Loading foresight
Interested in seeing how DSGHT.ai works for your strategy team?
Get the weekly foresight brief
A 5-minute read. Free, unsubscribe anytime.
Get the weekly foresight brief
A 5-minute read. Free, unsubscribe anytime.
Validated 17 Oct 2026
Between now and 2028, enforcement of the EU AI Act will reshape the European business-software market through two channels: whether regulators actually fine vendors, and whether corporate buyers turn AI Act compliance into a condition of purchase. Those channels can reinforce each other, but they can also fail while AI agents displace seat-based software on their own.
Generated by DSGHT.ai Living Foresight pipeline
Four possible futures the agents see for this topic, placed on the two uncertainties that separate them. Open any one to read its drivers, winners, losers and what to watch.
Archetype Discipline
Held steady — no material new evidence moved this scenario in the latest refresh.
Archetype Collapse
Held steady — no material new evidence moved this scenario in the latest refresh.
Archetype Transformation
Held steady — no material new evidence moved this scenario in the latest refresh.
Archetype Growth
Held steady — no material new evidence moved this scenario in the latest refresh.
These hold in every future, each against a force pushing the other way. The dots show how strongly each scenario rests on the trend, from 1 (background) to 5 (defining).
The EU AI Act applies in phases: prohibited practices since 2 February 2025, general-purpose AI duties and penalties since 2 August 2025, transparency rules from 2 August 2026, standalone high-risk (Annex III) duties from 2 December 2027 and product-embedded high-risk duties from 2 August 2028.
Countertrend: Pressure from industry executives and stalled standards for further stop-the-clock delays; sources still disagree on the operative standalone high-risk date.
AI use in enterprises keeps spreading, so more software features fall into transparency, high-risk or general-purpose AI downstream obligations each year.
Countertrend: Legal uncertainty (classification guidelines for high-risk systems still in preparation) and a persistent gap between hard-law intent and practice slow deployment of the riskiest use cases.
Incident-reporting and downstream general-purpose AI duties remain ambiguous through 2027, forcing vendors to build to the strictest plausible clock (72-hour first notice).
Countertrend: AI Office guidance and Article 73 clarification could confine duties to model providers and relax the clock for ordinary incidents.
AI governance becomes a paid software and services category (analyst coverage, acquisitions, investor attention to compliance as a moat).
Countertrend: Missing harmonised standards, no fines so far and thin enforcement capacity remove the compulsory demand driver.
Prohibited-practice rules (for example the workplace emotion-recognition ban) are already law, and national supervision of them starts 2 August 2026, so some enforcement contact exists in every world.
Countertrend: Authorities are still being designated and the Commission's own review found its incident evidence base limited, which delays and thins early cases.
Six C-level personas stress-test the foresight and record where they disagree with it. Their objections are kept, not reconciled.
Warning. 6 board personas reviewed this foresight; 5 changes are required before it ships.
The board's verdict is WARNING: the report's strategic reading, that buyers rather than regulators will set the pace (Scenario A, The Questionnaire Regime, at 36%), may be right, but it is not yet safe to ship. The legal calendar is the largest flaw. The report calls the Annex III high-risk start of 2 December 2027 "true in every scenario" while admitting that the Digital Omnibus on AI (the EU package postponing those duties) is unverified and that the tension-001 check date of 2026-Q2 passed unconfirmed. If the Omnibus is not in force, the high-risk duties already applied on 2 August 2026 and every reader is already late, a shadow path the report never costs. A human must confirm the dates against the Official Journal before release. The report also has two arithmetic and evidence gaps. The "wrong variable in 44% (C + D)" claim in Executive Summary point 4 cannot be derived from a matrix whose axes are enforcement intensity and buyer gating, and it conflicts with the tension-x-001, -007, -014, -019 and -028 row saying seat-based annual recurring revenue (ARR) is exposed in every scenario. Scenario D, The Enforcement Lottery, is also a high-enforcement world where compliance matters. Second, the only cost figure, EUR 0.4–1.0M a year for a EUR 20M vendor, is the model's own illustration, and the revenue at risk is never sized. Two operational and technical corrections are equally mandatory. The advice to build incident response to a 72-hour clock as "the strictest" is wrong, because EU AI Act Article 73 (the serious-incident reporting rule) has 2-day and 10-day tracks, and regulated buyers face their own clocks under NIS2 (the EU network and information security directive) and DORA (the EU financial-sector resilience regulation). Tension-002 must be rewritten with an engineering cost behind it. The tranche rule is also decorative: tension-x-004 makes the 2027 renewals the real deadline, yet the Scenario A signposts resolve between 2027-Q1 and 2028-Q4. Retime them to signals a vendor can see in its own pipeline within a quarter, and start a small unconditional first tranche now (an AI feature inventory, a corrected incident runbook and a reusable evidence pack), with an owner and a two-week deliverable for each action. Before the next review, the authors should also do the following: - Surface the early ISO/IEC 42001 certification and evidence-pack opportunity, currently buried in a second-order bullet, and define that pack in engineering terms. - Warn against self-declared "AI Act ready" claims, given tension-x-026 on buyer discounting of ethics washing. - Close or explicitly accept the unresolved tension-022 (SME relief), which also leaves the Central and Eastern Europe conclusion with no direct sources, together with tension-024 and tension-025. - Re-review the full document, since Scenarios C (Paper Tiger, Agent Storm) and D and the Decision Brief were not visible to the reviewers.
CEO The report's own 'uncomfortable call' rests on a number its scenario matrix cannot produce. Executive Summary point 4 says a compliance-first strategy is 'a bet on the wrong variable in 44% of the probability space (C + D)'. But the two matrix axes are public enforcement intensity and buyer contractual gating, and neither measures AI-agent substitution of seat-based software. Scenario D — The Enforcement Lottery is a high-enforcement world, where compliance is exactly what regulators sort vendors by, so it is unclear why D belongs in the 'wrong variable' bucket. Meanwhile the tension row for [tension-x-001, -007, -014, -019, -028] says seat-based annual recurring revenue (ARR) is 'exposed whichever way the Act goes', which implies 100% of the space, not 44%. So the biggest threat to the client's revenue is either understated (if it applies in every scenario) or unsupported (if it applies only in C). It sits outside the matrix and is quantified by arithmetic the reader cannot reproduce. The Scenario D narrative and the Decision Brief were not visible in the supplied text, so this finding is based on the visible sections only.
CTO The report tells vendors to 'build to the strictest clock (72h)' and calls this 'the cheaper error' (Section 3 predetermined elements; Section 4, Tension-002). Its own tension evidence says Article 73 (the serious-incident reporting rule) also has 2-day and 10-day clocks for specific categories, which are shorter than 72 hours. 72 hours is therefore not the strictest clock, and a playbook built to it could miss a legal deadline. The report also never says which Article 73 categories a B2B SaaS vendor is likely to meet. Regimes that already apply to regulated buyers have their own clocks (for example NIS2, the EU network-security directive, and DORA, the EU financial-sector resilience regulation), and the report does not reconcile them. The 'cheaper error' claim has no engineering cost behind it, because detection, triage and customer-notification pipelines are the expensive part.
COO The report stages compliance spend in tranches 'tied to signposts' (Executive Summary point 5), but the signposts resolve after the work has to start. Tension-x-004 (cost arrives early, legal pressure arrives late) says 2027 renewals are the real deadline. The Scenario A signposts check the CSA STAR registry (a registry of cloud-security questionnaires) by 2027-Q1, a Gartner survey edition published by 2028-Q4, and a cumulative penalty count at 2028-Q4. Two of the three resolve after the 2027 renewals are already signed, and the third is a weak proxy for the 2027-Q1 decision. A vendor following the tranche rule would release money only once the evidence it needs for renewals is overdue. The gate that stages the spend is therefore decorative and could cause the very late-start failure the report warns about.
How far the evidence behind this space can be followed back to where it came from.
2,707 of 4,129 claims are tied to a page that was matched to that specific claim (2,707 checked against a quoted passage). The rest are marked uncited and traced to the research document they were read in — its links are not shown as their source.
Dated, checkable forecasts this space committed to in advance, and how they turned out.
Each forecast was registered before its outcome could be known and is never edited. A moved threshold, date or probability is a new forecast, and the old one is still checked against what it said. A forecast is checked only after the data for its date is normally published. None has reached that point yet, so there is no score to show.
AI-CAIQ (AI Consensus Assessments Initiative Questionnaire) entries published in the CSA STAR registry exceeds 300 published entries by 2027-Q1
Staff headcount of the AI Office enforcement units exceeds 60 people by 2027-Q1 (from 36 in the frontier unit in October 2026)
First publicly announced AI Act fine by any authority at least 1 publicly announced AI Act fine
Formal legislative proposal to postpone the Annex III or Annex I application dates again at least 1 formal Commission legislative proposal to postpone the Annex III or Annex I application dates
Announced acquisitions of AI-governance software vendors at least 10 announced deals in calendar 2027
Share of European AI startup funding rounds led by US and Asian investors > 35%
Harmonised standards under request M/613 cited in the Official Journal below 1 harmonised standard under M/613 cited in the Official Journal by 28 February 2027
Seat-based subscription revenue growth of listed European business-software vendors < 8%
Valid ISO/IEC 42001 certificates held by EU-based organisations below 1,000 valid ISO/IEC 42001 certificates held by EU-based organisations
Share of EU enterprise software contracts above EUR 100,000 carrying an AI Act annex or AI questionnaire > 60%
Cumulative public AI Act penalty decisions by national authorities and the AI Office no more than 10 decisions cumulatively by 2028-Q4
Cumulative public AI Act penalty decisions by national authorities and the AI Office at least 20 decisions cumulatively by 2028-Q4
How this space scores on ForesightEval, dimension by dimension.
7.3/ 10
Solid across 6 core dimensions; weakest on Actionability (6).
Weighted mean of the core dimensions, scored by the ForesightEval judges.
Advisory, not in the headline: scenario-contrast 3
This report was generated by an AI pipeline (DSGHT.ai Living Foresight pipeline). Its scenarios, tensions and conclusions are machine-written and were checked by automated adversarial review, not by a human author. Every claim carries a source reference so any statement can be traced and verified independently.