Application dates move, requirements arrive, accountability shifts. Five principles, the division between company and owners, six measures, and where AI belongs on both sides of the model.
English · Read this paper in Svenska
Governance that holds when the rules move
Traditional IT governance assumes the requirements stand still between audits. They no longer do. Over the past two years application dates have moved, new requirements have arrived, and accountability has shifted towards management and the board. The governance model that copes is the one that notices a change and can show where it lands.
Compliance works as a protective shell that changes when the requirements change.
Static governance
Documents, an annual cycle, an audit. Gives a position once a year and requires someone to re-read everything when something changes.
Dynamic governance
Requirements attached to nodes with owners and status. When a requirement changes it shows on the node, and the backlog updates itself.
The difference in practice
The time from a published change to an identified impact. A year in the first model, days in the second.
Why the static model gives way
A current example shows the problem more clearly than any argument. Application dates in the AI Act changed during the summer of 2026, less than two weeks before the date many organisations had planned against.
What matters is what the example says about the governance model. An organisation that had planned against a date, built a plan around it and reported that plan to its board had the ground shift late. The organisation that had attached requirements to nodes could see what was actually affected. The organisation with a project plan started again on interpretation.
Read all of Governance that holds when the rules move
The rest of the paper is sent as a link to your address. It opens the text directly — no account, no password, and the address is used for nothing else unless you tick the box below.
Your address is stored so the paper can be sent, and to know which areas are being asked for. Nothing else is sent unless the box is ticked, and it can be stopped at any time.
Where this goes next
Want this applied to your organisation?
One call is enough to know if we're a fit.