EU AI Act Masterclass, Part Three

What GDPR taught us about who becomes indispensable

Ahmed starts with a pattern, because patterns repeat.

 Between 2016 and the May 2018 deadline, companies had two years to comply with GDPR. Most treated it as a compliance project to survive. A small group treated it as an opening, and that group became the data protection officers, the consultants and the trusted advisers who have owned the field ever since.

 His read on why is worth sitting with. They were not necessarily the smartest people in the room. They were the ones who prepared before everyone else realized they should.

 What is different this time is scope and speed. GDPR was about personal data, so it touched a few departments and the data governance function carried most of it. AI touches every function, not just data flows. The timeline is faster, the fines are larger, and, as he puts it, this time everybody can see the wave coming and is still not moving.

Why more information has not made anyone more confident

People read every article and sit through every webinar on AI compliance and still feel lost. Jeff asked why.

 Ahmed’s answer is that information stopped being scarce a long time ago. This is not the nineteen eighties, when knowledge sat behind money and access and people hoarded it. Everything is available. What is genuinely hard is finding good information, and what is harder still is doing anything with it.

 The people saving articles are collecting, not learning. Information without a framework is noise, and the regulation itself is organised for lawyers rather than for decisions. Reading it in article order tells you what the law says in the order the drafters wrote it, which is not the order in which anything gets decided.

 What people need instead is a sequence. Am I exposed? Can I prove it? What do I do first?

The three lies professionals tell themselves about the EU AI Act

Having trained more than seventy thousand people, Ahmed has seen enough of them to sort the patterns into three buckets. His more direct description is three lies people tell themselves.

That third one carries the sharpest edge, and it applies to consultants and internal hires alike. The value is in explaining the requirement so anyone in the business can understand it, then handing over something practical they can act on quickly without the whole operation seizing up. Unless it is a banned practice, in which case the pragmatic answer is that it stops.

Who should own AI governance inside a company

Jeff put the question directly. Legal, privacy, risk, or IT? And what happens if nobody takes it?

 Ahmed answers the first half with an admitted bias. He thinks privacy professionals are closest, because they already run the muscle this work requires: rights, risk, and accountability, exercised daily. They have spent years classifying risk, understanding what people are entitled to, and living with the idea that somebody has to answer for it.

 But he is clear that ownership beats department. Legal can own it. Risk can own it. Engineering can own it. What actually matters is that one named person does, and that the person knows they do.

The accidental provider problem is an ownership gap

When nobody owns AI governance, everybody assumes somebody else checked.

 Ahmed has watched this play out enough times to recite the internal monologue. We have got the tool. It is fine. Somebody must have looked at this, otherwise they would have come and asked us about it. It is safe. Let us carry on.

 Nobody was lying. Nobody was reckless. There was simply no name attached to the question, so the question never got asked, and a company that believed it was a user turned out to be a provider with a full set of obligations it had never read.

 The part that makes this unrecoverable is what happens afterwards. When something goes wrong, everyone looks at everybody else. The regulator does not care about that. The people who were harmed care about it even less.

How to become the go-to person on AI governance

Ahmed’s first instruction is not what most people expect. Understand AI before you touch the Act, and not in a technical way. What is artificial intelligence, what are the different types, what is machine learning, and the single distinction that unlocks the rest: AI either predicts things or generates things.

 Once that lands, the Act reads differently. And it needs to, because it was written for lawyers by lawyers and may not make much sense to anyone else.

 The profile he describes is someone who can understand the obligations, help a business classify its risks and the roles it is playing, and then help it mitigate and manage those risks in a way that is safe, ethical, compliant, and evidenced.

Why AI governance certification and credibility are not the same thing

The market for credentials here is wide open and very new. There is no standard benchmark yet. The IAPP offers certifications, ISACA offers certifications, PECB offers certifications, and effectively everybody is offering their own.

 Ahmed’s advice is to look at your background, decide which area of AI governance you actually want to work in, and then make an informed choice. What he would not do is rush.

 The reason is a pattern he sees constantly among smart professionals. They do not get the job, they conclude the problem is credibility, and they go and buy a certification to fix it. But getting certified makes you certified. It does not make you credible.

 Credibility comes from demonstrating to stakeholders that you understand the thing and can put it into practice. Talking the talk and walking the walk, as he puts it, which in this field means turning requirements into work streams somebody can actually run. Credibility comes from showing you can do the work.

The transferable skills you already have

This is the most useful thing in the conversation for anyone trying to move into the field, and it is the opposite of what most career advice says.

 Before you go and acquire anything new, look at what you have already done and find the shape of AI governance work inside it.

 Ever built an inventory of anything? That is evidence you can build an AI inventory. Done data mapping, or built a record of processing activities? That is evidence you can inventory and classify. Handled an incident response, a gap analysis, or any kind of structured assessment? That is evidence you can run a fundamental rights impact assessment.

 As Ahmed says, you bring more to the table than you realise. The work is not unfamiliar. What is unfamiliar is the vocabulary, and vocabulary is a much smaller gap to close than competence.

Why visibility is the currency

The second half of his advice is to build a personal brand, and his reasoning is mechanical rather than aspirational.

 Think about how hiring actually happens. Nobody wakes up and decides to hire ten people and post to a job board. A manager decides they need headcount, tells the team, and asks whether anyone knows good people, because good people know good people. Only when that network comes up empty does it reach HR. And HR is not the AI governance expert, so the job description that finally gets published may well have been drafted with a general-purpose AI tool and may sit a long way from what the hiring manager actually wanted. It then puts off qualified candidates who read the list and decide they do not tick every box.

 Which is why applying through the front door is harder than it needs to be. The better route is to be findable. Write posts and articles. Explain how you are handling things and what your take is. Find the problems people in the industry keep hitting and offer solutions to them.

 Ahmed’s own evidence is that he woke up recently to an inbound approach for a lead AI governance role he never applied for. And it is not only happening to him. Everybody on his book launch team who spent eight weeks posting, sharing takeaways, and talking through how to implement parts of the Act started getting recruiters on their profiles, podcast invitations, and product focus-group requests.

 Opportunities find people who are visible. As he put it, visibility is the currency in 2026 and beyond.

EU AI Act terms people constantly mix up

The conversation closed with a lightning round. Jeff named the pairs people confuse, Ahmed defined the difference in a sentence. This is the cleanest set of plain-language definitions of the Act’s core distinctions that we have on tape.

Why any of this exists

Ahmed closed on the question of why the obligations are there at all, and he answered it with a case rather than a principle.

 A Finnish psychotherapy provider, Vastaamo, failed to protect its patient records. Attackers took them, demanded payment, and when the company would not pay, went to the patients directly and threatened to publish their therapy notes unless they paid individually. The records contained the things people tell a therapist and nobody else. The harm to those patients has been severe and lasting.

 His point in raising it is that people say Europe has too much red tape, too many regulations, too many rules. And then something like Vastaamo happens, and Europe is the place you would rather be, because the framework was built to put people first. As he frames it, the obligations trace back to protecting fundamental rights. They are not there to generate fines.

 He extended it to what technology should be doing in the first place. It should be giving us more freedom, not less. If it is being used to surveil, restrict, or manipulate people, the question is not just what world we are living in but what world we are leaving behind. His own version of that is personal. He would rather be on the side that did everything it could for his daughter and the people who come after her.

Risk avoided is not value created

Jeff’s close is the line the whole series has been building toward.

 The EU did not just write a rule book. It took one of the first serious swings at defining what AI risk even is. And the companies that learn to measure it do more than protect themselves, because measurement is what turns you into the organisation people call.

 Risk avoided is not value created. The goal was never just to be safe. It is to capture the upside and do it safely.

 Which is the same three questions a board is going to ask, in whatever order they arrive. Is it paying off. Is it under control. And what could it cost us.

Is your AI investment making money or losing money?

TheAIAudit measures your organization’s collective AI investment and returns a single AI Health Score from 0 to 100, with three statements behind it that say what to fix: Governance, Impact, and Risk Flow.

Apply for the founding cohort