“Our diagnostic AI tool sits between MDR and the EU AI Act. Which framework governs — and what if the requirements conflict?”

Medical device regulation and the AI Act overlap for clinical AI tools. The interplay between CE marking and AI Act Article 6 obligations remains genuinely unresolved for many organisations.

“Who holds clinical accountability when an AI recommendation contributes to a wrong treatment decision?”

Human oversight requirements under the AI Act meet medical liability law. The accountability gap between clinician, developer and deployer is widening as AI moves deeper into clinical workflows.

“How do we govern AI in clinical trials without slowing down timelines that cost months and millions?”

AI in drug development is under increasing regulatory scrutiny. EMA guidance is evolving and most governance frameworks have not yet caught up with the pace of adoption in research environments.

“We use AI in benefit eligibility decisions. The AI Act classifies this as high-risk. How do we govern something this politically sensitive?”

Annex III of the AI Act explicitly covers AI in public services affecting citizens. Democratic accountability requirements go significantly beyond technical compliance.

“We procured an AI system from a vendor who claims compliance. How do we verify it — without internal technical capacity?”

Most public sector bodies currently rely on vendor self-declarations. Third-party audit requirements under the AI Act are still being operationalised across member states.

“A journalist asks us to explain an AI decision that affected thousands of citizens. What does meaningful transparency look like in practice?”

Transparency obligations in government AI are both a legal and democratic challenge. The explainability tools available rarely match the political and public accountability reality.

“We build on top of a foundation model. Does that make us a provider, a deployer — or both? Getting the role allocation wrong creates serious compliance and liability exposure.”

The provider/deployer distinction in the AI Act is one of the most contested interpretations currently. For the most serious infringements, penalties can reach up to €35m or 7% of worldwide annual turnover.

“Our agentic AI system takes actions autonomously across multiple tools and systems. What does governance look like for something not designed with a human in the loop?”

Agentic AI sits in a regulatory grey zone. Cascade failures and emergent misalignment require governance approaches that most frameworks have not yet structurally addressed.

“We ship AI features continuously across multiple EU countries. How do we build governance that keeps pace without becoming a release bottleneck?”

Product-embedded AI governance is architecturally different from traditional compliance. Most frameworks were not designed for continuous deployment cycles at commercial speed.

“Our actuarial models are now AI-driven. How do we govern them under the AI Act without undermining the business logic they were built on?”

Actuarial AI used in pricing and risk selection likely qualifies as high-risk. The tension between model confidentiality and explainability requirements is structurally acute.

“A customer was denied coverage by an AI underwriting system. How do we explain that decision in a way that is both compliant and genuinely understandable?”

Explainability in insurance AI is both a regulatory and reputational obligation. Most available tools produce outputs that regulators and customers cannot practically use.

“DORA applies and our AI systems touch ICT resilience. Are we managing both frameworks together — or creating gaps by treating them separately?”

Insurance sits at the intersection of DORA and the AI Act in ways the regulation did not fully anticipate. The compliance burden is compounding with no proportional increase in team capacity.

“Our predictive maintenance AI contributed to a production failure. Who is liable — and what does that mean for how we document AI decisions going forward?”

EU product liability reform now extends to AI-caused harm. The allocation of responsibility across the AI supply chain remains legally unsettled in many cross-border manufacturing contexts.

“We embed AI into machinery that directly affects worker safety. The AI Act classifies this as high-risk. What does a credible implementation actually require?”

Safety-critical AI in manufacturing triggers the most demanding AI Act requirements — including risk management, technical documentation, human oversight and incident reporting obligations.

“Our OT and IT environments do not share a governance language. How do we build AI oversight that functions coherently across both?”

Operational technology AI governance is a structural blind spot in most frameworks. The cultural and technical gap between OT and IT environments creates genuine and often overlooked compliance exposure.

“AI manages our grid load balancing. A failure would affect hundreds of thousands of people. What does credible governance look like for a system with this level of consequence?”

Critical infrastructure AI sits under both the AI Act and CER/NIS2 directives simultaneously. The governance requirements are the most demanding across any sector and are still being operationalised.

“NIS2 is now law. Our AI systems touch cybersecurity. Are we managing NIS2 and AI Act obligations coherently — or creating compliance gaps at their intersection?”

The intersection of NIS2 and the AI Act in energy creates compounding obligations. Most legal and governance teams are still handling them as separate workstreams — which creates structural risk.

“We use AI for emissions optimisation. Regulators are beginning to ask for audit trails. What does evidence-based governance for algorithmic environmental decisions look like?”

Environmental AI governance is emerging as a distinct regulatory requirement. Documentation standards and audit frameworks for this area are still being developed in real time.

“I advise clients on AI Act compliance. But my own firm uses AI tools whose governance status is unclear. What is the professional exposure?”

Legal professionals advising on AI governance face a credibility and liability question about their own AI tool usage — a challenge that bar associations are only beginning to address.

“A client wants me to validate their AI governance framework. I am not a technical expert. What does professional liability look like in this context?”

The market for AI governance advisory is growing faster than the professional standards that govern it. Advisors are increasingly being asked to vouch for technical realities they cannot independently verify.

“We use LLMs for legal research and drafting. How do we govern hallucination risk in a professional context where accuracy is a direct liability question?”

LLM use in legal work creates professional responsibility challenges that existing frameworks did not anticipate. Oversight, verification and documentation requirements remain structurally unresolved.