EU AI Act × Resource Governance

1. Why this guide exists

Two conversations have run in parallel and never met. One is AI compliance — the EU AI Act, GDPR, ISO/IEC 42001, the machinery of risk classification, documentation and conformity. The other is AI sustainability — the energy, water and compute that AI now consumes, treated as a corporate-responsibility footnote.

They are the same problem. AI's physical-resource footprint is quietly becoming a governance, due-diligence and disclosure obligation — written into the AI Act's documentation duties, the Energy Efficiency Directive's data-centre reporting scheme, the CSRD's sustainability standards, the EU Taxonomy and the NIS2/CER resilience regimes. The professional who treats "how much energy and water does this AI consume, and who is accountable for it?" as a compliance question — not a CSR one — is ahead of both conversations.

This guide maps where the physical-resource constraint enters existing law, and gives a practical lens — the PSR³ nexus — for operationalising it. It is the companion to the evidence brief The Coupled Constraint; that brief argues the coupling, this guide governs it.

2. The coupling, in one page

The premise is not ideological, it is physical:

• Compute drives energy. The IEA's Energy and AI analysis (2025) projects data-centre electricity demand rising steeply through 2030, with AI the primary driver — a material new load on already-constrained grids.
• Energy drives water. Data centres consume water directly (evaporative cooling) and indirectly (thermoelectric power generation). Li, Yang & Ren's Making AI Less "Thirsty" (2023) put concrete numbers on the direct and indirect water cost of training and serving large models — figures that scale with every inference.
• The constraint is local. Grid capacity and water stress are regional. An AI deployment that is trivial in one location is a siting, permitting and resilience problem in another.

The consequence for governance: an AI system's compliance profile now has a physical dimension — one that regulators, auditors, insurers and procurement functions are beginning to ask about, and in several regimes already require to be measured and disclosed.

3. The regulatory map — where resource governance already bites

3.1 EU AI Act — the resource footprint is already in the documentation

Read-through: the AI Act does not yet impose an energy cap, but it already makes energy and compute a documented, disclosable attribute of a GPAI model — and Art. 40 / Art. 112 signal that resource performance is on the path to binding measurement.

3.2 The reporting regimes that already require the numbers

3.3 The governance frameworks that let you own it

4. The PSR³ nexus lens

One question runs through the whole method — "what does this consume, and who is accountable for it?" — applied at five gates across the AI lifecycle:

• Gate 1 — Procurement & vendor selection: where resource transparency is either secured or lost.
• Gate 2 — Model lifecycle (train / deploy / monitor): where the energy and compute footprint is set, and where inference quietly compounds it.
• Gate 3 — Impact assessment (DPIA / FRIA / ISO 42001): where the resource dimension becomes documented and auditable.
• Gate 4 — Siting & infrastructure: where water stress, grid capacity and critical-infrastructure dependence become real risk.
• Gate 5 — Disclosure: where what you measured meets CSRD, Taxonomy and EED.

The PSR³ nexus is simply this: legal compliance, technical implementation and physical-resource governance treated as one frame, not three silos.

5. From map to method

The map above is public; the method is not. Operationalising it — the gate-by-gate questions, the evidence to obtain, the due-diligence checklist and the named-owner model — is delivered inside an engagement, tailored to the organisation's AI estate and sector. If that is relevant to you, I'm glad to talk.

6. Why now

The Digital Omnibus (Reg. (EU) 2026/1744) moved the AI Act's high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). That did not remove the work — it extended the window to build an audit-ready governance function before the deadline and before the talent pool tightens. Meanwhile the reporting regimes are already live: EED data-centre reporting since May 2025, CSRD phasing in, Taxonomy alignment being tested now. The organisations that will be ready in 2027–2028 are building the physical-resource dimension into their AI governance today — while it is still a differentiator rather than a scramble.