Planning for 2027: what to put in your AI plan

Line 1: know what you run

List the AI tools in use, the AI features switched on inside software you already pay for, and any AI agents. Much of it arrives without a purchase, which is how AI gets into a company. Who: IT governance. When: early in the year, then at each review.

Line 2: give each one a named owner

We'd name one accountable owner for each, a role rather than a whole team, with a deputy. An AI register is a simple place to record them. Who: the head of each area that uses the tool. When: as each item is added.

Line 3: give your AI agents their own line

By an AI agent we mean AI software that can take actions in other systems for you, not just answer questions. Because an agent acts, we'd note what it is allowed to do and access, who switched it on, who can switch it off, and when that was last looked at.

Singapore's IMDA published a Model AI Governance Framework for Agentic AI in May 2026. It says each agent identity should be tied to "a supervising agent, a human user, or an organisational department for accountability and tracking" [1]. It also recommends limits and permission policies for each agent, and ways "to take agents offline" when they malfunction [1].

The UK's National Cyber Security Centre published interim advice in August 2026. Where unintended activity would have significant consequences, it recommends "making named individuals or group responsible for agentic AI activities". It also advises being able to "pull the plug" on agent activity [2].

The Competition and Markets Authority's guidance on using AI agents with consumers says: "if an AI agent you use does something illegal, you are responsible" [3].

Who: the agent's owner, with IT. When: before it goes live, then at each review.

Line 4: keep a dated record of checks

Pick a review rhythm, for example quarterly. For each line, keep the date of the last check and what changed since. A list without dates is hard to rely on, which is why a list is not evidence. Who: each owner. When: at the rhythm you pick.

Line 5: EU AI Act dates in 2026, 2027 and 2028

The Act's dates depend on the system and your role. A provider is an organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is an organisation using an AI system under its own authority, other than for personal, non-professional use [4].

Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, moved the high-risk dates [5]. When we checked EUR-Lex on 31 October 2026, it listed no later act amending the Act [5].

Dates to put in the calendar, if they may apply to you:

• From 2 December 2026, the Article 50(2) duty to mark AI-generated audio, images, video or text also covers providers whose systems were on the market before 2 August 2026 (Article 111(4)) [4]. This is a duty on providers, not on organisations that only use such systems.
• For AI systems classed as high-risk under Annex III, the Act's high-risk requirements apply from 2 December 2027; for those under Annex I, from 2 August 2028 (Article 113) [4].

The EU AI Act is EU law. It can also reach providers and deployers outside the EU, for example in the UK or Switzerland, where the output of an AI system is used in the EU (Article 2) [4]. This piece does not describe Swiss or UK rules on AI.

Dates as set out in the EU AI Act as amended by Regulation (EU) 2026/1744, checked 31 October 2026. The text can change; check the current version before you rely on a date.

Who: the plan owner, with legal advice where a date may apply. When: as the plan is written, then at each review.

Line 6: one person reports it

We'd name one person to bring the plan to the board or leadership, with a short update at each review. It helps to have answers ready for the questions a board or a customer may ask. Who: the plan owner. When: a date you set in 2027.