This is exactly the piece GRC teams need before their next AI Act gap assessment. The register point is what will actually bite: you cannot classify or disclose agents you don't know exist, and that gap is the same shadow IT problem I chased for years before it had an AI Act price tag. Article 25 turning a deployer into a provider without anyone approving anything is the sharpest trap in the piece.
"Before it had an AI Act price tag" is great. I might steal that. It really is the same problem, someone just attached fines to it. One thing to check before the next gap assessment: when Article 25 flips the role, don't count on Microsoft handing over documentation. Their terms may say Copilot was never meant to go high-risk, and then you're on your own.
This is exactly the piece GRC teams need before their next AI Act gap assessment. The register point is what will actually bite: you cannot classify or disclose agents you don't know exist, and that gap is the same shadow IT problem I chased for years before it had an AI Act price tag. Article 25 turning a deployer into a provider without anyone approving anything is the sharpest trap in the piece.
"Before it had an AI Act price tag" is great. I might steal that. It really is the same problem, someone just attached fines to it. One thing to check before the next gap assessment: when Article 25 flips the role, don't count on Microsoft handing over documentation. Their terms may say Copilot was never meant to go high-risk, and then you're on your own.