The AI Act Transparency Countdown: Why AI Disclosure Needs an Operating Record

The next phase of AI governance is not about whether the company has a policy. It is about whether the company can prove what AI is being used, who owns it, what data it touches, what rules apply, and what evidence supports the answer.

That is why the EU AI Act matters even for companies that do not think of themselves as AI vendors. Its obligations arrive in stages, and by the 2026 operating window many enterprises will need stronger transparency, classification, risk, and recordkeeping practices across the AI systems they deploy or depend on. The practical question is simple: when a regulator, customer, auditor, or board member asks about an AI system, can the company answer from an operating record instead of a spreadsheet hunt?

Disclosure breaks when the inventory is stale

AI systems are not static software assets. A sales team can adopt a new assistant in a week. A support group can connect a bot to a knowledge base in an afternoon. A product team can add an agentic workflow to a release process before procurement ever sees the vendor. The inventory changes faster than traditional governance rituals.

That is the failure mode Proxon is designed around. A company cannot create credible disclosure if it cannot first resolve the AI work record: the tool or agent, the workflow, the owner, the team, the data class, the policy state, the spend pattern, the approval history, and the evidence trail.

• System identity: tool, model, agent, workflow, integration, or MCP server.
• Business context: owner, department, use case, process, and decision impact.
• Data context: source systems, data classes, retention expectations, and exposure boundaries.
• Policy context: approved, restricted, pending, exception, or violation.
• Evidence context: approvals, review dates, incident history, and audit logs.

The operating record becomes the control

Most governance programs still separate policy from usage. Legal writes the rules. Security maintains a list of approved tools. Finance sees invoices. Business teams create the actual workflows. AI turns that separation into a visibility gap.

The better pattern is to make the operating record the center of governance. Every AI system has a current owner. Every workflow has a policy state. Every exception has a route. Every high-risk use case has review evidence. Every disclosure question can be answered by the same record the company uses to manage the work.

The companies that do this early will not treat the AI Act as a compliance fire drill. They will use it as a forcing function to build a durable AI operating model. Transparency will become a byproduct of management, not a document assembled after the fact.