The AI Act is not a universal data-governance checklist—classify the agent first

Alation’s September 2 argument is appealing: stop treating regulatory data governance and production AI as separate programmes. The company says cataloguing critical data, assigning ownership, documenting lineage and maintaining audit trails are also the foundations an organisation needs to operate reliable AI. It frames that overlap as a chance to build once for compliance and deployment rather than fund two parallel workstreams. Source: Alation

That is a useful operating principle for teams deploying text-to-SQL and analytics agents. But it is not yet a compliance plan. The EU AI Act is explicitly risk-based, and the European Commission says the “vast majority” of AI systems in use fall into the minimal-or-no-risk category, for which the Act adds no rules. Before converting a governance backlog into an AI Act checklist, a team must classify the system, its use case and its role in the supply chain. Source: European Commission

The workflow matters more than the chat box

An analytics assistant does not become high-risk merely because it generates SQL. The Commission’s examples focus on uses such as employment decisions, access to essential services including credit, education, critical infrastructure, law enforcement and migration. A natural-language query tool used for ordinary internal reporting may sit in a different category from the same interface used to produce evidence for credit denial or worker management. Source: European Commission

That distinction should change the design review. Teams should map each agent workflow to the decision it informs, the data it can reach and whether a human can challenge the output. Alation’s proposed assets—ownership, lineage, critical-data inventories and audit trails—remain useful across those categories, but the legal obligation cannot be inferred from the presence of an LLM alone. Sources: Alation; European Commission

The dates are already staggered

Alation says substantive requirements take effect from 2027. The Commission’s current timeline is more granular: the Act entered into force on August 1, 2024; prohibited-practice and AI-literacy provisions began applying in February 2025; governance and general-purpose-model duties followed in August 2025; and the Act became generally applicable on August 2, 2026. Transparency rules for systems such as chatbots also took effect in August 2026. Certain high-risk use cases move to December 2, 2027, while high-risk systems embedded in regulated products have until August 2, 2028. Source: European Commission

For data-agent teams, the practical sequence is therefore: classify the workflow, identify the provider/deployer role, map the applicable date, then reuse existing lineage, ownership and logging controls wherever they satisfy the requirement. Alation is persuasive that governance infrastructure can do double duty. The missing step is risk classification; without it, “build once” can still mean building the wrong controls first. Sources: Alation; European Commission