Context
De Lijn, Belgium’s largest public transport operator, needed an AI strategy that could survive regulatory scrutiny under the incoming EU AI Act. With over 5,000 employees and operations spanning the entire Flemish region, any AI deployment would touch high-risk classification areas: public safety, accessibility, and critical infrastructure. The board required a roadmap that was not just technically sound, but governance-first — provably compliant before a single model went into production.
Regulatory Constraint
- • EU AI Act — high-risk classification for transport and public safety AI systems
- • GDPR — passenger data protection across all touchpoints
- • Flemish government oversight — public sector accountability and procurement rules
- • Board-level governance — C-suite sign-off required for every AI initiative
Architecture Decision
Governance-first roadmap with phased deployment across three horizons. Each AI initiative was classified by EU AI Act risk tier before any technical work began. The roadmap mapped every use case to its regulatory obligation, not just its business value.
- • AI risk classification matrix aligned to EU AI Act Annex III categories
- • Phased rollout: operational intelligence first, then passenger-facing, then autonomous systems
- • C-suite governance committee with quarterly review gates
- • Vendor assessment framework for third-party AI components
Governance Controls
Three-Horizon Roadmap
Internal-facing AI: route optimization, maintenance prediction, fleet management. Low-risk under EU AI Act. Quick wins that build organizational confidence and data infrastructure.
Real-time information, accessibility features, demand-responsive services. Medium-to-high risk. Requires conformity assessments and human oversight protocols.
Autonomous vehicle integration, dynamic network management. Highest risk tier. Full conformity assessment, continuous monitoring, and mandatory human-in-the-loop.
Lesson
The EU AI Act is not an obstacle — it is an architecture constraint. By classifying every AI initiative by risk tier before development, De Lijn avoided the trap of building first and retrofitting compliance later. The governance framework became the roadmap itself. The board approved a 3-year strategy with 129% projected ROI precisely because it was provably compliant from day one.