EU AI Act: What Architecture Needs Now

Three News Items, One Message

This week I had three AI regulation stories on my desk. They looked unrelated at first. A harmonized standard. A new prohibition. An overturned fine. Together they tell a clear story about where the EU AI Act stands — and what that means for organizations in the DACH region.

A quick framing before the details.

The First Harmonized Standard Is Published

Pearl Cohen reports that the first harmonized standard under the EU AI Act is out. It is based on ISO/IEC and focuses on an AI-specific quality management system. That matters. In European law, harmonized standards are how organizations earn a presumption of conformity. Meet the standard, and you are presumed compliant — until proven otherwise.

For architects and IT leads, the practical question shifts. It is no longer just whether an AI system meets functional requirements. It is whether the quality management system around it is documented, auditable, and aligned to the system's full lifecycle. Anyone planning or operating a high-risk system today should check whether their QMS structure can be mapped to this standard. That is not a task for compliance alone. It is an architecture decision.

• •

  Harmonized standards create a presumption of conformity — that matters in a dispute

• •

  QMS requirements cover the full lifecycle, not just deployment

• •

  High-risk systems need documented governance before they go into production

December 2026: New Prohibitions, Some Relief

Lumenova AI flags two changes taking effect on 2 December 2026. First: AI-generated non-consensual intimate content is explicitly prohibited. That sounds like a fringe topic for enterprise architects. It is not, once an organization uses generative AI for image or video production — or integrates services that could produce such outputs. What a model can generate in principle becomes a compliance question.

Second — and this is the less expected part — compliance requirements for standard software in certain industrial use cases will be reduced. The EU is differentiating. Not every AI integration into a business process carries the same burden. Organizations that have sorted their use cases by risk class will benefit. Those that have not will keep paying the flat rate: uncertainty and oversized effort.

The Rome Ruling and What It Reveals About Enforcement

The Rome ruling looks like a win for OpenAI. It is more instructive than that. A court overturned the Italian data protection authority's €15 million fine — not because OpenAI was right, but because the Irish Data Protection Commission holds jurisdiction, as Blocksize HR reports. The Irish DPC is now the primary regulatory authority for OpenAI in the EU.

Two things follow for DACH organizations. First: jurisdiction over cross-border AI services is a real and unresolved issue. Using a US provider with an EU subsidiary in Ireland means a different regulatory structure than using a German provider. That is not an academic point. It affects which authority is competent in a dispute and how fast decisions come. Second: EU AI Act enforcement will fragment the same way GDPR enforcement did. Waiting for a national authority to impose order may mean waiting a long time.

What This Means for Architecture and Governance Decisions

The three items together form a picture I would describe this way: the regulatory framework is getting more concrete, enforcement remains uneven, and organizations that act now with structure gain a real advantage. Not because they avoid fines — that is the minimum ambition. Because they can decide faster which AI projects to pursue and at what cost.

Three steps I recommend. First: sort use cases by risk class — the EU AI Act risk classification guide provides a structured basis for that. Second: check whether your governance structure can be aligned to the new harmonized standard. That is a question IT leads and compliance officers need to answer together, not separately. Third: reassess your vendor landscape through the lens of regulatory jurisdiction — especially where generative AI services from US providers are in use. The guide on building AI governance offers a framework that goes beyond documentation requirements.

The Compliance Center in AI Navigator helps organizations check their current status against the latest requirements — without working through every primary source.

• •

  Risk-classify all active AI use cases — before December 2026

• •

  Check QMS structure against the new harmonized standard

• •

  Document regulatory jurisdiction for third-party providers

• •

  Assign governance responsibility clearly — do not let it dissolve in the org chart

What I Take Away

What stays with me is the timing. The harmonized standard is here. The new prohibitions arrive in December. Enforcement is still fragmented. That is not a contradiction — it is the normal state of an early regulatory phase. Organizations that act with structure now will have less to explain in two years.

What remains open: how fast the Irish DPC actually moves, and whether national authorities in the DACH region will set their own enforcement priorities. I will be watching. My desk will too.

Sources

This draft was written with AI assistance from the reports below and requires editorial review before publication.

• •

  Erster harmonisierter Standard zum EU AI Act veröffentlicht (ISO/IEC-basiertes QMS) – Pearl Cohen: pearlcohen.com/eu-ai-acts-first-harmonized-standard-publis… (opens in a new tab)

• •

  EU AI Act: Zwei neue Verbote ab 2. Dezember 2026 – KI-generierte intime Inhalte und weiteres – Lumenova AI: lumenova.ai/blog/eu-ai-act-delays-july-2026 (opens in a new tab)

• •

  Gericht Rom hebt 15-Mio.-€-DSGVO-Bußgeld gegen OpenAI auf – Irische DPC übernimmt Zuständigkeit – Blocksize HR / AI Blog: ai.blocksize.hr/blog/de/… (opens in a new tab)