AI adoption is accelerating, so are the demands of regulators

For SMEs to thrive in the AI space governance frameworks can be a valuable tool

Voices

Colm Lucey, Sevtech

In association with Sevtech

Artificial Intelligence (AI) is on a steep growth trajectory, with advances happening at lightning pace. Colm Lucey, technical consultant with SevTech, says its rapid growth is making it difficult to regulate, but there is an effective way businesses can approach AI governance. 

“We’re nowhere near the pace of AI acceleration and evolution slowing down. Over the coming years it will continue to move at a breakneck speed. I saw a report recently that indicated there’s at least another five years of the hockey stick growth to come,” says Lucey (pictured).

With advances now happening every week, regulating the AI environment is proving challenging, particularly in what’s turning out to be a fragmented global landscape. “If you look at the big global territories – the EU, US and China. The US is prioritising AI dominance, so their focus is speed over regulation. The focus for China is more about content security, rather than citizen rights, whereas the EU is leaning more towards citizen rights which may lead to a competitive disadvantage in the short term, albeit for what could be argued as the right reasons.”

Within the EU, the main piece of AI legislation is the EU AI Act, which Lucey says is “very much a risk-based approach”. Within the high-risk category are highly regulated industries including medical devices, aviation systems, and anything in EU safety law. “For these types of systems you would have to register what you’re doing in the EU database that tracks high‑risk AI.” 

“At the other end you have the unacceptable risk – manipulation, social scoring, or certain biometric uses like video surveillance to track people’s biometric or emotional state. These things are prohibited under the EU AI Act.”

It’s a complex setting, made all the more intricate by a distinct skills gap and continuing AI advances. All this means that although the EU AI Act’s core obligations phase-in through 2026 and 2027 remains as planned, implementation is proving challenging due to underestimated capacity gaps across authorities and companies. “We can see this evidenced by missed deadlines for national regulators, delayed Codes of Practice, and ongoing calls for timeline changes.”

In this minefield, implementing AI effectively, safely and according to legislation requires a step-by-step strategy. “Make sure you’re not trying to go from zero to 100 in one step. Take a structured approach,” Lucey advises.

What does that look like? 

“Define clear business value for each use case, and take small steps through lower-risk internal tools like Copilot and ChatGPT. Only then should you move into customer-facing or higher risk domains. It’s critical that businesses align ambition with governance capacity and skills. If your business is operating in the high-risk tiers as defined by the EU AI Act, ensure you have robust governance frameworks, comprehensive documentation, and ongoing monitoring for bias and human-in-the-loop controls.” 

This level of management and oversight will no doubt be burdensome for SMEs, which is why Lucey advises them to only pursue high-risk implementations if “the business case justifies the investment, and you can realistically staff and govern them”.  

And as businesses scale their AI systems, Lucey says they will need to develop cross-functional oversight. “Legal, compliance, CIOs, CTOs, data science/AI teams, HR, ethics, risk, all working together to manage and govern the whole life cycle of AI. That’s your model of good practice for more mature implementations.”

For SMEs to truly thrive in the AI space, Lucey says governance frameworks could help. “If the complexities are to be overcome, there will need to be frameworks and toolsets that companies can use to audit and manage their AI implementations. That’s a space we should see emerging in 2026 onwards.”

“At SevTech, we are working on incorporating frameworks into some of the product suites we’re building. Right now it’s an uneven playing field for a lot of companies, and I think, given the regulatory backdrop, frameworks will be needed, certainly for SMEs and mid-sized companies, to allow for democratising the use of AI.”