Annex III Explained — When Is Your AI 'High-Risk'?
The eight Annex III categories explained with concrete examples from Nordic midmarket. When is your recruitment tool, credit scoring, or OT system high-risk under the EU AI Act?
Sandhed før narrativ. Field notes, frameworks, and honest assessments on Enterprise Architecture, AI governance, and IT portfolio management.
No newsletter yet — follow on LinkedIn or subscribe via RSS.
RSS FeedThe eight Annex III categories explained with concrete examples from Nordic midmarket. When is your recruitment tool, credit scoring, or OT system high-risk under the EU AI Act?
What must an AI policy contain? The eight mandatory sections, common mistakes, and what separates a policy that is actually used from one that lives in a PDF folder nobody opens.
The difference and overlap between GDPR's DPIA and the AI Act's FRIA. When do you need which, who is responsible, and how do you avoid duplication with a coordinated workflow?
How to build an AI inventory from scratch. The discovery process, 15 questions per system, often-overlooked AI systems (Copilot, Shadow AI), and when to move from spreadsheet to a dedicated tool.
A policy PDF doesn't make you compliant. Here are the four deliverables that actually move the needle — a register, a risk classification, a decision matrix, and a one-pager.
80% of AI cost reduction comes from sending the right request to the right model — not from prompt engineering. A practical guide to model routing in production.
Anthropic's ephemeral cache discount is mechanically simple but operationally hard. The placement pattern, the 1024-token threshold, and what can and cannot be cached.
AI features without traces are not features, they are liabilities. The trace pattern, ADR-0001 metadata fields, and EU AI Act Article 15 in practice.
Most EA tools model architecture or strategy, not the loop. Themes without initiatives are aspirations. Initiatives without applications are theatre. Here is the loop in plain language.
When strategy and EA operate as separate disciplines, execution slows down. Three symptoms, one structural fix — and why the bridge matters more than either side alone.
Roger Martin's strategy cascade applied to EA governance: from winning aspiration to management systems, with capability maps and ADRs as the connective tissue.
Companies with 200–5,000 employees need structured EA practice but find that traditional platforms overshoot on complexity and cost. What right-sized looks like.
Organisations with 200-5,000 employees need EA but can't justify enterprise tooling. The gap is not a tool gap — it's a structure gap.
Most TIME implementations are colour-coded spreadsheets. Here's what structured scoring, strategy connection, and cost analysis actually look like.
You don't need an AI ethics board. You need a register, a risk classification, a decision matrix, and a one-pager. Two weeks, four deliverables.
Every organisation has scattered AI pilots. Few have direction. Prioritisation and an operating model turn experiments into capability.
The TIME model is the industry standard for classifying applications. But without strategic context, it's a categorisation exercise — not a decision engine.
AI-assisted scoring, capability generation, strategy parsing. APM in 2026 is AI-native or it's a spreadsheet.
Enterprise EA tooling requires 6-18 months, a dedicated team, and a six-figure budget. Most midmarket organisations have one EA or IT leader. There's a better way.
ISO 42010 is viewpoint-driven. TOGAF ADM is too slow for the AI era. Modern EA is about stakeholder concerns and decision support — not diagrams.
The gap between strategy and IT execution is where most organisations lose momentum. Capability mapping is the bridge.