From rules to reality: three AI questions leaders should be asking

Do you know where AI is being used across your organisation, and could you explain a decision it influenced if challenged?

At TECH: Ignite UK, our industry experts explored three key areas for businesses navigating AI. We’ve distilled their insights into three questions leaders should be asking now.

1. Have you kept up with changes to the cross-jurisdictional regulatory landscape?

Changes to the EU AI Act have pushed back the application of its high-risk requirements. But the message from Jaap Tempelman is clear: delay should not be confused with relaxation. The additional time reflects the need for standards, guidance and enforcement infrastructure to catch up. For businesses, it creates a preparation window rather than opportunity to pause.

They still need to understand what systems they use, which role they occupy in the AI value chain and what evidence will be needed to demonstrate responsible deployment. Even the softened AI literacy requirement retains an expectation that providers and deployers take measures to support staff who operate or use AI systems.

Christopher Götz highlights that one of the most consequential issues is how an AI system’s “intended purpose” is assessed. A disclaimer saying that a product should not be used in a high-risk context may carry little weight if the product’s marketing, functionality and overall positioning point in the opposite direction. The assessment is holistic. What a product is presented as doing may matter more than what its terms seek to exclude.

The UK presents a different challenge. Sophie Sheldon explains that organisations must navigate overlapping sectoral regimes rather than a single cross-sector AI act. That can be more complicated than it first appears: the relevant question is not simply “What is the UK’s AI rule?” but “Which regulators and existing legal regimes touch this particular use?” Safeguards around regulatory accountability, automated decisions, use of data, human intervention and routes to challenge, will therefore be central to responsible deployment.

And this matters beyond day-to-day compliance. In an acquisition, for example, Edoardo Tedeschi urges that buyers need to understand the AI systems they are acquiring, their risk classification and potential exposure so that risks can be remediated, priced or allocated appropriately. This could be achieved via a multi factor approach split between (i) red flag reporting with AI assisted triage (ii) strong valuation and synergy modelling on AI outputs (iii) document automation and negotiation playbook for any AI approach and (iv) monitor condition precedent and post closing results via AI stress testing on contractual R&W.

What to do now:

Build or update an inventory of your AI systems and uses. For each, establish who owns it, its intended purpose, where it sits in the regulatory landscape and what evidence supports that assessment.

2. Is your governance keeping pace with how people actually use AI?

AI in the workplace is no longer limited to specialist products. Lauren Dickinson highlights recruitment and HR as a key area where AI often now plays a substantial role, including in CV screening, interviews, performance reviews, employee monitoring and the drafting or summarising of feedback. Increasingly, these capabilities may also be developed informally by HR teams using widely available enterprise tools. Knowing which AI products your organisation has bought is no longer enough. Do you also know how people are actually using them?

That matters particularly when AI influences decisions about people. The employment risk is not limited to whether an AI system produces a discriminatory outcome. An equally challenging problem may be explaining how a decision was reached. If an AI system materially influenced recruitment, performance or compensation, an employer may struggle to defend a claim if nobody can reconstruct the reasoning or demonstrate meaningful human oversight.

The evidence trail can itself create risk. Prompts, generated drafts and AI-assisted conversations may become relevant to data subject access requests or litigation. A polished final email will not necessarily neutralise an inappropriate instruction used to generate it. Similarly, AI note-taking can preserve informal discussion after a sensitive meeting if participants forget that recording or transcription remains active. Lauren’s practical warning was simple: treat interactions with AI as business communications, not as a private space for unfiltered thinking.

Approaching the issue from the employee side, Mandy Perry highlights how AI is making it easier for individuals to formulate grievances and claims, sometimes producing lengthy and apparently authoritative documents in which the underlying issue is difficult to identify. The answer is not necessarily more automation. Often, the better response is to narrow the complaint to its substance and speak directly to the person involved.

That human intervention matters on both sides. Managers can also over-rely on AI-generated grievance outcomes or workplace communications without testing them against the evidence. The opportunity is to use AI to reduce administrative burden while preserving human judgement where decisions affect livelihoods, rights and workplace relationships. Clear policies, training and multidisciplinary risk assessments involving HR, employment, privacy, commercial and technology teams are therefore becoming operational necessities.

What to do now:

Look beyond your approved tools list. Identify where employees are using AI in important processes, set clear boundaries, train people on the evidence they may be creating and make explicit where human review is required.

3. How prepared are you to navigate a fragmented enforcement landscape?

The EU AI Act’s enforcement landscape is more fragmented than many organisations may expect. Minesh Tanna distinguishes between centralised oversight of general-purpose AI models by the EU AI Office and enforcement of AI systems through national market-surveillance authorities. The risk is not limited to fines. Authorities may request information or system access, conduct inspections, restrict use, or order a product’s withdrawal or recall. Operational disruption and reputational damage may ultimately outweigh the financial penalty.

Alejandro Guerrero adds another layer: an AI issue may engage the AI Act, GDPR and Digital Services Act simultaneously. The same conduct could attract questions from multiple regulators, potentially approaching it from different legal perspectives. Organisations therefore need a joined-up investigation strategy and documentation that works across regimes, rather than separate compliance exercises that produce inconsistent answers. Existing GDPR work, including data protection impact assessments, may offer a useful foundation, but it should be tested against the AI Act’s distinct requirements.

Laura Cortés López demonstrates how enforcement may begin with seemingly straightforward transparency questions. Was a customer told they were interacting with AI? Was synthetic content technically marked? Was a user-facing disclosure actually presented at the right point? These obligations are split between providers, who must design appropriate capabilities, and deployers, who must ensure they operate in practice.

What to do now:

Stress-test your response to an AI incident. Who would lead it? Which regulators or legal regimes might be involved? And could your teams produce a consistent explanation of what happened and the safeguards that were in place?

From compliance to confidence

The common thread across all three sessions? Evidence.

Organisations need to know where AI is used, why it was classified in a particular way, who reviewed its outputs and what safeguards were applied.

Good AI governance is not about slowing adoption. Done well, it gives businesses the confidence to use AI while remaining able to explain and defend the decisions they make.

TECH: ignite – Asia returns on 27 October 2026. Find out more.