Three Lines of Defence for EU AI Act Governance: Who Owns What
Apply the three-lines-of-defence model to EU AI Act governance: ops own the controls, compliance classifies and monitors, internal audit assures.
The three-lines-of-defence model is borrowed from risk management, not from the EU AI Act. Like an ethics board or an audit-readiness file, it is a governance practice — a way of allocating responsibility so that the duties the Act does impose have clear owners. Regulation (EU) 2024/1689 never uses the phrase. But it does scatter obligations across building, running, classifying and assuring AI systems, and the three-lines model is a clean way to make sure none of them is orphaned.
The core idea: separate the people who own and operate the controls from the people who set policy and monitor, and put an independent assurance function above both. Map the Act's duties onto those three layers and accountability stops being a debate.
The model, mapped to the Act
| Line | Who | Owns | AI Act duties it carries |
|---|---|---|---|
| First line | Product, engineering, operations | The controls themselves — running the system correctly | Human oversight (Art 14), logging (Art 12), using systems per instructions for use (Art 13/26), data governance in practice (Art 10) |
| Second line | Compliance, risk, legal | Policy, classification, monitoring | Risk classification (Art 6), the risk-management system (Art 9), policy, post-market monitoring oversight (Art 72), transparency rules (Art 50) |
| Third line | Internal audit | Independent assurance | Independent verification that the first two lines work; no AI Act duty of its own, but evidences the whole |
The discipline is the separation. The first line cannot mark its own homework; the second line sets the rules and watches; the third line, independent of both, periodically tests whether the system actually holds.
First line: the people running the AI
The first line is where the controls live and operate. For a high-risk system, this is the team that staffs the Article 14 human-oversight step — the human who can interpret, override or disregard the system's output — keeps the Article 12 logs, follows the instructions for use (a deployer duty under Article 26, supplied by the provider under Article 13), and applies data-governance practice (Article 10) day to day. First-line ownership matters because the Act's controls are operational, not paper: human oversight only counts if a real person performs it on real decisions.
Second line: classification, policy, monitoring
The second line — compliance, risk, often legal — owns the framework the first line operates within. It runs the Article 6 classification (is this high-risk, limited-risk or minimal?), maintains the Article 9 risk-management system as a living process, writes the AI policy, oversees post-market monitoring (Article 72), and tracks the Article 50 transparency duties. Crucially, the second line monitors the first — it is not a one-time gatekeeper but a standing oversight function. This is also where the provider/deployer role determination is made and recorded; see provider versus deployer roles.
Third line: independent assurance
The third line is internal audit, and its single defining quality is independence — it reports separately and tests both other lines without owning their work. It carries no AI Act duty of its own; its value is evidentiary. By periodically and independently verifying that human oversight is genuinely performed, that classifications are sound, and that the risk-management process is alive rather than dormant, the third line produces the assurance a board — and, if it ever comes to it, a market-surveillance authority under Article 74 — will credit. A first line that audits itself is not assurance; a third line that builds the controls is not independent.
A caution: don't over-engineer it for an SME
The three-lines model came from large financial institutions, and a 40-person company does not need three separate departments. The separation of judgment is what matters, not three org-chart boxes. In a small firm the "third line" might be a periodic review by someone outside the build-and-run team — even an external reviewer — rather than a standing internal-audit function. Apply the principle (no one assures their own work), not the bureaucracy.
The Digital Omnibus deferral the lines plan against
Most of the high-risk duties these lines carry were originally set to apply from 2 August 2026. Under the Digital Omnibus — adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, entering into force on Official Journal publication expected before 2 August 2026 — those duties are deferred to 2 December 2027 for stand-alone Annex III systems (and 2 August 2028 for Annex I product-embedded systems). The Article 5 prohibitions and Article 4 literacy duties the first and second lines already enforce have applied since 2 February 2025.
Worked example: an SME maps the three lines
Brückner Mobility GmbH, a ~240-employee fleet-software firm in Cologne with roughly EUR 52M turnover, deploys a driver-risk-scoring feature it built on a third-party model — making it the provider of that system under Article 25. It maps the lines without adding headcount. First line: the product team that runs the scoring, staffs the human-review step before any driver is flagged (Article 14), and keeps the logs (Article 12). Second line: a two-person compliance function that classified the feature as high-risk under Article 6, owns the Article 9 risk file, and monitors operation under Article 72. Third line: the company's existing internal auditor, who already reviews financial controls, adds a yearly independent check that the oversight step is genuinely performed and the classification still holds. No new department — just three distinct owners and one rule: no line assures its own work.
How Confir helps
Confir gives each line the same source of truth: it registers every AI system, classifies it under Articles 5 and 6, derives the provider/deployer role, and maps the obligations — so the second line has its classifications and risk records, the first line knows which oversight and logging duties attach to its systems, and the third line has an immutable audit log to test against. The engine is deterministic and rule-based, so an assurance review checks a reproducible record rather than reconstructing one.
Frequently asked questions
Is the three-lines-of-defence model required by the EU AI Act?
No. The model is a governance practice borrowed from risk management; Regulation (EU) 2024/1689 never uses the phrase. The Act imposes specific duties — human oversight (Article 14), risk management (Article 9), classification (Article 6), monitoring (Article 72) — and the three-lines model is one clean way to assign clear owners to them. The framework is optional; the duties are not.
What does each line own under the AI Act?
The first line (product, engineering, operations) owns and operates the controls: human oversight, logging, using systems per instructions. The second line (compliance, risk, legal) owns classification, the risk-management system, policy and monitoring. The third line (internal audit) provides independent assurance that the first two work — it carries no AI Act duty of its own but evidences the whole.
Why does the third line need to be independent?
Because assurance only means something if the assurer did not build or run what they are checking. The third line's defining quality is independence: it reports separately and tests both other lines. A first line that audits itself is not assurance, and a third line that owns the controls is not independent. That independence is what a board — or a market-surveillance authority under Article 74 — will credit.
Can a small company use the three-lines model?
Yes, but apply the principle, not the bureaucracy. The model came from large banks, and an SME does not need three departments. What matters is the separation of judgment — no one assures their own work. In a small firm the third line might be a periodic review by someone outside the build-and-run team, or an external reviewer, rather than a standing internal-audit function.
How does the model relate to provider and deployer roles?
The second line typically determines and records whether the organisation is the provider (Article 16) or deployer (Article 26) of each system — including whether Article 25 has flipped it into the provider role by branding or substantial modification. That determination then tells the first line which operational duties attach, and gives the third line a defined scope to assure against.
When do the duties these lines carry become mandatory?
Most high-risk duties were originally set to apply from 2 August 2026. Under the Digital Omnibus — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), entering into force on Official Journal publication expected before 2 August 2026 — they are deferred to 2 December 2027 for stand-alone Annex III systems (2 August 2028 for product-embedded ones). The Article 5 prohibitions and Article 4 literacy duties are already in force.
Related guides
- Article 9: the risk-management system
- Article 14: human oversight
- Provider versus deployer roles
- AI Act audit readiness
- An AI governance RACI model
- Post-market monitoring under Article 72
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →