[{"data":1,"prerenderedAt":679},["ShallowReactive",2],{"navigation-nl":3,"{\"language\":\"nl\",\"resolve_relations\":[\"article.author\"],\"version\":\"published\"}news\u002Fhow-to-turn-ai-governance-into-a-single-control-fabric":330},{"_uid":4,"groups":5,"component":4},"navigation",[6,107,210,263],{"_uid":7,"link":8,"label":16,"tiers":17,"hidden":29,"columns":97,"component":98,"in_footer":15,"in_header":15,"brand_link":99,"brand_label":101,"footer_link":102,"footer_text":9,"panel_width":103,"footer_label":9,"footer_order":104,"brand_cta_link":105,"footer_heading":106,"brand_cta_label":9},"3a984d45-c4a4-4620-b9a0-e89311aad748",{"id":9,"url":9,"story":10,"linktype":12,"fieldtype":13,"cached_url":14,"prep":15},"",{"full_slug":11},"helia","story","multilink","\u002Fnl\u002Fhelia",true,"Product",[18,63],{"_uid":19,"items":20,"style":59,"hidden":29,"marker":60,"component":61,"marker_color":62},"a7cc3e35-c73c-4b31-adb6-287a7a0f5a5f",[21,32,41,50],{"_uid":22,"icon":23,"link":24,"label":28,"hidden":29,"component":30,"description":31},"06faf34e-21ae-4e85-9c18-d349c8e43767","i-lucide-mountain-snow",{"id":9,"url":9,"story":25,"linktype":12,"fieldtype":13,"cached_url":27,"prep":15},{"full_slug":26},"helia\u002Fhorizon-scanning","\u002Fnl\u002Fhelia\u002Fhorizon-scanning","Horizon Scanning",false,"nav_item","Wij signaleren wat er verandert zodra het verschijnt",{"_uid":33,"icon":34,"link":35,"label":39,"hidden":29,"component":30,"description":40},"1b053d0c-5196-4a3d-b446-0d975ad3a0bf","i-lucide-trending-up",{"id":9,"url":9,"story":36,"linktype":12,"fieldtype":13,"cached_url":38,"prep":15},{"full_slug":37},"helia\u002Fimpact-assessment","\u002Fnl\u002Fhelia\u002Fimpact-assessment","Impact Assessment","Zie wat een wijziging betekent en waar de gaps zitten",{"_uid":42,"icon":43,"link":44,"label":48,"hidden":29,"component":30,"description":49},"a77dbf68-4115-4712-99cd-cc1c687b6db3","i-lucide-route",{"id":9,"url":9,"story":45,"linktype":12,"fieldtype":13,"cached_url":47,"prep":15},{"full_slug":46},"helia\u002Frisk-control","\u002Fnl\u002Fhelia\u002Frisk-control","Risk & Control","Elke gap komt met een door AI opgestelde oplossing",{"_uid":51,"icon":52,"link":53,"label":57,"hidden":29,"component":30,"description":58},"74a1f93b-9b82-42be-8052-9037a25eef70","i-lucide-database",{"id":9,"url":9,"story":54,"linktype":12,"fieldtype":13,"cached_url":56,"prep":15},{"full_slug":55},"helia\u002Fdata-management","\u002Fnl\u002Fhelia\u002Fdata-management","Data Management","Eén geversioneerde bron van waarheid voor regels en controls","rows","tile","nav_tier","secondary",{"_uid":64,"items":65,"style":93,"hidden":29,"marker":60,"heading":94,"component":61,"description":95,"marker_color":62,"heading_style":96},"3fe1e99d-1af4-4266-808b-a6d42a292b7d",[66,75,84],{"_uid":67,"icon":68,"link":69,"label":73,"hidden":29,"component":30,"description":74},"cfb434b2-8dd3-4a2e-b7a3-55026f8f6e69","i-lucide-compass",{"id":9,"url":9,"story":70,"linktype":12,"fieldtype":13,"cached_url":72,"prep":15},{"full_slug":71},"helia\u002Fregulatory-nexus","\u002Fnl\u002Fhelia\u002Fregulatory-nexus","Regulatory Nexus","Elke regel gekoppeld aan zijn controls, bewijzen en eigenaren",{"_uid":76,"icon":77,"link":78,"label":82,"hidden":29,"component":30,"description":83},"a7d84ff1-8690-4117-95b2-7570d58c2ebd","i-lucide-folder-kanban",{"id":9,"url":9,"story":79,"linktype":12,"fieldtype":13,"cached_url":81,"prep":15},{"full_slug":80},"helia\u002Ftask-management","\u002Fnl\u002Fhelia\u002Ftask-management","Task Management","Bevindingen worden toegewezen, beoordeeld en onderbouwd werk",{"_uid":85,"icon":86,"link":87,"label":91,"hidden":29,"component":30,"description":92},"37996c4e-dc18-4619-9d4e-1ad1aa5f1435","i-lucide-vault",{"id":9,"url":9,"story":88,"linktype":12,"fieldtype":13,"cached_url":90,"prep":15},{"full_slug":89},"helia\u002Fvault","\u002Fnl\u002Fhelia\u002Fvault","Vault","Toezichthouderklaar bewijs in één klik","labels","Helia Foundation","altijd inbegrepen","inline","2","nav_group",{"id":9,"url":9,"story":100,"linktype":12,"fieldtype":13,"cached_url":14,"prep":15},{"full_slug":11},"Ontdek Regulatory AI",{"id":9,"url":9,"linktype":12,"fieldtype":13,"cached_url":9},"wide","1",{"id":9,"url":9,"linktype":12,"fieldtype":13,"cached_url":9},"RegAI Helia",{"_uid":108,"link":109,"label":111,"tiers":112,"hidden":29,"columns":97,"component":98,"in_footer":15,"in_header":15,"panel_width":103,"footer_order":209},"b819acc3-3bd1-4e78-808f-430a5106bfd3",{"id":9,"url":9,"linktype":110,"fieldtype":13,"cached_url":9},"url","Oplossingen",[113,149,169],{"_uid":114,"items":115,"style":59,"hidden":29,"marker":146,"heading":147,"component":61,"description":148,"marker_color":9,"heading_style":9},"ced8b335-a7d1-4076-b875-513e850185f7",[116,124,132,139],{"_uid":117,"icon":9,"link":118,"label":122,"hidden":29,"component":30,"in_footer":15,"in_header":15,"description":123},"a0f46fa6-82f1-4c85-81e1-3a3684b54eaa",{"id":9,"url":9,"story":119,"linktype":12,"fieldtype":13,"cached_url":121,"prep":15},{"full_slug":120},"solutions\u002Famlr","\u002Fnl\u002Fsolutions\u002Famlr","AMLR","Sanctiewet, technical standards (FEC)",{"_uid":125,"link":126,"label":130,"hidden":29,"component":30,"description":131},"d89ecacc-8bb4-49e1-b02f-df32bb824c32",{"id":9,"url":9,"story":127,"linktype":12,"fieldtype":13,"cached_url":129,"prep":15},{"full_slug":128},"solutions\u002Fdora","\u002Fnl\u002Fsolutions\u002Fdora","DORA","en gerelateerde regelgeving",{"_uid":133,"link":134,"label":138,"hidden":29,"component":30,"description":131},"65a2c9e5-b3a4-4465-9d16-9ef734ffbee9",{"id":9,"url":9,"story":135,"linktype":12,"fieldtype":13,"cached_url":137,"prep":15},{"full_slug":136},"solutions\u002Fesg","\u002Fnl\u002Fsolutions\u002Fesg","ESG",{"_uid":140,"link":141,"label":145,"hidden":29,"component":30,"description":131},"25031048-0045-4cea-b5ed-8e1af3a2b240",{"id":9,"url":9,"story":142,"linktype":12,"fieldtype":13,"cached_url":144,"prep":15},{"full_slug":143},"solutions\u002Fai-act","\u002Fnl\u002Fsolutions\u002Fai-act","AI Act","bar","Implementatie-engines","Toegespitst op één regulatoir domein en uitgerold binnen uw bestaande beleid, controls en dataraamwerk",{"_uid":150,"items":151,"style":59,"hidden":29,"marker":146,"heading":166,"component":61,"description":167,"marker_color":168,"heading_style":9},"4cb9d0fb-ae60-4a6d-8ce9-a63ac15bbffa",[152,159],{"_uid":153,"link":154,"label":158,"hidden":29,"component":30,"description":131},"3319bb12-c3e1-4f03-8628-55db20ab7bca",{"id":9,"url":9,"story":155,"linktype":12,"fieldtype":13,"cached_url":157,"prep":15},{"full_slug":156},"solutions\u002Fmicar","\u002Fnl\u002Fsolutions\u002Fmicar","MiCAR",{"_uid":160,"link":161,"label":165,"hidden":29,"component":30,"description":131},"4f20f819-0ed2-4bed-9f6e-4c79a6ebdada",{"id":9,"url":9,"story":162,"linktype":12,"fieldtype":13,"cached_url":164,"prep":15},{"full_slug":163},"solutions\u002Faifmd","\u002Fnl\u002Fsolutions\u002Faifmd","AIFMD","Compliance-in-a-box","Samengesteld voor een type instelling waarvan de regulatoire perimeter grotendeels door één regime wordt bepaald","accent",{"_uid":170,"items":171,"style":93,"hidden":29,"marker":207,"heading":208,"component":61,"in_header":29,"footer_order":97,"marker_color":9,"footer_column":15,"heading_style":9},"c3852bfb-8d89-443f-99fd-754307e49dcc",[172,179,186,193,200],{"_uid":173,"link":174,"label":178,"hidden":29,"component":30},"e1b66107-6600-4633-a6df-4961e8af20d9",{"id":9,"url":9,"story":175,"linktype":12,"fieldtype":13,"cached_url":177,"prep":15},{"full_slug":176},"services\u002Fregulatory-change","\u002Fnl\u002Fservices\u002Fregulatory-change","Regulatory Change Management",{"_uid":180,"link":181,"label":185,"hidden":29,"component":30},"366e6e5a-39b9-4623-a37e-c19a0c9438a9",{"id":9,"url":9,"story":182,"linktype":12,"fieldtype":13,"cached_url":184,"prep":15},{"full_slug":183},"services\u002Fintegrated-risk-management","\u002Fnl\u002Fservices\u002Fintegrated-risk-management","Integrated Risk Management",{"_uid":187,"link":188,"label":192,"hidden":29,"component":30},"9cf11ffe-1fbb-48e4-b8c6-bef6b0b04f6b",{"id":9,"url":9,"story":189,"linktype":12,"fieldtype":13,"cached_url":191,"prep":15},{"full_slug":190},"services\u002Fnon-financial-risk","\u002Fnl\u002Fservices\u002Fnon-financial-risk","Non-Financial Risk",{"_uid":194,"link":195,"label":199,"hidden":29,"component":30},"c2fb0349-60a7-47f2-8fe7-194bfae736fc",{"id":9,"url":9,"story":196,"linktype":12,"fieldtype":13,"cached_url":198,"prep":15},{"full_slug":197},"services\u002Fresponsible-ai","\u002Fnl\u002Fservices\u002Fresponsible-ai","Responsible AI",{"_uid":201,"link":202,"label":206,"hidden":29,"component":30},"dc05a25f-81f0-4060-b940-ed2e02ea2f39",{"id":9,"url":9,"story":203,"linktype":12,"fieldtype":13,"cached_url":205,"prep":15},{"full_slug":204},"services\u002Fsustainable-finance","\u002Fnl\u002Fservices\u002Fsustainable-finance","Sustainable Finance","none","Diensten","4",{"_uid":211,"link":212,"label":216,"tiers":217,"hidden":29,"columns":104,"component":98,"in_footer":29,"in_header":15,"panel_width":261,"footer_order":262},"0ef586ba-e957-44b3-9bca-e3dbab796458",{"id":9,"url":9,"story":213,"linktype":12,"fieldtype":13,"cached_url":215,"prep":15},{"full_slug":214},"clients","\u002Fnl\u002Fclients","Klanten",[218,226],{"_uid":219,"items":220,"style":59,"hidden":29,"marker":207,"component":61,"in_footer":29,"in_header":29},"5029d714-3b1c-46c9-8184-57601f8a292c",[221],{"_uid":222,"link":223,"label":216,"hidden":29,"component":30,"description":225},"d95827bc-7fb0-464b-b6be-1fe7a1ad5046",{"id":9,"url":9,"story":224,"linktype":12,"fieldtype":13,"cached_url":215,"prep":15},{"full_slug":214},"Met wie wij werken, in de hele sector en met de toezichthouders",{"_uid":227,"items":228,"style":59,"hidden":29,"marker":207,"component":61,"in_footer":29,"in_header":29},"51f99e1b-7670-4f52-8bc4-672c19e34fa8",[229,237,245,253],{"_uid":230,"link":231,"label":235,"hidden":29,"component":30,"description":236},"e744d61a-0416-41e8-aedc-c3401dd02cac",{"id":9,"url":9,"story":232,"linktype":12,"fieldtype":13,"cached_url":234,"prep":15},{"full_slug":233},"banking","\u002Fnl\u002Fbanking","Banken","Kapitaal, prudentiële rapportage en een verbredende AML-agenda",{"_uid":238,"link":239,"label":243,"hidden":29,"component":30,"description":244},"20d27513-7541-4143-9caa-bc93b4805905",{"id":9,"url":9,"story":240,"linktype":12,"fieldtype":13,"cached_url":242,"prep":15},{"full_slug":241},"insurance","\u002Fnl\u002Finsurance","Verzekeraars","Solvency II, IFRS 17, en een groeiende conduct- en ICT-last",{"_uid":246,"link":247,"label":251,"hidden":29,"component":30,"description":252},"7b671952-5705-4e90-8e95-b037f1522cc6",{"id":9,"url":9,"story":248,"linktype":12,"fieldtype":13,"cached_url":250,"prep":15},{"full_slug":249},"asset-management","\u002Fnl\u002Fasset-management","Vermogensbeheer","AIFMD II, gedragsregels en duurzaamheidsrapportage",{"_uid":254,"link":255,"label":259,"hidden":29,"component":30,"description":260},"849a3ffb-e943-4043-83fa-d70f0926e2cb",{"id":9,"url":9,"story":256,"linktype":12,"fieldtype":13,"cached_url":258,"prep":15},{"full_slug":257},"pension-funds","\u002Fnl\u002Fpension-funds","Pensioenfondsen","De Wtp-transitie en IORP II, met de data die daaronder ligt","narrow","3",{"_uid":264,"link":265,"label":266,"tiers":267,"hidden":29,"columns":104,"component":98,"in_footer":15,"in_header":15,"panel_width":261,"footer_order":329},"32580ef8-5802-4f5e-a36c-fa38d56a9504",{"id":9,"url":9,"linktype":110,"fieldtype":13,"cached_url":9},"Bedrijf",[268],{"_uid":269,"items":270,"style":59,"hidden":29,"marker":60,"component":61,"heading_style":9},"19e06ab9-9671-4711-bc0b-9e57c0ba9952",[271,275,284,293,302,311,320],{"_uid":272,"link":273,"label":216,"hidden":29,"component":30,"in_footer":15,"in_header":29},"fb8cfc24-0903-4d96-9510-a528472f667c",{"id":9,"url":9,"story":274,"linktype":12,"fieldtype":13,"cached_url":215,"prep":15},{"full_slug":214},{"_uid":276,"icon":277,"link":278,"label":282,"hidden":29,"component":30,"description":283},"38b711d4-31f3-4981-8513-4d9a4e65ff35","i-lucide-building-2",{"id":9,"url":9,"story":279,"linktype":12,"fieldtype":13,"cached_url":281,"prep":15},{"full_slug":280},"about","\u002Fnl\u002Fabout","Over ons","Wat we doen, hoe we werken en waar we vandaan komen",{"_uid":285,"icon":286,"link":287,"label":291,"hidden":29,"component":30,"description":292},"f2bef759-a957-426b-a1e0-e73248b14063","i-lucide-users",{"id":9,"url":9,"story":288,"linktype":12,"fieldtype":13,"cached_url":290,"prep":15},{"full_slug":289},"team","\u002Fnl\u002Fteam","Team","De mensen met wie u daadwerkelijk werkt",{"_uid":294,"icon":295,"link":296,"label":300,"hidden":29,"component":30,"description":301},"02418345-4aef-4413-9f5e-7fff2ade80fc","i-lucide-newspaper",{"id":9,"url":9,"story":297,"linktype":12,"fieldtype":13,"cached_url":299,"prep":15},{"full_slug":298},"news","\u002Fnl\u002Fnews","Nieuws & inzichten","Wat er veranderde, wat het betekent en wat wij ermee deden",{"_uid":303,"icon":304,"link":305,"label":309,"hidden":29,"component":30,"description":310},"4254d80d-2645-4a32-8dde-fbb8e5a0c98e","i-lucide-briefcase",{"id":9,"url":9,"story":306,"linktype":12,"fieldtype":13,"cached_url":308,"prep":15},{"full_slug":307},"careers","\u002Fnl\u002Fcareers","Werken bij","Hoe het is om hier te werken, en hoe u ons bereikt",{"_uid":312,"icon":313,"link":314,"label":318,"hidden":29,"component":30,"description":319},"33676272-e0f6-49bd-b759-a9a63857103a","i-lucide-leaf",{"id":9,"url":9,"story":315,"linktype":12,"fieldtype":13,"cached_url":317,"prep":15},{"full_slug":316},"sustainability","\u002Fnl\u002Fsustainability","Duurzaamheid","Onze EcoVadis-rating, en wat daarachter zit",{"_uid":321,"icon":322,"link":323,"label":327,"hidden":29,"component":30,"in_header":29,"description":328},"2885e2cf-cb3d-4861-8db2-49683dc9b7d0","i-lucide-mail",{"id":9,"url":9,"story":324,"linktype":12,"fieldtype":13,"cached_url":326,"prep":15},{"full_slug":325},"contact","\u002Fnl\u002Fcontact","Contact","Waar wij zitten, en wie antwoordt als u schrijft","5",{"data":331,"headers":657},{"story":332,"cv":643,"rels":644,"links":656},{"name":333,"created_at":334,"published_at":335,"updated_at":336,"id":337,"uuid":338,"content":339,"slug":635,"full_slug":636,"sort_by_date":356,"position":637,"tag_list":638,"is_startpage":29,"parent_id":639,"meta_data":356,"group_id":640,"first_published_at":641,"release_id":356,"lang":630,"path":356,"alternates":642,"default_full_slug":356,"translated_slugs":356},"How to turn AI governance into a single control fabric","2026-08-05T09:28:48.449Z","2026-09-02T13:25:05.823Z","2026-09-02T13:25:05.841Z",205752436563951,"371811c9-f800-46d9-b8e1-588cdb14e0ce",{"_uid":340,"body":341,"date":591,"kind":592,"image":593,"title":597,"topic":199,"author":598,"summary":632,"component":633,"source_url":634},"f168a16d-edbc-4dff-a55c-ca2b28b851e4",{"type":342,"content":343},"doc",[344,372,379,390,396,400,404,408,413,417,423,427,432,436,441,445,449,453,457,464,469,473,478,482,499,503,508,512,528,533,537,545,550,554,558,568,572,578,583,587],{"type":345,"content":346},"paragraph",[347,358,362,368],{"text":235,"type":348,"marks":349},"text",[350,352],{"type":351},"italic",{"type":353,"attrs":354},"link",{"href":355,"uuid":356,"anchor":356,"target":357,"linktype":12},"\u002Fbanking",null,"_self",{"text":359,"type":348,"marks":360}," bewegen zich vandaag door een steeds complexer web van digitale regelgeving: gegevensbescherming, operationele weerbaarheid en inmiddels ook AI-specifiek risicomanagement. Overlap tussen regels is niets nieuws, maar de komst van de ",[361],{"type":351},{"text":145,"type":348,"marks":363},[364,365],{"type":351},{"type":353,"attrs":366},{"href":367,"uuid":356,"anchor":356,"target":357,"linktype":12},"\u002Fsolutions\u002Fai-act",{"text":369,"type":348,"marks":370}," zet een oude vraag scherper neer: welke governance-elementen moeten er boven op bestaande frameworks komen? En minstens zo belangrijk: welke verplichtingen vragen om volledig nieuwe controls, en welke om aanpassing van bestaande? Voor Europese financiële instellingen is het antwoord op die vragen bepalend om compliance mee te laten bewegen met de technologische werkelijkheid.",[371],{"type":351},{"type":373,"attrs":374,"content":376},"heading",{"level":375},2,[377],{"text":378,"type":348},"Meerdere frameworks, één probleem",{"type":345,"content":380},[381,383,388],{"text":382,"type":348},"Het probleem is niet dat de regels onduidelijk zijn, maar dat elke regeling zijn eigen werkstromen, eigenaren en audits meebrengt, ook waar de vereisten overlappen. Nergens is dat duidelijker dan bij AI governance, waar de AI Act nieuwe verplichtingen brengt die rechtstreeks raken aan bestaande GDPR- en ",{"text":130,"type":348,"marks":384},[385],{"type":353,"attrs":386},{"href":387,"uuid":356,"anchor":356,"target":357,"linktype":12},"\u002Fsolutions\u002Fdora",{"text":389,"type":348},"-controls. Laten wij AI governance als voorbeeld nemen.",{"type":373,"attrs":391,"content":393},{"level":392},3,[394],{"text":395,"type":348},"AI governance: onduidelijke normen en naderende deadlines",{"type":345,"content":397},[398],{"text":399,"type":348},"De AI Act deelt AI-systemen in naar risico. Voor hoogrisicotoepassingen in de financiële sector gelden strenge verplichtingen rond risicobeoordeling, datakwaliteit en traceerbaarheid. Welke verplichtingen precies gelden, hangt af van de rol van de instelling ten opzichte van het AI-systeem. Deze vereisten gaan verder dan klassieke software governance: zij vragen om transparantie, data lineage en doorlopende monitoring.",{"type":345,"content":401},[402],{"text":403,"type":348},"De opgave wordt nijpender doordat de gedetailleerde uitvoeringsrichtsnoeren bij de AI Act nog in ontwikkeling zijn. De wetgeving trad in augustus 2024 in werking, maar de geharmoniseerde normen die concrete compliance-paden bieden worden nog afgerond door de Europese normalisatie-instellingen; naar verwachting loopt dat uit tot 2026.",{"type":345,"content":405},[406],{"text":407,"type":348},"Dat gat in de tijd levert een strategisch dilemma op: gaat u te snel, dan riskeert u controls die niet aansluiten; wacht u te lang, dan riskeert u de handhavingsdeadline van augustus 2026 voor hoogrisico-AI te missen.",{"type":373,"attrs":409,"content":410},{"level":392},[411],{"text":412,"type":348},"AI Act, GDPR en DORA vragen om hetzelfde fundament",{"type":345,"content":414},[415],{"text":416,"type":348},"Veel compliance teams merken dat de AI Act niet op zichzelf staat, maar sterk raakt aan bestaande frameworks die al veel capaciteit opslokken. Banken hebben veel werk gestoken in het mappen van GDPR-vereisten voor gegevensbescherming en implementeren tegelijkertijd de ICT-weerbaarheidscontrols van DORA, waardoor overlappende verplichtingen op elkaar stapelen. Veel van dezelfde of vergelijkbare procedurele en strategische vereisten komen nu in alle drie de regimes terug. Bijvoorbeeld:",{"type":373,"attrs":418,"content":420},{"level":419},5,[421],{"text":422,"type":348},"Logging, monitoring en incidentrapportage:",{"type":345,"content":424},[425],{"text":426,"type":348},"Onder de AI Act (artikel 12 en 26(5-6) voor deployers), GDPR (art. 30, 33-34) en DORA (art. 10, 17-19) moeten banken systeemgedrag monitoren, traceerbare logs bewaren en betrokkenen informeren bij ernstige incidenten. De definities verschillen, technische incidenten onder DORA, datalekken onder GDPR en storingen in AI onder de AI Act, maar de onderliggende bouwstenen overlappen vaak. Toch houden veel instellingen per regime nog aparte eigenaren, systemen en audit trails aan.",{"type":373,"attrs":428,"content":429},{"level":419},[430],{"text":431,"type":348},"Data governance en datakwaliteit:",{"type":345,"content":433},[434],{"text":435,"type":348},"De AI Act vraagt om datasets van hoge kwaliteit om het risico op discriminerende uitkomsten te beperken (art. 10 en 26(4)), GDPR eist juiste en actuele persoonsgegevens (art. 5(1)(d) en (f)) en DORA schrijft data-integriteit voor met het oog op operationele weerbaarheid (art. 5(2)(b)). Alle drie de regimes vragen om een stevig data governance framework. Die vereisten in silo’s aanpakken kost niet alleen dubbel werk, het brengt ook het risico van uiteenlopende normen binnen de organisatie mee.",{"type":373,"attrs":437,"content":438},{"level":392},[439],{"text":440,"type":348},"Silo’s in controls remmen innovatie",{"type":345,"content":442},[443],{"text":444,"type":348},"Een versnipperde aanpak leidt tot ‘compliance silo’s’, waarin gescheiden eigenaarschap en parallelle beheersmaatregelen zorgen voor dubbele controls, overbelasting van mensen en, het meest ingrijpend, vertraging of stilstand van AI-pilots die echte waarde kunnen opleveren.",{"type":345,"content":446},[447],{"text":448,"type":348},"De onzekerheid over de laatste details van de AI Act maakt het er niet makkelijker op. Slechts 11% van de Europese banken voelt zich voorbereid op de AI Act, terwijl 70% zegt gedeeltelijk klaar te zijn (EY, 2024). In juni behoorden banken tot de ondertekenaars van een brede oproep uit het bedrijfsleven om de AI Act uit te stellen, met versnipperde normen en onduidelijke vereisten als reden (EU AI Champions Initiative, 2025). En het blijft niet bij AI: overlappende EU-regelgeving kost het bedrijfsleven naar schatting 150 miljard euro per jaar aan compliance (Europese Commissie, 2025).",{"type":345,"content":450},[451],{"text":452,"type":348},"Zolang de geharmoniseerde normen nog in ontwikkeling zijn, kan het te vroeg vastleggen van controls leiden tot een mismatch met toekomstige vereisten. Wachten op volledige duidelijkheid drukt de opleverplanning juist gevaarlijk dicht tegen de regulatoire deadlines aan.",{"type":345,"content":454},[455],{"text":456,"type":348},"Compliance teams zitten klem tussen te vroeg implementeren en regulatoire stilstand, terwijl zij vereisten jongleren die veel efficiënter te behappen zijn als u ze in samenhang aanpakt. Hoe kunnen banken dan snel en met vertrouwen bewegen in dit overlappende, onzekere speelveld? Concreter:",{"type":373,"attrs":458,"content":459},{"level":419},[460],{"text":461,"type":348,"marks":462},"Hoe ontwerpt u vandaag AI governance, terwijl de regels nog in beweging zijn, zonder een silo naast GDPR, DORA en de rest te bouwen? Hoe voorkomt u dubbel werk aan controls en bouwt u in plaats daarvan één schaalbaar framework dat alle regimes bedient?",[463],{"type":351},{"type":373,"attrs":465,"content":466},{"level":375},[467],{"text":468,"type":348},"Eén governance fabric, voor AI en verder",{"type":345,"content":470},[471],{"text":472,"type":348},"Het antwoord ligt in een aanpak die convergentie van regelgeving als kans ziet in plaats van als last, met technologie als aanjager. Wie de AI Act behandelt als proefcasus voor bredere verbetering van governance, lost twee problemen tegelijk op: voldoen aan de naderende AI-verplichtingen en de dubbeling terugdringen die GDPR en DORA al hebben veroorzaakt. Hieronder een aanpak in vier stappen om die governance fabric te bouwen: beginnend bij de AI Act, maar ontworpen om over frameworks heen mee te schalen.",{"type":373,"attrs":474,"content":475},{"level":392},[476],{"text":477,"type":348},"Stap 1: bepaal uw positie ten opzichte van de AI Act",{"type":345,"content":479},[480],{"text":481,"type":348},"Breng eerst uw huidige en geplande AI-toepassingen in kaart tegen de risicocategorieën van de AI Act (beperkt, hoog risico, verboden) en maak helder welke rol uw organisatie heeft, want elke rol brengt andere verplichtingen mee. Koppel de van toepassing zijnde artikelen aan de geraakte bedrijfsfuncties en processen. Richt lichte classificatieprocessen in waarmee u nieuwe AI-initiatieven snel kunt beoordelen. Bepaal welke use cases direct aandacht vragen en welke kunnen meebewegen met de normen die nog komen.",{"type":345,"content":483},[484,489,495],{"text":485,"type":348,"marks":486},"Tip: de expertsessies van ACE leiden u door de scoping van de AI Act, met applicability scans en risicoclassificatiesessies om uw AI-inventaris op te bouwen en uit te breiden. Ondertussen mapt de Impact Assessment module van ",[487],{"type":488},"bold",{"text":106,"type":348,"marks":490},[491,492],{"type":488},{"type":353,"attrs":493},{"href":494,"uuid":356,"anchor":356,"target":357,"linktype":12},"\u002Fhelia",{"text":496,"type":348,"marks":497}," automatisch elk relevant artikel op uw bedrijfsfuncties, zodat u zich op innovatie kunt richten in plaats van op handmatig kruisverwijzen.",[498],{"type":488},{"type":345,"content":500},[501],{"text":502,"type":348},"Dezelfde scoping-aanpak geldt voor andere frameworks dan de AI Act: begrijpen waar regulatoire verplichtingen aangrijpen op bedrijfsprocessen en systemen is de eerste stap in het terugdringen van dubbel werk.",{"type":373,"attrs":504,"content":505},{"level":392},[506],{"text":507,"type":348},"Stap 2: breng gaps en overlap met bestaande controls in beeld",{"type":345,"content":509},[510],{"text":511,"type":348},"Beoordeel welke vereisten uit de AI Act al door bestaande controls worden afgedekt en waar echte hiaten overblijven. Let vooral op overlap in implementatie, conflicterend eigenaarschap en terreinen waar regelgeving samenkomt, zoals dataclassificatie, incident response en derdepartijrisico. Deze stap laat zien waar nieuwe controls werkelijk nodig zijn en waar bestaande hergebruikt of uitgebreid kunnen worden.",{"type":345,"content":513},[514,518,524],{"text":515,"type":348,"marks":516},"Tip: gebruik het eigen ",[517],{"type":488},{"text":199,"type":348,"marks":519},[520,521],{"type":488},{"type":353,"attrs":522},{"href":523,"uuid":356,"anchor":356,"target":357,"linktype":12},"\u002Fservices\u002Fresponsible-ai",{"text":525,"type":348,"marks":526}," framework van ACE om de vereisten uit de AI Act tegen uw bestaande controlomgeving te leggen. Onze alignmentsessies helpen kandidaten voor hergebruik te vinden, hiaten zichtbaar te maken en verantwoordelijkheden helder te beleggen.",[527],{"type":488},{"type":373,"attrs":529,"content":530},{"level":392},[531],{"text":532,"type":348},"Stap 3: stel een voorlopige set AI-controls op",{"type":345,"content":534},[535],{"text":536,"type":348},"Ontwikkel gerichte controls alleen daar waar echte hiaten zitten. Behandel deze AI-specifieke maatregelen (zoals het testen op bias in datasets, hertrainingsfrequentie of drempels voor uitlegbaarheid) als “versie 0.9”, ontworpen om mee te bewegen met de geharmoniseerde normen. Zodra de richtsnoeren van CEN-CENELEC definitief zijn, volstaan kleine aanpassingen op deze basiscontrols.",{"type":345,"content":538},[539,543],{"text":540,"type":348,"marks":541},"Tip: gebruik de Generative Accelerator van Helia om AI-controls op te stellen en terug te koppelen aan de bijbehorende verplichtingen. Deze gerichte module levert een eerste versie op die klaar is om te verfijnen en later te rationaliseren in de bredere control library",[542],{"type":488},{"text":544,"type":348},".",{"type":373,"attrs":546,"content":547},{"level":392},[548],{"text":549,"type":348},"Stap 4: rationaliseer de controls en monitor",{"type":345,"content":551},[552],{"text":553,"type":348},"Voeg overlappende controls samen tot één traceerbaar framework dat de regulatoire herkomst vasthoudt en vereisten verbindt met de plek waar het bewijs ligt.",{"type":345,"content":555},[556],{"text":557,"type":348},"Breng bijvoorbeeld de logging-vereisten uit het eerdere voorbeeld “Logging, monitoring en incidentrapportage” samen in één control “Event logging”:",{"type":559,"content":560},"bullet_list",[561],{"type":562,"content":563},"list_item",[564],{"type":345,"content":565},[566],{"text":567,"type":348},"Richt onveranderbare, van een tijdstempel voorziene event logging in voor hoogrisico-AI-systemen, ICT-systemen die kritieke of belangrijke functies ondersteunen en systemen die persoonsgegevens verwerken onder GDPR, met vastlegging van gebruikers- en rol-ID’s, handelingen en gebeurtenissen, en geraakte data-elementen. Bewaar de logs in een repository waarin manipulatie zichtbaar wordt, houd de vastgestelde bewaartermijn aan en koppel waar nodig aan geautomatiseerde alerting of monitoring",{"type":345,"content":569},[570],{"text":571,"type":348},"Voor de overlappende regimes rond data governance is op vergelijkbare wijze een control “Data governance en integriteit” te formuleren. Dit zijn startpunten. Dezelfde ontologie van controls en bewijs kan, en zou moeten, worden uitgebreid naar frameworks als NIS2 of ISO 27001. Zo ontstaat een basis om digitale risico’s en compliance te beheersen zonder uw controls opnieuw uit te vinden bij elke nieuwe regeling.",{"type":345,"content":573},[574],{"text":575,"type":348,"marks":576},"Tip: de Control Rationalisation engine van Helia versnelt dit door de regulatoire herkomst automatisch over frameworks heen te mappen. Als onderdeel van een bredere compliance workbench biedt Helia een gezamenlijk, GenAI-gedreven platform waarin risk, data en compliance teams regulatory mapping automatiseren, control management stroomlijnen en toewerken naar doorlopende compliance.",[577],{"type":488},{"type":373,"attrs":579,"content":580},{"level":375},[581],{"text":582,"type":348}," Maak van regulatoire complexiteit een voorsprong",{"type":345,"content":584},[585],{"text":586,"type":348},"Deze geïntegreerde aanpak maakt van compliance geen kostenpost maar een voorsprong: sneller AI uitrollen, mensen en middelen gerichter inzetten en steviger risicomanagement. Door eerst de controls te rationaliseren en governance vervolgens uit te breiden zodat rollen, processen en bewijs met elkaar verbonden raken, pakken banken de AI Act op zonder er weer een compliance silo bij te bouwen.",{"type":345,"content":588},[589],{"text":590,"type":348},"De AI Act is slechts de laatste aanleiding. Banken die vandaag één governance fabric bouwen, kunnen zich sneller, slimmer en met minder dubbel werk aanpassen wanneer de volgende golf regelgeving komt. Klaar om verder te gaan dan versnipperde compliance? Neem contact op met onze experts om uw specifieke vraagstukken rond AI governance te bespreken, of vraag een demonstratie van Helia aan om geharmoniseerde control rationalisation in de praktijk te zien.","2025-08-07 09:45:57","News",{"id":594,"alt":333,"filename":595,"fieldtype":596},205752429155840,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F294177895581993\u002F1739726\u002F93394c4770\u002Fhow-to-turn-ai-governance-into-a-single-control-fabric.png","asset","Hoe u AI governance tot één control fabric maakt",{"name":599,"created_at":600,"published_at":601,"updated_at":602,"id":603,"uuid":604,"content":605,"slug":623,"full_slug":624,"sort_by_date":356,"position":625,"tag_list":626,"is_startpage":29,"parent_id":627,"meta_data":356,"group_id":628,"first_published_at":629,"release_id":356,"lang":630,"path":356,"alternates":631,"default_full_slug":356,"translated_slugs":356,"_stopResolving":15},"Janco Jordaan","2026-07-31T10:04:21.292Z","2026-08-26T07:44:28.675Z","2026-08-26T07:44:28.692Z",203991700688516,"10e7ea9e-9dd0-4f22-8f29-982994c23161",{"bio":606,"_uid":612,"name":599,"role":613,"email":614,"facts":615,"phone":616,"photo":617,"quote":620,"linkedin":621,"component":622,"quote_source":9},{"type":342,"content":607},[608],{"type":345,"content":609},[610],{"text":611,"type":348},"Janco werkt sinds 2018 bij Ace + Company en heeft binnen de managementconsultancy een bewezen staat van dienst op het gebied van portfolio- en changemanagement, datakwaliteit en governance, (business) datamodellering en het opstellen van (data)requirements.","1aafb9df-3894-42cc-b371-29cdc91b8f28","Partner","janco.jordaan@acecompany.nl",[],"06 4666 7035",{"id":618,"alt":599,"name":9,"focus":9,"title":9,"filename":619,"copyright":9,"fieldtype":596},203988219230185,"https:\u002F\u002Fa.storyblok.com\u002Ff\u002F294177895581993\u002F768x960\u002Fa317a5929f\u002Fteam-janco-jordaan.webp","Ace geeft mij het platform om echt het verschil te maken in de manier waarop onze klanten regulatory change beheersen en inrichten. Structurele oplossingen verankeren is een uitdaging die ik graag aanga.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fjanco-jordaan-847225a6\u002F","team_member","janco-jordaan","nl\u002Fteam\u002Fjanco-jordaan",-100,[],203991674748537,"20ee2aaa-9433-4ba3-957c-9e11d8ad4e5b","2026-07-31T10:04:21.331Z","nl",[],"Banken bewegen zich door een steeds complexer web van digitale regelgeving, van gegevensbescherming en operationele weerbaarheid tot AI-specifiek risicomanagement. Overlap in regelgeving is niets nieuws, maar de komst…","article","https:\u002F\u002Facecompany.nl\u002Fblog\u002Fresponsible-ai\u002Fhow-to-turn-ai-governance-into-a-single-control-fabric\u002F","how-to-turn-ai-governance-into-a-single-control-fabric","nl\u002Fnews\u002Fhow-to-turn-ai-governance-into-a-single-control-fabric",-80,[],205752346605937,"93bc4d17-6b01-47bd-ae71-690ad2974950","2026-08-05T09:28:48.503Z",[],1788359998,[645],{"name":599,"created_at":600,"published_at":601,"updated_at":602,"id":603,"uuid":604,"content":646,"slug":623,"full_slug":624,"sort_by_date":356,"position":625,"tag_list":654,"is_startpage":29,"parent_id":627,"meta_data":356,"group_id":628,"first_published_at":629,"release_id":356,"lang":630,"path":356,"alternates":655,"default_full_slug":356,"translated_slugs":356},{"bio":647,"_uid":612,"name":599,"role":613,"email":614,"facts":652,"phone":616,"photo":653,"quote":620,"linkedin":621,"component":622,"quote_source":9},{"type":342,"content":648},[649],{"type":345,"content":650},[651],{"text":611,"type":348},[],{"id":618,"alt":599,"name":9,"focus":9,"title":9,"filename":619,"copyright":9,"fieldtype":596},[],[],[],{"age":658,"cache-control":659,"connection":660,"content-encoding":661,"content-type":662,"date":663,"etag":664,"referrer-policy":665,"sb-be-version":666,"server":667,"transfer-encoding":668,"vary":669,"via":670,"x-amz-cf-id":671,"x-amz-cf-pop":672,"x-cache":673,"x-content-type-options":674,"x-frame-options":675,"x-permitted-cross-domain-policies":207,"x-request-id":676,"x-runtime":677,"x-xss-protection":678},"5002","max-age=0, public, s-maxage=604800, stale-if-error=3600","keep-alive","gzip","application\u002Fjson; charset=utf-8","Wed, 02 Sep 2026 14:40:34 GMT","W\u002F\"058440e4a095913541001ad914312c0d\"","strict-origin-when-cross-origin","5.959.0","nginx\u002F1.29.1","chunked","Origin,Accept-Encoding","1.1 0e9d65763124ffd5921e616a7b0081ce.cloudfront.net (CloudFront)","DA1s19cS0mQXP5LOGNj96dH5ZEEaHAMQl1FptWdhLvNgje1SeTECCg==","IAD55-P6","Hit from cloudfront","nosniff","SAMEORIGIN","717e9071-b246-443d-8de7-00521f3dacf2","0.061896","0",1788365036885]