Europe should stop treating AI governance as a handbrake on growth

By Robin Gilthorpe(pictured), CEO, Earnix

Across Europe, AI is moving into day-to-day business use just as the regulatory framework around it starts to bite. In 2025, one in five EU enterprises was already using AI, rising to 55% among large businesses, while the EU AI Act is now moving through successive stages of implementation. European companies must work out how to govern AI as they move it beyond pilots and into live systems, business processes, and increasingly consequential decisions.

But the governance question becomes more important, not less, as AI moves beyond pilots and into live business processes. The real value of AI emerges when intelligence begins to influence a decision: what action to take, for whom, under what conditions and with what level of authority. At that point, companies need to know what the system is authorised to do, what information it can use, where human judgement is required and who remains accountable.

The question is one of authority

We are already seeing the business value of AI surface when we stop just asking it to produce an answer and start relying on it to influence a live decision or complete work in production. The more capable the system becomes, the more clearly its authority needs to be defined. Governance is therefore not about limiting what AI can do but deciding how much authority it can safely have, and under what conditions.

As AI moves into operational decision-making, companies need to define its boundaries before it is deployed: what data and systems it can access, what it can decide or execute without approval, when a person must intervene, and how its actions will be traced if something goes wrong. Greater autonomy only works if responsibility remains clear, especially when an AI-driven action directly affects a customer, a financial outcome, or a regulated decision.

That also changes what human oversight should mean. Putting a person nominally “in the loop” achieves very little if their role is simply to approve whatever the system recommends. Oversight must be designed around the points at which human judgment is genuinely required, with clear boundaries around where AI can act independently and where responsibility remains with a person.

Insurance offers an early view of what comes next

uropean insurance offers a useful glimpse of the challenge because the industry is already accustomed to making high-stakes decisions in a highly regulated environment. EIOPA’s 2026 survey, covering 347 insurers across 25 countries, found that 65% were already using generative AI and another 23% planned to. Yet most of those currently using it remained at proof-of-concept stage.

This says a great deal about where enterprise AI now stands. Demonstrating that the technology can work is becoming easier. Moving it into production, where it can affect customers, risk and commercial outcomes, requires a much stronger combination of technology, controls and operating governance.

This is not unique to insurance, as AI becomes more autonomous, governance cannot be something applied at the end of development as a compliance exercise. It has to be reflected in how the system actually operates, including the permissions it is given, the approvals it requires, how its behaviour is monitored, how changes are recorded and how a person can intervene. Those controls need to shape what the technology is permitted to do from the beginningEurope can turn control into an advantage

The EU AI Act makes that question increasingly immediate. From 2 December 2027, high-risk systems covered by Annex III will be subject to requirements including risk management, traceability, documentation and human oversight. But companies should resist treating that date as a regulatory finish line.

A business that can trace what an AI system did, monitor its behaviour and intervene when necessary can reasonably allow that system to do more than a business operating without that visibility. In that sense, governance is not necessarily a restriction on AI autonomy. It is part of what makes useful autonomy possible.If Europe gets that right, governance does not have to be the handbrake on AI growth. It can become one of the things that makes responsible AI adoption at scale possible.

About the Author

Robin Gilthorpe is CEO of Earnix, an AI company purpose-built for insurance decisioning, providing the industry with the agility to drive profitable growth, improve resilience, and operate with speed and precision in a rapidly changing risk environment.