Thanks for this. The detail that turns the week-one attachment argument from a compliance nicety into a continuous operational problem is the rate: KPMG's Q2 2026 AI Pulse survey (2,145 C-suite respondents, 20 countries) found employee AI-agent adoption jumped from 23% to 56% in a single quarter. A register is a stock control being asked to track a flow that just doubled in three months, so Art 25(1)(c) provider-conversion is happening continuously across the org, not as the rare edge case the register format assumes. The leaver-checklist gap you flag is the same problem on the exit side: the population needing offboarding is growing exactly as fast as the population needing onboarding.
Stock control against a flow is a good way to put it. Do you have a link for the 23 to 56 figure though? I went looking in KPMG's Q2 2026 AI Pulse (https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2026/06/global-ai-pulse-q2.pdf) and couldn't place it. Page 12 has employee adoption of AI agents going from 25% to 28%, up 3 points. If there's a cut showing 56% I'd genuinely want it, that changes the picture quite a bit.
Sorry about that, I'd conflated two different KPMG reports in my notes— the 23%→56% figure is from the banking industry spotlight of KPMG's Q2 2026 AI Quarterly Pulse Survey (https://kpmg.com/kpmg-us/content/dam/kpmg/corporate-communications/pdf/2026/BANKING_2026_AIPulseSurvey_Q2.pdf): that's 100 US-based C-suite banking leaders, not the 2,145-respondent global sample I attributed it to. Your 25%→28% is the correct number for the broader population.
That changes what the evidence can carry. A single-sector, 100-respondent US spotlight isn't a strong enough anchor for "continuous operational problem" at the scale I framed it — it shows one high-adoption sector moving fast in one quarter, not a global doubling. The stock-vs-flow structure of the argument still holds, it's just a slower flow than I made it sound.
Appreciate you going back and checking. A US banking sample moving that fast is interesting on its own, just a different claim. The stock-versus-flow point stands either way.
This is exactly the piece GRC teams need before their next AI Act gap assessment. The register point is what will actually bite: you cannot classify or disclose agents you don't know exist, and that gap is the same shadow IT problem I chased for years before it had an AI Act price tag. Article 25 turning a deployer into a provider without anyone approving anything is the sharpest trap in the piece.
"Before it had an AI Act price tag" is great. I might steal that. It really is the same problem, someone just attached fines to it. One thing to check before the next gap assessment: when Article 25 flips the role, don't count on Microsoft handing over documentation. Their terms may say Copilot was never meant to go high-risk, and then you're on your own.
Thanks for this. The detail that turns the week-one attachment argument from a compliance nicety into a continuous operational problem is the rate: KPMG's Q2 2026 AI Pulse survey (2,145 C-suite respondents, 20 countries) found employee AI-agent adoption jumped from 23% to 56% in a single quarter. A register is a stock control being asked to track a flow that just doubled in three months, so Art 25(1)(c) provider-conversion is happening continuously across the org, not as the rare edge case the register format assumes. The leaver-checklist gap you flag is the same problem on the exit side: the population needing offboarding is growing exactly as fast as the population needing onboarding.
Stock control against a flow is a good way to put it. Do you have a link for the 23 to 56 figure though? I went looking in KPMG's Q2 2026 AI Pulse (https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2026/06/global-ai-pulse-q2.pdf) and couldn't place it. Page 12 has employee adoption of AI agents going from 25% to 28%, up 3 points. If there's a cut showing 56% I'd genuinely want it, that changes the picture quite a bit.
Sorry about that, I'd conflated two different KPMG reports in my notes— the 23%→56% figure is from the banking industry spotlight of KPMG's Q2 2026 AI Quarterly Pulse Survey (https://kpmg.com/kpmg-us/content/dam/kpmg/corporate-communications/pdf/2026/BANKING_2026_AIPulseSurvey_Q2.pdf): that's 100 US-based C-suite banking leaders, not the 2,145-respondent global sample I attributed it to. Your 25%→28% is the correct number for the broader population.
That changes what the evidence can carry. A single-sector, 100-respondent US spotlight isn't a strong enough anchor for "continuous operational problem" at the scale I framed it — it shows one high-adoption sector moving fast in one quarter, not a global doubling. The stock-vs-flow structure of the argument still holds, it's just a slower flow than I made it sound.
Appreciate you going back and checking. A US banking sample moving that fast is interesting on its own, just a different claim. The stock-versus-flow point stands either way.
This is exactly the piece GRC teams need before their next AI Act gap assessment. The register point is what will actually bite: you cannot classify or disclose agents you don't know exist, and that gap is the same shadow IT problem I chased for years before it had an AI Act price tag. Article 25 turning a deployer into a provider without anyone approving anything is the sharpest trap in the piece.
"Before it had an AI Act price tag" is great. I might steal that. It really is the same problem, someone just attached fines to it. One thing to check before the next gap assessment: when Article 25 flips the role, don't count on Microsoft handing over documentation. Their terms may say Copilot was never meant to go high-risk, and then you're on your own.