Europe’s AI governance challenge shifts from compliance to control

AI adoption is accelerating across Europe just as new rules begin to take effect. In 2025, one in five EU enterprises was already using AI, rising to 55% among large businesses, pushing companies to decide how systems should operate once they move beyond pilots and into production.

The governance challenge is increasingly about authority rather than simple restriction. Businesses need to define what data and systems AI can access, what actions it can take without approval, when human judgement is required and how decisions can be traced if something goes wrong. Human oversight must be tied to moments where people are genuinely accountable, rather than reduced to routine approval of system recommendations.

Insurance shows how difficult that shift can be in regulated industries. EIOPA’s 2026 survey, covering 347 insurers across 25 countries, found that 65% were already using generative AI and another 23% planned to, though most current use remained at proof-of-concept stage. Moving AI into live environments requires controls, monitoring, permissions and intervention mechanisms built into operations from the start.

The EU AI Act will make these requirements more urgent. From 2 December 2027, high-risk systems covered by Annex III will face obligations around risk management, traceability, documentation and human oversight. Strong governance could allow companies to deploy AI more confidently, turning control into a foundation for broader adoption rather than a brake on growth.