Miquido's new report: The €35M Blind Spot: Rethinking AI in the AI Act

In this article:

Don’t let your AI estate become a blind spot

Every quarter, organizations proudly announce new AI-powered features, including copilots, recommendation engines, and automated workflows. These additions are meant to position companies at the forefront of innovation. On paper, adoption looks like success, but in reality, it often hides a growing and largely invisible liability.

With the EU AI Act fully enforceable from August 2, 2026, that liability becomes measurable, reaching up to €35 million or 7% of global annual turnover per violation. For many companies, the risk is not tied to bold, experimental AI programs. Instead, it stems from small, “temporary” pilots that quietly evolved into business-critical systems without governance, ownership, or oversight.

The core problem is the absence of visibility, rather than AI adoption itself.

AI tools frequently enter organizations through side doors, such as team-level experiments, SaaS features, or quick productivity hacks. Over time, they gain access to sensitive data, influence decisions, and integrate into core workflows. Yet internally, they remain mislabeled as “pilots.” From a regulatory perspective, many have already crossed into high-risk territory.

When regulators ask fundamental questions regarding model ownership, data usage, or decision explanations, most organizations cannot answer with confidence.

Miquido and Scaleway’s latest report, The €35M Blind Spot: Rethinking AI in the AI Act Era, reveals that governing AI is a far greater challenge than building it. It provides a practical framework for identifying hidden exposure and turning fragmented AI adoption into a controlled, compliant system.

Key findings from the report

Inventory gaps: While 88% of organizations already use AI in at least one business function, adoption metrics obscure a critical issue. Most leadership teams lack a complete inventory of AI systems running in production.
Model layer exposure: Only 22% of companies govern the AI model layer itself. This gap remains despite the fact that the highest regulatory and strategic risks originate at this layer.
Unmonitored production: 31% of enterprise AI use cases are already in production, which is double the share from 2024. This transition frequently occurs without formal risk classification or accountability structures.
Sovereignty shift: 75% of firms in Europe and the Middle East plan to move AI workloads to sovereign or regional infrastructure by 2030. This data points to a rapid shift toward jurisdiction-aware AI deployment.
Silent exposure: Most organizations unknowingly operate multiple high-risk (Tier 3 or Tier 4) AI systems. Because teams still treat them as low-risk tools, they create silent regulatory exposure.

Build on governance, not just models

The report demonstrates that successful AI strategies in regulated environments require firm governance foundations instead of a sole focus on model performance. This strategy includes:

Full AI estate inventory across tools, vendors, and internal systems.
Honest risk classification aligned with EU AI Act categories, including Annex III.
Named ownership for every high-risk workload.
Infrastructure mapping with clear jurisdiction and data residency.
Auditability of every AI-driven decision.
The operational capability to stop any system within 24 hours.

Rather than slowing innovation, these measures enable it. They make AI systems defensible, scalable, and regulator-ready.

The role of sovereign AI infrastructure

A key architectural shift is the move toward sovereign AI. This approach keeps high-risk workloads operating within EU jurisdiction, maintaining full control over data, inference, and compliance.

The recommended setup relies on a hybrid model. Companies can deploy global cloud providers for low-risk workloads, and combine them with European sovereign infrastructure, such as Scaleway, for high-risk systems that demand strict governance and regulatory alignment.

This distinction is becoming critical as organizations prepare for enforcement. It is especially vital in heavily regulated sectors where AI systems directly impact human outcomes and fall under high-risk classifications.

Don’t let your AI estate become a blind spot

The report makes one point clear: the biggest regulatory risk stems from AI that quietly became high-risk without oversight, rather than the systems intentionally built for high-risk use cases.

Organizations that act now by mapping their AI estate, classifying risk, and implementing governance will reduce compliance exposure. They will also gain a structural advantage in scaling AI safely.

Download The €35M Blind Spot: Rethinking AI in the AI Act era report to audit your current AI landscape, identify hidden liabilities, and build a governance-first strategy aligned with the EU AI Act before enforcement begins.