The question is no longer whether artificial intelligence will enter the business. It is who answers for the decision it helped to make.

Tomislav Vazdar, founder and CEO of Riskoria, took part in Sarajevo at the EU Danube Region Forum, on the panel “Digitalization, boost for competitiveness and growth”. He was there representing the Croatian AI Association, whose management board he sits on. The association was founded in 2019 and brings together more than three hundred members from industry, academia and the public sector, working at the intersection of artificial intelligence and wider digital transformation, in cooperation with the Ministry of Justice, Public Administration and Digital Transformation.

The pilot phase is over

What has been done in recent years under the name of a pilot project was mostly kept apart from the real work. A narrow task would be chosen, a result measured, a report written, and there it usually stopped. That phase has passed, and not because anybody decided so, but because the tools entered daily work before anyone formally introduced them.

The question therefore changes. It is no longer how well a model performs on the task from the pilot, but how it fits into real decisions, into processes that repeat every day, and into the judgement of the person who signs at the end. A tool that performs well in a pilot while nobody knows who is allowed to use it and for what is not a success but an unfinished obligation.

The gap shows up in the numbers

That gap can be measured. Recent surveys of the Croatian environment show that sixty-one percent of citizens already use generative artificial intelligence tools, while only thirteen percent of organisations have a formal strategy for artificial intelligence. Put another way, people adopted the tools themselves while institutions are still deciding whether to adopt them.

This is not merely a documentation problem. Once an employee types work data into a service nobody has checked for where it stores that data and for how long, the organisation has already taken on the risk, it simply has not written it down. The first step is therefore not a ban, which does not work anyway, but an inventory: which tools are in use, who uses them and with what data.

The challenge is governance, not technology

What Vazdar put to the panel comes down to technology being the easy part. The hard part is answering who approves a use, which decisions may be automated and which never, how anybody recognises that a model’s output is wrong, and who carries the consequence when the error occurs. Without those answers, adoption amounts to hoping it all goes well.

The reverse holds too. An organisation that has those answers can move faster, because it does not have to stop at every new use case. Governance here is not a brake but the thing that makes it safe to accelerate. For organisations covered by the Cyber Security Act part of this already exists as an obligation, and how it relates to the AI Act is described on the page about the AI Act.

Three questions that settle most of it

A board that does not know where to start can begin with three questions, and without a consultant. First: where in our work is a decision taken on the basis of what a model proposed, with a person merely confirming it. Such places are usually not where anyone expects them, but in drafting an offer, in sorting incoming enquiries and in choosing who gets called first.

Second: what happens when an output is wrong and nobody notices the same day. If the answer is that nothing happens, the risk is low and the work can proceed. Third: which data leaves the building for the tool to function at all. Answers to those three produce a list of places to put in order, and that list is almost always shorter than feared.

Where the Croatian framework stands

The panel also heard that Croatia is completing work on a national framework for artificial intelligence, with an emphasis on innovation, digitalisation, advanced skills and strong data protection. It takes the form of a national development plan with a horizon to 2032 and an accompanying action plan, prepared through a working group of around a hundred experts drawn from dozens of organisations.

The message the association brought was that progress and trust are not opposed. A framework offering only incentives, without accountability, fails to create the confidence institutions need before they genuinely adopt these tools. A framework offering only obligations, without investment in skills, buys compliance on paper and nothing more.

Why Sarajevo suited this conversation

A regional gathering has one advantage large European events rarely offer. Participants come from places comparable in size and in budget, so the discussion is not about what somebody would do with unlimited means, but about what can be done now, with the people already in post.

Sarajevo also lends a conversation about the future a sense of proportion that is hard to describe and easy to recognise. A city carrying what this one carries does not let anyone talk about technology as though everything came down to choosing a tool. That is a useful reminder for a profession that easily gets lost in its own vocabulary. What Riskoria speaks about at events is described on the page about keynotes and conferences.