied carbon = the hardware’s manufacturing footprint amortised over the share of its lifespan a workload consumes — (production emissions) × (allocated compute hours ÷ total hardware life). GPUs, HBM and accelerators make this entry material for training-heavy estates.
- Efficiency units make the numbers governable: energy per training run, and for inference, kWh per 1M tokens (or per 1,000 queries). Efficient frontier systems operate in the region of 0.15 kWh per 1M tokens and below; treat that as a frontier marker for procurement conversations, not an industry average.
- Facility multipliers: PUE at or below 1.2 is best-in-class hyperscale performance (industry averages sit nearer 1.5); WUE carries the water side — our data-center water guide sets out that method in full.
Under CSRD this lands in ESRS E1 (energy and emissions) with water in ESRS E3; under the ISSB baseline it enters through S1/S2 materiality. Either way, the telemetry pipeline is the same one the AI Act’s monitoring duties require — build it once, report it twice. And the emissions accounting discipline is the same one our Scope 3 guide applies to vendors: AI compute bought from cloud providers is a purchased service, and its data quality will be graded like everyone else’s.
One programme, three frameworks
| Dimension | EU AI Act | ISO/IEC 42001:2023 | NIST AI RMF | Evidence |
|---|---|---|---|---|
| Governance & policy | Arts 9, 50 | Clauses 5–6; Annex A.2–A.3 | Govern | Board minutes; AI policy; RACI |
| Risk & impact | Arts 9, 27 (FRIA) | Clause 6.1; Annex A.5 | Map, Measure | FRIAs; threat models; risk register |
| Data & bias | Art 10 | Annex A.7 | Map, Measure | Lineage manifests; AIR reports; consent logs |
| Transparency | Art 50 | Annex A.8 | Manage | C2PA marking logs; model cards; disclosure UX |
| Logging & monitoring | Arts 12, 72 | Clause 9; Annex A.9 | Measure, Manage | ≥6-month logs; drift telemetry; HITL records |
| Compute & ESG | ESRS E1/E3 alignment | Clause 8; Annex A.6 | Govern, Measure | Emissions logs; WUE/PUE reporting |
The roadmap to December 2027
Now — scope and classify. Inventory every model: in-house, fine-tuned, vendor API, embedded feature. Tier each against the Act; register the Article 50 population (already live); gap-analyse against ISO 42001 and the NIST framework. Through 2027 — build the evidence machinery. WORM-retained logging, continuous bias evaluation, HITL circuits, and the compute telemetry feed into sustainability reporting. Before December 2, 2027 — high-risk readiness. Technical documentation suites, FRIAs, quality management, and a mock conformity assessment with an external body while mistakes are still cheap. The Omnibus bought sixteen months; the programmes that use them as build time will experience the deadline as a filing exercise. The ones that don’t will experience it as an incident.
Frequently asked questions
Did the Digital Omnibus cancel the AI Act’s high-risk duties?
No — it moved them. Regulation (EU) 2026/1744 deferred Annex III standalone high-risk obligations to December 2, 2027 and Annex I embedded systems to August 2, 2028. The substantive obligations are unchanged, Article 50 transparency was not deferred, and GPAI duties have applied since August 2025.
How fast must a serious AI incident be reported?
Under Article 73: immediately once a causal link (or its reasonable likelihood) is established, and no later than 15 days after awareness — 10 days where a death may have been caused, and 2 days for widespread infringements or serious, irreversible disruption of critical infrastructure. An incomplete initial report is permitted, with supplements to follow.
Is a Fundamental Rights Impact Assessment required for every model?
No. Article 27 mandates FRIAs for specified deployers — public-law bodies and deployers of particular Annex III systems (notably creditworthiness evaluation and life/health insurance pricing). Running them more broadly is good practice; claiming the Act requires them universally is not accurate.
Do we have to disclose the energy our AI uses?
If you are in CSRD scope, energy and emissions data — including material compute — belongs in ESRS E1 reporting; ISSB reporters reach the same place through materiality. Even out of scope, the procurement direction is clear: enterprise customers increasingly demand per-workload energy and emissions figures from AI vendors, and the vendors who can produce them win the diligence round.
Sources: Regulation (EU) 2024/1689 (EU AI Act), Arts 9, 10, 12, 14, 26, 27, 50, 55, 72, 73; Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ July 24, 2026 — Annex III to Dec 2, 2027, Annex I to Aug 2, 2028; European Commission draft guidance on serious-incident reporting (Sep 2025) and law-firm analyses (Latham & Watkins; Paul Weiss); ISO/IEC 42001:2023; NIST AI RMF 1.0 and NIST AI 600-1 (GenAI Profile); EEOC Uniform Guidelines four-fifths rule; ESRS E1 and E3. Thresholds identified as practitioner targets are operator-chosen benchmarks, not regulatory requirements.