Welcome to the 13th issue of AI Governance Today. If previous months were defined by regulatory architecture, this week was defined by geopolitical alignment. AI governance is moving from compliance frameworks and risk classifications to a contest over influence, investment, and global norm-setting. From New Delhi’s AI Impact Summit to escalating enforcement actions in Europe and strategic positioning in Washington, the center of gravity is shifting. Governance goes beyond managing AI systems. It involves shaping the global rules and systems that determine how AI operates and influences the world.

TL;DR For The Week

• India’s AI Impact Summit put geopolitics at the center of governance, positioning AI oversight as a contest over influence, alliances, and industrial advantage, not just risk frameworks.

• The Delhi Declaration gathered 80+ countries behind principles like equitable access, transparency, and human oversight, signaling broad alignment without binding enforcement.

• The U.S. reiterated resistance to centralized global AI oversight, reinforcing a governance path built around national flexibility, agency control, and bilateral/multilateral partnerships rather than a global authority.

• Europe’s enforcement posture sharpened through existing law, with Spain opening a criminal probe into major platforms over alleged AI-generated child abuse content, escalating platform accountability for AI outputs.

• Enforcement pressure is rising on generative harms, as reports of AI-generated illegal imagery increase and authorities signal tougher scrutiny and safeguards expectations.

• National security governance intensified, with Anthropic negotiating DoD terms that spotlight the collision between military demand, corporate safety commitments, and acceptable-use boundaries.

• Governance is being negotiated through capital and infrastructure, highlighted by Microsoft’s $50B Global South AI investment push, tying access, capability-building, and standards influence together.

• Public legitimacy became a governance variable, as the U.S. “botlash” gained momentum, showing how civic backlash can shape regulatory appetite and political narratives.

• Tech’s political engagement continued to expand globally, with industry actors increasingly shaping AI policy agendas, not just responding to them.

Spotlight

India’s AI Impact Summit Signals a New Axis of Global Influence

This past week marked a pivotal shift in the geopolitics of AI governance, far beyond technical standards and high-risk classifications. The India AI Impact Summit 2026 in New Delhi crystallized a growing reality: AI governance is now as much about strategic power, alliances, and economic competition as it is about risk management.

For the first time, the global AI agenda was convened in the Global South with nearly 90 countries and international organizations endorsing a collective vision for AI’s future, a declaration built around equity, inclusive cooperation, and shared benefits, but also shaped by geopolitical undercurrents. What’s emerging isn’t a singular regulatory model, but a multipolar governance ecosystem where national strategies, diplomatic alignments, and economic imperatives intersect.

Unlike previous summits, notably the UK’s safety-focused gathering in 2023 or France’s AI Action Summit in 2025, New Delhi’s forum was explicitly positioned as a “global AI governance and impact” conversation hosted by a middle power charting its own path. The event brought together heads of state, major AI CEOs, and multilateral actors under a banner of shared prosperity through technology, rather than top-down enforcement.

This matters for several reasons:

1. A Broader Global Consensus (But Not a Uniform Model)
The New Delhi Declaration was backed by 88+ countries and international bodies, including major powers across different blocs, the United States, China, Russia, the EU and numerous developing nations, signaling unusually broad participation in a global AI governance initiative. The declaration’s seven pillars emphasize equitable access, secure and trusted systems, human capital development, and resilient innovation.

This broad endorsement suggests AI governance will not be defined by a single dominant standard, but by negotiated coalitions that balance national priorities, economic interests, and ethical norms.

2. Geopolitical Alignment Through Partnerships
India used the summit to anchor itself within emerging technology coalitions, including participation in the U.S.-led Pax Silica initiative and infrastructure commitments with major players like OpenAI, Google, Microsoft and Amazon. This aligns India closer to Western tech ecosystems while still championing the Global South perspective, positioning AI governance as both a strategic partnership and a national development priority.

3. Divergence Between Governance Goals and Regulatory Enforcement
While the declaration emphasizes cooperation and inclusive development, it is not a binding regulatory framework; it stops short of harmonized enforceable rules. This contrasts sharply with the EU AI Act’s tightening high-risk perimeters and enforcement mechanisms, highlighting a geopolitical divide in governance approaches:

• EU model: rule-based compliance with stiff penalties

• India/global consensus model: voluntary principles with broad participation

• U.S. stance: resistance to centralized global governance in favor of flexible bilateral or multilateral partnerships

4. Economic and Competitive Stakes Are Front and Center
The summit was as much about investment and industrial strategy as it was about principles. India and its partners signaled hundreds of billions of dollars in AI infrastructure plans and technology commitments, underscoring that governance now intertwines with economic diplomacy and competitiveness.

5. Soft Power and Narrative Control
India’s messaging from Prime Minister Narendra Modi’s emphasis on human-centric AI to the summit’s guiding principle of “Sarvajan Hitaya, Sarvajan Sukhaya” (welfare and happiness for all) illustrates how nations now use AI governance forums to project values and influence global norms around equity, inclusivity, and technological sovereignty.

Key Takeaways:

• AI governance is entering the realm of geopolitical contestation. It is no longer a siloed regulatory policy domain; it is embedded in strategic alliances, economic competition, and diplomatic influence.

• Global South voices are shaping the narrative. India’s summit marked the first time a major AI governance forum was hosted in and driven by a middle-power nation with global participation.

• Multipolar governance frameworks will likely coexist. EU enforcement regimes, U.S. flexible partnerships, and broad consensus declarations like New Delhi’s sketch an ecosystem where cooperation and competition are both drivers.

• Economic clout and policy influence are now inseparable. Investment pledges and tech alliances at the summit point to governance being negotiated alongside infrastructure, capacity building, and market access.

• Declarations matter but enforceable rules are still contested. The New Delhi Declaration builds political momentum, but real regulatory and compliance regimes will be shaped through future summits, bilateral agreements, and regional strategies.

Policy Radar: Regional and Global Governance Shifts

1. Spain Opens Criminal Probe Into AI-Generated Child Abuse Content

Region: European Union (Spain)

Spanish authorities have launched a criminal investigation into X (formerly Twitter), Meta, and TikTok over alleged circulation of AI-generated child sexual abuse material. Prosecutors are examining whether platforms failed to prevent algorithmic amplification and distribution of harmful synthetic content. This marks a significant escalation: existing criminal law is being directly applied to AI-generated outputs, not merely platform moderation practices.

2. Delhi Declaration Advances Multilateral AI Governance Principles

Region: India / Global

More than 80 countries endorsed the Delhi Declaration at the India AI Impact Summit, calling for democratic, inclusive, and equitable AI development. The declaration emphasizes transparency, human oversight, and responsible innovation, reflecting growing multilateral coordination efforts. While non-binding, the declaration signals continued momentum toward globally aligned AI governance norms.

3. U.S. Signals Resistance to Centralized Global AI Oversight

Region: United States

At the India AI Impact Summit, U.S. officials reiterated opposition to establishing a centralized global AI governance authority. The position underscores Washington’s preference for national regulatory flexibility and sector-specific oversight rather than treaty-based international governance. The divide reflects broader geopolitical tensions over who sets global AI rules.

4. Anthropic Negotiates AI Use Terms With U.S. Department of Defense

Region: United States

Anthropic is reportedly engaged in high-level negotiations with the U.S. Department of Defense over military deployment conditions for its models. The company has resisted provisions that could permit mass surveillance or autonomous weapons use.

The episode highlights intensifying governance tensions between national security interests and corporate AI safety commitments.

5. Microsoft Announces $50B Global South AI Investment Push

Region: Global (Emerging Markets)

Microsoft announced plans to invest approximately $50 billion through the decade to expand AI infrastructure and capabilities in emerging markets. The initiative includes compute infrastructure, skilling programs, and ecosystem development.

Large-scale corporate investment strategies are increasingly shaping the governance landscape by influencing standards, infrastructure access, and geopolitical alignment.

6. Public “Botlash” Movement Gains Momentum in the U.S.

Region: United States

A growing civic backlash against AI deployment, referred to as “botlash”, is gaining visibility in the U.S. Activists and community groups are raising concerns about privacy, labor displacement, and unchecked automation.

While not regulatory in itself, sustained civic pressure can shape legislative priorities and enforcement appetite in 2026.

7. Tech Industry Expands Political Influence in AI Policy Debates

Region: Global

Technology companies are intensifying political engagement around AI governance, both domestically and internationally. Industry-backed advocacy efforts are increasing alongside global AI summits and regulatory negotiations.

This trend signals that corporate actors are not merely responding to regulation — they are actively shaping its trajectory.

8. Surge in AI-Generated Harm Content Reports Raises Enforcement Pressure

Region: United States / Europe

Authorities have reported a significant rise in AI-generated illegal imagery cases, increasing pressure on platforms and developers to implement stronger safeguards. Law enforcement agencies are signaling stricter scrutiny of generative model misuse. The enforcement focus is shifting from theoretical risk to active prosecution.

Framework Focus

The Three Competing Models of AI Governance

AI governance is no longer converging toward a single global standard. Instead, three distinct models are taking shape, each reflecting different political priorities and strategic objectives. The India AI Impact Summit did more than produce a declaration; it clarified that AI oversight is becoming multipolar.

The European Union represents the first model: regulatory discipline. Through the EU AI Act, governance is binding, risk-based, and enforcement-driven. Classification determines obligations, conformity assessments are mandatory, and penalties are significant. Trust is built through codified compliance and supervisory authority.

The United States reflects a second model: executive and procurement-led governance. Rather than a single comprehensive AI statute, oversight flows through agency mandates, federal guidance, contractual leverage, and national security framing. This approach prioritizes flexibility and strategic control while resisting centralized global oversight structures.

India’s approach, highlighted at the AI Impact Summit, represents a third model: strategic development governance. Here, AI governance is framed as economic infrastructure. The emphasis is on capability-building, inclusive growth, coalition formation, and international alignment rather than immediate enforcement. Principles precede penalties, and governance is embedded within national development strategy.

These models are not identical, nor are they converging. One centers on regulatory discipline, another on operational control, and the third on developmental strategy. For enterprises operating globally, this means AI governance is no longer just a compliance function. It is a geopolitical variable.

The future of AI oversight will likely be shaped not by a single dominant framework, but by the coexistence and competition of these three approaches.

Looking Ahead

• European Commission AI Act Implementation Workshop

  Region: European Union | Expected: March 2026
  The European Commission is continuing stakeholder engagement sessions focused on high-risk system classification and conformity assessment capacity. These workshops are increasingly important as companies prepare for documentation and supervisory scrutiny under Article 6 classifications.

• IAPP Global Summit 2026: Privacy | Washington, D.C., USA

  Date: March 30–April 2, 2026
  A flagship IAPP event on digital responsibility and governance. Sessions span operational AI policy implementation, vendor risk, compliance frameworks, international enforcement trends, and practical case studies on governance program scaling.

• HumanX 2026 | San Francisco, USA

  Date: April 6–9, 2026
  One of the largest independent AI conferences globally, featuring executives, technologists, policymakers, and investors. While not exclusively governance-focused, HumanX is essential for anyone tracking the intersection of AI regulation, business adoption, and strategy, with sessions on ethical deployment, trust frameworks, and real-world impact.

Closing Thoughts

AI governance is entering a new phase. Declarations, enforcement actions, investment pledges, and defense negotiations are no longer isolated developments; they reflect a broader structural shift. Regulation is increasingly intertwined with economic strategy, industrial policy, and international alignment.

As governance models diverge across regions, organizations must think beyond compliance checklists. The ability to operate across different regulatory philosophies and anticipate where expectations are tightening will define leadership in this next phase.

As AI governance evolves across regions, one question should guide every boardroom discussion: are you preparing for isolated regulatory requirements, or for a world of competing governance frameworks?

Until next week,
The AI Governance Today

Welcome to the 12th issue of AI Governance Today. If the last few months were about building AI governance frameworks, the past three weeks have been about drawing boundaries. From Brussels to Tokyo to Washington, regulators are moving beyond broad principles and into operational clarity, defining who falls within high-risk categories, how accountability will be demonstrated, and what evidence organizations must be prepared to produce.

TL;DR For The Week

• The EU AI Act has entered its classification phase, Article 6 high-risk definitions are moving from abstract interpretation to practical enforcement triage.

• High-risk designation now clearly triggers conformity assessments, documentation obligations, incident reporting, and fines up to €35M or 7% of global turnover.

• Enterprises must accelerate AI inventory mapping and risk classification as interpretive flexibility narrows.

• Conformity assessment capacity may become a 2026 bottleneck.

• EU Member States are strengthening supervisory coordination ahead of active cross-border enforcement.

• U.S. federal agencies continue advancing operational AI accountability through structured impact and oversight mandates.

• Japan’s 2026 AI Basic Plan positions governance as economic infrastructure — prioritizing capability-building and adaptive oversight.

• The UK AI Safety Institute has begun structured model evaluations, signaling a more formalized safety testing regime.

• Financial regulators globally are raising concerns about autonomous and agentic AI systems.

• Existing laws (e.g., GDPR) are increasingly being used to enforce AI content accountability.

Spotlight

The High-Risk Line Is Being Drawn: EU AI Act Moves From Text to Triage

Between January 27 and mid-February, the European AI governance conversation shifted in a subtle but decisive way. The debate is no longer about what the EU AI Act intends to regulate. It is now about who falls inside the high-risk perimeter and what that means in operational terms.

Article 6 of the EU AI Act defines when an AI system qualifies as “high-risk.” Until recently, many organizations relied on broad interpretation and cautious internal mapping. But regulators are now moving toward more concrete implementation guidance, narrowing ambiguity around sectoral examples and use-case thresholds.

This matters because classification determines compliance gravity.

High-risk designation triggers:

• Mandatory conformity assessments

• Robust technical documentation requirements

• Post-market monitoring obligations

• Incident reporting to authorities

• Human oversight safeguards

• Board-level accountability exposure

• Fines up to €35M or 7% of global turnover

In other words, misclassification is no longer a theoretical compliance risk. It is a material governance failure.

Several use-case categories are emerging as focal points for scrutiny:

• AI used in recruitment and worker evaluation

• Biometric identification and categorization systems

• Creditworthiness and financial risk scoring tools

• AI in public administration decision-making

• Systems affecting access to essential services

The practical shift underway is from principle to triage.

Enterprises are now confronting three urgent realities:

1. AI Inventory Mapping Is No Longer Optional

Organizations must maintain a defensible registry of all AI systems, broken down by function, deployment context, and risk exposure. Composite systems are being decomposed into sub-functions to determine whether specific components independently trigger high-risk classification.

2. Documentation Debt Is Surfacing

Many AI deployments preceded structured governance documentation. As classification lines sharpen, companies are retrofitting traceability — including training data summaries, model evaluation records, and decision log retention policies.

3. Conformity Capacity May Become a Bottleneck

Notified bodies and certification mechanisms are limited. As more systems are formally categorized high-risk, conformity assessment queues could become a significant operational choke point later in 2026.

What makes this moment significant is not that the law changed. It is that the interpretive margin is shrinking.

For multinational enterprises, the EU’s clarification phase has a cascading effect. Internal AI governance programs built for “future enforcement” are now being stress-tested against near-term supervisory expectations. Boards are asking different questions. Risk committees are requesting classification briefings. Procurement teams are inserting AI compliance representations into vendor contracts.

The EU has moved from drafting rules to drawing lines. And once lines are drawn, regulators expect evidence. The next phase of the AI Act will not be defined by philosophical debates about risk. It will be defined by whether organisations can demonstrate in a structured, auditable form that they understand where their systems fall on the spectrum.

The era of interpretive comfort is ending.

The era of classification accountability has begun.

Policy Radar: Regional and Global Governance Shifts

1. EU Member States Move Toward Supervisory Coordination

Region: European Union
Germany, France, and other EU Member States are accelerating work on national AI supervisory structures and coordination as the EU AI Act enters operational phases. National authorities are preparing oversight frameworks and refining roles for enforcement and audits under the bloc’s risk-based regime.

2. U.S. Federal Agencies Advance Operational AI Accountability

Region: United States
Federal AI governance guidance continues to evolve within the executive branch. Memoranda from the Office of Management and Budget (OMB) emphasize structured impact assessments, human review mandates, transparency practices, and risk monitoring for agency AI use, shaping compliance expectations ahead of formal legislation.

3. Japan Strengthens Transparency and Public Sector AI Controls

Region: Japan
Japan’s ongoing AI governance strategy includes updates to procurement standards and transparency expectations for public-sector AI deployments. While largely principle-based, the focus on explainability, accountability, and public trust signals a more operational governance approach in the Asia-Pacific.

4. UK AI Safety Institute Begins Structured Model Evaluations

Region: United Kingdom
The UK AI Safety Institute, now on a statutory trajectory, has started formal evaluation engagements with advanced model developers. These structured assessments include pre-release and scenario-based testing frameworks aimed at improving safety without punitive enforcement as a first resort.

5. Financial Regulators Raise Concerns Over Autonomous Agents

Region: Global
Regulatory bodies, including U.S. and UK financial authorities, are flagging risks associated with autonomous and agentic AI systems in trading, advisory bots, and related functions. Firms are being urged to assess oversight, auditability, and human control as agents expand beyond traditional automation.

6. EU Privacy Watchdog Probes AI-Generated Content Risks

Region: European Union
The Irish Data Protection Commission launched an investigation into X (formerly Twitter) over AI-generated sexualized imagery, applying GDPR and content safety expectations to AI outputs. This highlights how existing privacy and safety laws are being used to enforce responsible AI content practices.

7. India Hosts AI Impact Summit and Pushes Platform Accountability

Region: India / Global
India’s AI Impact Summit in New Delhi brought global leaders together to discuss governance centered on societal impact and inclusive innovation. Subsequently, the Indian government also signaled tougher accountability demands on tech platforms regarding constitution-aligned content moderation and AI usage.

8. Anthropic Commits $20M to AI Policy Advocacy

Region: Private Sector / United States
AI developer Anthropic announced a $20 million initiative to support bipartisan policy advocacy, signalling increased industry engagement in shaping governance frameworks, transparency norms, and responsible deployment standards at the national level.

Framework Focus

Japan’s 2026 AI Basic Plan: Governance as Economic Infrastructure

While much of the global AI governance debate centers on risk containment, Japan’s newly approved Artificial Intelligence Basic Plan (2026) frames AI governance as a pillar of national competitiveness.

Adopted by Cabinet decision at the end of December 2025, the Plan establishes Japan’s first consolidated national AI strategy under a statutory framework. Rather than introducing punitive controls, it outlines a coordinated, whole-of-government roadmap designed to accelerate AI deployment while embedding trust, accountability, and international alignment.

What distinguishes Japan’s approach is its integration of governance into economic strategy.

The Plan rests on three structural pillars:

1. Accelerated AI Utilization Across Society

The government commits to leading by example, expanding AI adoption across public administration, healthcare, disaster management, infrastructure, and education. AI is positioned not merely as a technological upgrade but as a tool for addressing demographic pressures, productivity stagnation, and labour shortages.

Unlike purely regulatory frameworks, Japan’s model treats AI deployment itself as a public policy objective.

2. Strengthening Domestic AI Capabilities

The Plan emphasizes investment in foundational AI capabilities, compute infrastructure, data environments, research ecosystems, and talent pipelines. Startups and domestic innovation capacity receive particular attention, reflecting concern that Japan has lagged behind the U.S. and China in frontier AI development.

Governance, in this context, is meant to create predictability that encourages investment rather than deterring it.

3. Leading AI Governance and International Norm-Setting

Japan explicitly positions itself as a contributor to global AI governance architecture. The Plan reinforces transparency, explainability, and accountability principles while aligning with risk-based approaches emerging in Europe and elsewhere.

However, Japan’s tone remains principle-driven rather than enforcement-heavy. Instead of immediate fines or sanctions structures, the framework emphasizes guidance, public trust, and iterative refinement.

The Operational Dimension: PDCA Governance

One of the most important elements of the Plan is its commitment to a continuous PDCA (Plan–Do–Check–Act) cycle.

This signals that Japan views AI governance as dynamic. Policies will be evaluated, adjusted, and updated as technology evolves. Rather than a static compliance regime, the framework anticipates adaptive oversight.

For enterprises, this creates both flexibility and expectation. Organizations operating in Japan should anticipate increasing clarity around:

• Public sector AI procurement standards

• Transparency expectations in government-linked deployments

• Human oversight structures

• Documentation practices for explainability and accountability

While the Plan does not introduce immediate high-penalty enforcement mechanisms, it lays the foundation for progressively structured oversight.

Japan’s AI Basic Plan illustrates a third governance model emerging alongside the EU’s enforcement-heavy risk classification system and the U.S.’s procurement-driven oversight.

If the EU model is regulatory discipline, and the U.S. model is executive governance through agency control, Japan’s model is strategic governance as economic policy.

It treats trust not as a constraint on innovation, but as infrastructure for it.

As AI governance frameworks mature worldwide, Japan’s approach demonstrates that regulation does not always begin with restriction. It can begin with coordination, capability-building, and international alignment, with enforcement evolving gradually over time.

The long-term question will be whether principle-based governance can scale as AI systems become more autonomous and higher impact.

For now, Japan has made clear that in its view, AI governance is not a brake on growth. It is the architecture that enables it.

Looking Ahead

• IAPP UK Intensive 2026: Privacy | London, UK

  Date: February 23–26, 2026
  Hosted by the International Association of Privacy Professionals, this intensive conference delves into emerging AI regulation, privacy obligations, risk management, and evolving compliance frameworks in Europe and the UK, ideal preparation as the EU AI Act high-risk rules mature.

• IAPP Global Summit 2026: Privacy | Washington, D.C., USA

  Date: March 30–April 2, 2026
  A flagship IAPP event on digital responsibility and governance. Sessions span operational AI policy implementation, vendor risk, compliance frameworks, international enforcement trends, and practical case studies on governance program scaling.

• HumanX 2026 | San Francisco, USA

  Date: April 6–9, 2026
  One of the largest independent AI conferences globally, featuring executives, technologists, policymakers, and investors. While not exclusively governance-focused, HumanX is essential for anyone tracking the intersection of AI regulation, business adoption, and strategy, with sessions on ethical deployment, trust frameworks, and real-world impact.

Closing Thoughts

Across jurisdictions, one pattern is becoming unmistakable: governance is no longer about signaling responsibility, it is about proving it. Classification lines are sharpening, supervisory coordination is strengthening, and documentation expectations are becoming operational realities. The organizations that will lead in this new phase are not those waiting for regulatory perfection, but those building AI systems designed to withstand scrutiny from day one. As enforcement moves from principle to practice, one question should sit at the centre of every AI strategy discussion: if a regulator asked you tomorrow to justify your system’s risk classification, could you prove it?

Until next week,
The AI Governance Today

Welcome to the 11th issue of AI Governance Today. If last week was defined by the first wave of deepfake enforcement, this week marks a decisive shift from "what is the AI saying?" to "what is the AI doing?" As we cross into late January, the era of theoretical risk has ended. With South Korea enacting the world’s first comprehensive AI framework and Finland igniting the first national sanctions board under the EU AI Act, regulators are no longer waiting for accidents to happen before stepping in. We are moving into a period of operational duty of care, where governance is no longer a pre-launch checklist but a real-time, auditable requirement for autonomous agents and judicial systems alike.

TL;DR For The Week

• South Korea enforces its AI Basic Act, establishing a national framework for AI governance.

• The law requires high-impact AI oversight and human-in-the-loop safeguards.

• Mandatory labeling of AI-generated content is enforced to prevent misrepresentation.

• Transparency obligations require disclosure of AI involvement in decision-making.

• Compliance includes risk management frameworks, traceable decision logs, and incident reporting.

• Guidance platforms, consultation support, and government-linked incentives help organizations comply.

• U.S. judges form a Judicial AI Consortium to address courtroom AI risks.

• Finland activates EU AI Act enforcement for high-risk AI systems.

• California’s Companion AI guardrails (SB 243) go live.

• The UK formalizes the AI Safety Institute with statutory powers.

Spotlight

South Korea’s AI Basic Act Marks a New Phase in Global AI Governance

South Korea’s AI Basic Act came into force in January 2026, positioning the country as one of the first to implement a comprehensive national framework for artificial intelligence oversight. The legislation brings together safety, transparency, and accountability obligations under a single legal foundation and has drawn global attention precisely because it is being enforced sooner than similar frameworks elsewhere.

At its core, the Basic Act aims to balance innovation with trust. The law mandates human oversight for high-impact AI applications, enforces clear labelling requirements for AI-generated content, and introduces transparency obligations for system operators. Penalties for non-compliance can reach up to 30 million won, although authorities have provided a grace period of at least one year before fines are imposed to allow industry time to adapt.

This regulatory leap has drawn a range of responses from the domestic tech ecosystem. Larger firms with established compliance teams are better positioned to interpret and implement the new requirements, while startups and smaller players have raised concerns about vague definitions—especially around “high-impact AI”, and the potential for regulatory burden to slow innovation.

The government has responded with support measures, including planning guidance platforms and assistance centres to help organisations understand and comply with the new regime. These efforts reflect an intent to soften the transition from policy to enforcement while reinforcing the law’s foundational goals of safe and trustworthy AI.

Viewed from outside Korea, the Basic Act illustrates a practical test case for how comprehensive AI governance can be enacted in a national context. Its early implementation highlights a broader trend in which governments are experimenting with mechanisms to regulate AI rapidly, yet thoughtfully, in response to emerging social and economic risks. For the global AI governance community, South Korea’s experience offers an instructive example of the real world challenges and opportunities inherent in moving from aspiration to enforcement.

Policy Radar: Regional and Global Governance Shifts

1. South Korea Enacts World’s First Comprehensive AI Basic Act

Region: South Korea

On January 22, 2026, South Korea made history as the first nation to enforce a comprehensive, standalone AI law. The AI Basic Act creates a unified legal framework for the entire AI lifecycle. Key mandates include:

• Watermarking: Compulsory labeling for all generative content to combat deepfakes.

• High-Impact Audits: Strict safety and reliability documentation for AI used in “essential” sectors like healthcare, finance, and energy.

• National Oversight: A new National AI Committee with the power to issue corrective orders and substantial fines.

2. U.S. Judges Form Consortium to Tackle Courtroom AI Risks

Region: United States

A new Judicial AI Consortium, composed of state and federal judges, has formed to establish “Rules of the Road” for AI in legal settings. Disturbed by the rise of AI hallucinations (fake case citations and fabricated evidence) in court filings, the group is developing best practices for judge-led verification. The move signals that the judiciary will no longer wait for federal legislation to protect the integrity of the record.

3. Finland Activates EU AI Act Enforcement Mechanisms

Region: European Union

While much of the EU AI Act remains in a staggered rollout, Finland became the first member state to activate its national Sanctions Board this week. This board is now empowered to audit “High-Risk” AI inventories. Finnish regulators have signaled they will prioritize the investigation of algorithmic bias in recruitment tools, setting the precedent for the massive fines (up to €35M or 7% of revenue) allowed under the Act.

4. California’s “Companion AI” Guardrails Go Live (SB 243)

Region: United States (State-Level)

Effective this week, California’s Companion Chatbots Act now governs AI systems designed for “relational” engagement. Developers must now provide continuous disclosure (reminding users the bot is not human during long sessions) and must implement mandatory intervention triggers for users expressing self-harm intent. For minors, “immersion interrupts” are now required to prevent emotional dependence on AI entities.

5. UK Moves to Statutory Footing for AI Safety Institute

Region: United Kingdom

Following the scrutiny of platforms like X (formerly Twitter) for deepfake generation, the UK government is moving to place the AI Safety Institute on a permanent statutory footing. This would grant the Institute formal powers to request pre-release access to the “most powerful” models for safety testing, shifting the UK from a purely “voluntary” safety regime to a more structured, enforceable model.

Framework Focus

South Korea AI Basic Act: Structural and Operational Deep Dive

South Korea’s AI Basic Act, formally the Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trustworthiness, provides a comprehensive governance framework for AI systems in the country. The law applies to all AI deployed or operated domestically, with a particular focus on high-impact AI applications such as healthcare, transportation, finance, public decision-making, and critical infrastructure. These systems are considered high-impact because they can affect human safety, fundamental rights, or essential services.

The Act establishes a multi-tiered institutional structure:

• The National AI Committee provides strategic guidance, coordinates national policy, and sets technical standards.

• Sector-specific authorities oversee enforcement within their respective domains, ensuring compliance aligns with sectoral risk and context.

This model balances central coordination with domain expertise, allowing authorities to evaluate AI risks in context while maintaining consistent national oversight.

Organizations deploying high-impact AI systems must implement comprehensive compliance measures including:

• Risk management frameworks covering system design, deployment, and post-deployment monitoring

• Human oversight mechanisms to prevent or mitigate harm

• Technical documentation and traceable decision logs for regulatory audits

• Incident reporting procedures to notify authorities of system failures or adverse outcomes

These obligations embed accountability into both the design and operational phases of AI, making compliance measurable and auditable.

Transparency obligations are also central to the framework:

• Providers must label AI-generated content to prevent misrepresentation.

• Organizations must disclose AI involvement in decision-making processes that affect users.

• Traceable records of system behavior must be maintained to allow regulatory and user verification.

This focus on clarity and documentation fosters trust and ensures AI deployments can be evaluated in real-world conditions.

The Act pairs enforceable obligations with support measures:

• Administrative fines can reach 30 million won, but a grace period allows organizations time to comply.

• Authorities provide guidance platforms, compliance toolkits, and consultation support.

• Compliance is linked to eligibility for government-funded AI research and infrastructure programs, incentivizing adherence while promoting innovation.

Finally, the law aligns with international AI governance standards, reflecting risk-based classification, human oversight, and transparency principles similar to the EU AI Act. South Korea’s approach demonstrates how a national framework can translate high-level principles into operational and auditable governance, providing a model for other countries implementing AI regulation.

Looking Ahead

• The “High-Risk” Deadline (Feb 2, 2026)

  The European Commission was expected to release its definitive guidelines on the practical implementation of Article 6 of the EU AI Act. It could be delayed though. This is a critical milestone for any organization deploying AI in Europe, as it will finally provide the “concrete examples” of what qualifies as high-risk versus low-risk, effectively setting the compliance roadmap for the rest of the year.

• IAPP UK Intensive: AI Governance - London (Feb 23–26, 2026)

  Privacy and AI governance leaders will gather in London to deconstruct the first month of “active enforcement” under the UK’s Online Safety Act and the EU AI Act. This event will likely produce the first “lessons learned” from the Finnish and British regulatory inquiries we saw this week.

• Agentic AI Transformation Summit - Miami (Feb 2–4, 2026)

  As governance moves toward AI Agents, this summit will be the ground zero for discussing “Autonomous Accountability.” It will focus on how enterprises can move agents into production while maintaining the “human-in-the-loop” safeguards demanded by the new South Korean and California laws.

Closing Thoughts

South Korea’s AI Basic Act illustrates how quickly ambitious regulatory frameworks can move from paper to practice, creating both challenges and opportunities for organizations deploying AI. As governments worldwide follow suit, operational readiness and demonstrable safeguards are becoming the true measures of responsible AI. The question facing every AI team today is: how prepared are you to show regulators that your systems are safe, auditable, and accountable in real-world operations?

Until next week,
The AI Governance Today

Welcome to the 10th issue of AI Governance Today. This week, one reality has become unmistakable: deepfakes have moved from a theoretical risk to a live test of AI governance programs. Regulators across the UK, U.S., and Europe are using synthetic media as a lens to evaluate whether organizations can prevent harm, detect misuse, and respond effectively once AI systems are deployed. What was once treated as a content moderation or misinformation concern is now an enforcement benchmark, signaling that operational accountability, transparency, and rapid remediation are no longer optional but central to AI governance.

TL;DR For The Week

• Deepfakes are now a primary enforcement test for AI governance, shifting regulatory focus from design intentions to real-world harm, accountability, and operational proof.

• UK regulators, under the Online Safety Act, and California and U.S. federal authorities are actively investigating AI platforms for non-consensual and harmful deepfake content.

• Civil remedies and criminal penalties for creators, deployers, and platforms are expanding, including the DEFIANCE Act in the U.S. Senate.

• Transparency, machine-readable labeling, rapid takedown procedures, and post-deployment monitoring are emerging as universal compliance expectations.

• Organizations must demonstrate detectable safeguards, clear governance, and rapid response capabilities, deepfakes are the first visible benchmark for broader AI accountability.

Spotlight

Deepfakes Emerge as the First Enforcement Test of AI Governance

Over the past week, deepfakes have moved decisively from a theoretical AI risk to a practical enforcement priority. What was once treated as a content moderation or misinformation issue is now being used by regulators as a test case for whether AI governance programs work in production, not just on paper.

Across jurisdictions, regulators are converging on a shared view: deepfakes represent a direct threat to personal safety, identity, democratic processes, and platform trust. As a result, regulatory attention has shifted away from abstract model characteristics and toward harm-based accountability, focusing on non-consensual imagery, identity misuse, sexual exploitation, and deception at scale.

A defining feature of this shift is the use of existing legal authority to address live AI systems. Regulators are no longer waiting for comprehensive AI laws to come into force before acting. Instead, they are applying consumer protection, online safety, privacy, and criminal statutes to synthetic media harms, particularly where safeguards were foreseeable but absent or ineffective. This approach lowers the enforcement threshold and accelerates accountability timelines for companies deploying generative systems.

Transparency has emerged as a core regulatory expectation. Many jurisdictions now require clear disclosure when content is artificially generated or manipulated, often extending beyond visible labels to include machine-readable markers that enable detection downstream. These obligations apply not only to malicious deepfakes, but also to synthetic media used in entertainment, marketing, or artistic contexts, reinforcing the principle that realism triggers responsibility regardless of intent.

Platform responsibility is another unifying theme. Rather than focusing solely on creators, regulators are placing increasing obligations on services that host, distribute, or amplify deepfake content. Expectations include rapid takedown mechanisms, proactive risk assessments, monitoring for abuse patterns, and documented escalation procedures. Failure to act after notice is increasingly treated as a governance failure rather than a technical oversight.

In parallel, civil liability and criminal penalties are expanding. Victims of non-consensual deepfakes are gaining clearer legal pathways to seek damages, while creators and distributors face escalating penalties when synthetic media is used for harassment, exploitation, fraud, or political manipulation. These measures reflect a broader policy judgment that deepfakes undermine fundamental rights tied to identity, consent, and dignity.

What makes deepfakes particularly significant is their role as a regulatory forcing function. They expose gaps in post-deployment monitoring, challenge assumptions about user behavior, and test whether governance frameworks can respond dynamically once systems are in the wild. As a result, enforcement actions tied to deepfakes are implicitly evaluating incident response readiness, internal accountability structures, and the ability to demonstrate control under scrutiny.

The broader implication is clear: deepfakes are not an isolated content issue, but the first widely visible enforcement benchmark for AI governance. Regulators are signaling that future scrutiny, whether related to discrimination, manipulation, or unsafe automation, will follow a similar pattern, prioritizing real-world harm and operational proof over aspirational principles.

For organizations deploying generative AI, the lesson is straightforward. Effective governance now requires detectable safeguards, enforceable policies, and the ability to intervene quickly and document decisions. Deepfake enforcement is not the end of the regulatory story, it is the opening chapter in how AI accountability will be judged going forward.

Policy Radar: Regional and Global Governance Shifts

1. UK Deepfake Enforcement and Regulatory Action Accelerates

Region: United Kingdom
UK Prime Minister Keir Starmer confirmed that regulator Ofcom is actively probing AI platform X (formerly Twitter) for allegedly generating sexually explicit deepfake content via its Grok chatbot. This follows new legislation criminalizing non-consensual deepfake image creation, slated to take effect imminently under the Online Safety Act framework. The government has emphasized enforcement readiness and indicated additional measures if platforms fail to comply with UK legal standards on abusive AI content.

2. California Attorney General Opens AI Misuse Investigation

Region: United States (State-Level)
California’s Attorney General has launched an investigation into xAI’s Grok tool over allegations that it enabled generation of non-consensual sexually explicit deepfake images, including content involving minors. The inquiry reflects heightened regulator scrutiny on harmful AI outputs and abuse vectors, with bipartisan political figures condemning the tool’s capabilities and calling for broader enforcement action. International regulators in Europe and Asia are also initiating inquiries into related conduct.

3. U.S. Senate Passes Deepfake Civil Remedies Bill (DEFIANCE Act)

Region: United States
The U.S. Senate unanimously passed the DEFIANCE Act, designed to allow victims of non-consensual AI-generated intimate imagery to pursue civil damages against creators and deployers of such content. The bill responds to high-profile deepfake concerns and aims to expand legal recourse beyond platform removal requirements to include individual accountability. The measure now awaits action in the House of Representatives.

4. California Advances AI Transparency and Safety Enforcement in 2026

Region: United States (State-Level)
California continues to implement its AI regulatory agenda in 2026, including enforcement of the Transparency in Frontier Artificial Intelligence Act (SB 53). This law requires large AI developers to publish safety reports, adhere to transparency obligations, and offer whistleblower protections. As the state positions itself at the forefront of operational AI governance, legislators are also debating additional oversight measures connected to data center energy use and broader AI impacts on infrastructure and employment.

5. EU Digital Enforcement Posture Strengthens Around AI Outputs

Region: European Union
Although not tied to a specific news article last week, regulatory pressure within the EU also featured prominently in enforcement discourse: the European Commission has been reviewing AI provider compliance with existing frameworks such as the Digital Services Act. Commission actions include fines and heightened investigatory scrutiny of platforms that fail to meet transparency and safety obligations, demonstrating that EU enforcement mechanisms are being applied to generative AI models alongside emerging national laws. (Context from regulatory tracking.)

Framework Focus

UK Online Safety Act – Deepfake Governance and Enforcement

The UK Online Safety Act (OSA) has emerged as one of the first operationally enforceable frameworks addressing AI-generated deepfakes, particularly non-consensual and sexually explicit synthetic media. Unlike abstract AI legislation, the OSA emphasizes real-world outcomes, holding platforms accountable for the creation, hosting, or distribution of harmful content, whether AI-generated or human-produced. This makes it a practical blueprint for organizations seeking to demonstrate effective governance under regulatory scrutiny.

Scope and Applicability

The Act applies to:

• Online platforms and services that host, distribute, or recommend user-generated content, including social media, marketplaces, and messaging platforms.

• AI-generated content that impersonates individuals, produces non-consensual sexual imagery, or otherwise exposes users to identity-based or reputational harm.

• Senior leadership accountability, requiring organizations to designate responsible officers for content safety and harm mitigation.

The OSA explicitly extends to synthetic media, treating AI-generated deepfakes as a priority harm category, signaling that governance programs must address both design-time safeguards and post-deployment monitoring.

Key Governance Provisions

1. Proactive Risk Assessment
   Platforms must identify potential risks associated with AI-generated content, evaluate likely harms, and implement preventive measures before deployment.

2. Content Detection and Monitoring
   Continuous monitoring, abuse reporting mechanisms, and automated detection systems are expected to identify non-consensual or manipulative content promptly.

3. Rapid Takedown and Remediation
   Upon notice of harmful content, platforms must act swiftly to remove or disable access. Delays or procedural gaps can constitute a governance failure under the Act.

4. Operational Accountability
   The Act reinforces the need for clear internal ownership, defined escalation protocols, and documented decision-making authority for managing AI-related harm.

5. Documentation and Auditability
   Organizations are required to maintain auditable records demonstrating compliance with safety obligations, including risk assessments, mitigation steps, and incident responses.

Governance Implications

The OSA demonstrates the regulatory shift from ethical intentions to operational proof. Enforcement is outcome-focused: regulators evaluate whether organisations can prevent harm, detect misuse, and intervene effectively. For AI governance teams, the key lesson is clear: having policies is insufficient. Companies must be able to show evidence of governance in action, including post-deployment controls and rapid response capability.

Deepfakes under the OSA also serve as a model for broader AI accountability. The same enforcement principles, risk identification, monitoring, rapid remediation, accountability, and traceability are likely to extend to other high-risk AI applications, including biased decision-making, manipulative content, and unsafe automation.

For organisations deploying AI, the UK Online Safety Act provides both a warning and a roadmap: governance programs are no longer judged on intent alone but on whether they can demonstrably prevent, detect, and remediate real-world harm.

Looking Ahead

• AI Governance Forum 2026 - Amsterdam (21–22 January 2026
  Senior executives and AI risk leaders will gather to discuss practical governance strategies, operationalizing compliance, and preparing for upcoming regulatory regimes across the EU and beyond. The multi‑industry agenda includes actionable frameworks for accountability and risk management in regulated environments.

• National AI Convention & AI Leadership Conference - United States (20–21 January 2026)
  These events bring together AI practitioners and strategic leaders to explore innovation, ethical deployment, and organizational strategies for AI at enterprise scale. Sessions will cover governance implications of emerging technologies and cross‑sector compliance priorities.

• India AI Impact Summit 2026 - New Delhi (19–20 February 2026)
  Hosted by Indian authorities with broad international participation, this summit will emphasize global standards, inclusive AI deployment, and governance frameworks that support ethical use, transparency, and accountability. India aims to build consensus on international AI norms and regulatory approach

Closing Thoughts

As deepfakes take centre stage in AI enforcement, the message to organisations is clear: governance is measured by action and not precisely intent. Regulators are evaluating whether companies can detect misuse, remediate harm, and maintain auditable records once AI systems are live. Transparency, rapid takedown mechanisms, and clearly defined accountability structures are no longer optional; they are the baseline for compliance. Looking forward, deepfakes serve as a litmus test for broader AI oversight, from biased decision-making to unsafe automation, setting expectations for operational proof across all high-risk AI applications.

Key Question: If regulators examined your AI systems tomorrow, could you demonstrate effective control, rapid response, and documented accountability in real operating conditions?

Until next week,
The AI Governance Today

Welcome to the 9th issue of AI Governance Today. As we return to our usual format, the opening weeks of 2026 make one reality unmistakable: AI governance has moved from anticipation to execution. Across the United States and globally, enforceable state-level laws are taking effect, incident reporting expectations are solidifying, and accountability is shifting from abstract responsibility to operational proof. With federal and state approaches diverging and global alignment still fragmented, organizations deploying AI are increasingly being judged not by intent, but by their ability to demonstrate control, traceability, and readiness under scrutiny.

TL;DR For The Week

• Texas’s Responsible Artificial Intelligence Governance Act entering into force confirms that 2026 has begun as an enforcement year for AI regulation, not a preparatory one.

• State-level AI laws in the U.S. are advancing faster than federal unification efforts, increasing compliance complexity for organizations operating across multiple jurisdictions.

• Clear statutory prohibitions on harmful AI uses are replacing voluntary ethics frameworks and discretionary risk management approaches.

• Regulators are prioritizing post-deployment behavior, including misuse, drift, and real-world harm, over design-time assurances.

• Accountability is being defined operationally, with expectations for clear ownership, escalation authority, and intervention capability inside organizations.

• Governance maturity is increasingly measured by documentation, traceability, and the ability to withstand regulatory investigation, not by stated principles.

Spotlight

Texas Responsible AI Governance Act Enters Force, Marking First Major U.S. AI Law to Be Executed in 2026

On 1 January 2026, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) formally entered into force, making Texas the first U.S. state this year to actively enforce a comprehensive AI governance statute rather than announce or debate one.

Unlike prior state AI laws that focused narrowly on transparency or sector-specific disclosures, TRAIGA introduces clear statutory prohibitions on harmful AI uses, enforceable transparency obligations, and centralized enforcement authority under the Texas Attorney General. With the law now live, organizations deploying AI systems that impact Texas residents are subject to immediate compliance exposure, not future rulemaking.

What makes this moment significant is execution. TRAIGA does not rely on future agency guidance to define its core obligations. Prohibited practices, such as unlawful discrimination, behavioral manipulation, facilitation of harm, and creation of illegal content, are already defined in statute. Disclosure requirements for government and healthcare AI use are also immediately applicable. Enforcement mechanisms, including civil penalties, are now available to the state.

Early legal and compliance advisories issued this month indicate that organizations are reassessing AI deployments that previously relied on internal ethical review or voluntary safeguards. The absence of a private right of action shifts the risk calculus toward state investigation readiness, documentation discipline, and defensible governance structures rather than consumer litigation management.

TRAIGA’s entry into force matters beyond Texas. It provides a working U.S. model of enforceable AI governance at a time when federal policy remains unsettled. For governance teams, the lesson is immediate: 2026 is not a transition year for AI regulation. In at least some jurisdictions, it is already an enforcement year.

Policy Radar: Regional and Global Governance Shifts

1. New U.S. Executive Order Seeks National AI Policy Framework

Region: United States (Federal)
The U.S. federal government issued an executive order in December 2025 aimed at establishing a unified national AI policy framework and limiting conflicting state AI laws. The order directs federal agencies to evaluate and potentially preempt state laws deemed burdensome or inconsistent with the national policy, intensifying the debate over federal versus state authority in AI governance.

2. Texas Responsible Artificial Intelligence Governance Act Goes Into Effect

Region: United States (State-Level)
Effective January 1, 2026, Texas’s Responsible Artificial Intelligence Governance Act establishes a comprehensive AI governance framework that bans certain harmful AI uses (including discriminatory and harmful content), mandates disclosures for government and health-care AI deployments, and positions Texas as a leader in AI statutory regulation.

3. California and Other State AI Laws Take Effect in 2026

Region: United States (Multi-State)
Several state AI laws, including California’s rules on AI transparency, chatbot disclosures, and consumer protections, and Colorado’s AI Act requiring reasonable care in high-risk systems, are now effective or phasing in during 2026, reinforcing a patchwork of enforceable operational expectations across states.

4. Spain Advances Legislation to Curb AI Deepfakes and Non-Consensual Content

Region: European Union / Spain
Spain’s government approved draft legislation targeting AI-generated deepfakes and non-consensual use of images and likenesses. The bill proposes age-based consent rules and commercial use restrictions, aligning with broader EU efforts to criminalize non-consensual intimate imagery produced by AI.

5. UK Passes Law Criminalizing Non-Consensual Deepfake and AI-Generated Intimate Images

Region: United Kingdom (National)
In direct response to widespread misuse of AI image-generation tools, the UK government has enacted legislation under the Online Safety Act designating the creation of non-consensual intimate deepfake images as a priority offence with proactive platform obligations and significant penalties for non-compliance. Regulators such as Ofcom are already investigating major AI platforms over alleged violations, signaling an enforcement focus on harmful AI outcomes and content moderation accountability.

6. Ongoing Proliferation of AI Laws Worldwide Surges in 2025-26

Region: Global
Recent reporting confirms that 30+ nations and 15+ U.S. states have passed new AI laws, with a significant increase in mandatory incident reporting and statutory governance obligations, signaling a global shift from voluntary ethics to enforceable regulation.

Framework Focus

Texas Responsible Artificial Intelligence Governance Act (TRAIGA)

Overview
The Texas Responsible Artificial Intelligence Governance Act (HB 149), signed into law on June 22, 2025, and effective 1 January 2026, represents one of the most comprehensive state-level AI regulatory frameworks enacted in the U.S. It aims to balance consumer protections, civil rights, and innovation by establishing enforceable obligations on AI use, transparent interactions, prohibited practices, and governance structures, particularly for governmental entities and entities doing business in Texas.

Scope and Applicability:
TRAIGA applies to:

• Any entity that develops, deploys, or offers AI systems in Texas, including those whose products or services are used by Texas residents.

• Governmental bodies at the state and local levels, which face distinct and more rigorous obligations regarding transparency and prohibited practices.

Key Governance Provisions:

1. Definitions and Transparency Requirements

• An “artificial intelligence system” is broadly defined as any machine-based system that uses inputs to generate outputs (e.g., content, decisions, predictions) influencing physical or virtual environments.

• Government entities must provide clear, conspicuous notice to consumers when interacting with an AI system before or at the time of the interaction; healthcare providers must disclose AI involvement in patient care.

2. Prohibited AI Practices
TRAIGA categorically prohibits the development or deployment of AI systems for:

• Manipulating human behavior (e.g., self-harm encouragement, criminal conduct facilitation).

• Unlawful discrimination against protected classes.

• Creation or distribution of child sexual abuse material and unlawful deepfakes.

• Infringement on constitutional rights.
  These restrictions apply broadly, including to private sector actors operating in Texas, elevating legal risk when AI systems are used for harmful or manipulative purposes.

3. Regulatory Sandbox and Innovation Support
TRAIGA establishes a regulatory sandbox administered by the Texas Department of Information Resources to allow eligible participants to test AI systems without traditional regulatory burdens for up to 36 months. Participants must submit detailed reports on system performance, risks, mitigation activities, and stakeholder feedback.

4. Texas Artificial Intelligence Council
The Act creates a seven-member advisory council composed of experts in AI, public policy, ethics, risk management, and related domains. The Council’s mandate includes advising the legislature on AI policy, recommending improvements, identifying regulatory barriers, and publishing reports on compliance, ethical implications, and legal risks.

5. Enforcement and Penalties

• Enforcement authority lies with the Texas Attorney General, who can issue civil investigative demands, pursue penalties, and seek injunctive relief.

• Civil penalties for violations range from $10,000 to $200,000 per violation, with daily assessments for ongoing noncompliance.

• TRAIGA has no private right of action; enforcement is exclusively through state mechanisms.

Governance Implications:

Operational Accountability: Organizations with AI deployments in Texas must prepare internal documentation, governance processes, and proactive risk controls to demonstrate compliance during civil investigative demands. This elevates internal AI governance from voluntary best practice to enforceable legal duty.

Traceability and Documentation: While TRAIGA stops short of formal lifecycle traceability mandates of some EU proposals, the regulatory sandbox and enforcement mechanisms effectively require organizations to maintain auditable records of AI design, deployment, risk mitigation, and outcomes.

Sector-Focused Obligations: Healthcare and governmental use cases trigger specific disclosure requirements, signaling that regulated sectors should prioritize consumer protection and informed consent when AI is involved in decision-making or treatment.

Looking Ahead

• AI Governance in 2026: Webinar (15 January 2026)
  A live webinar examining lessons from past AI governance approaches and their relevance to policy, risk management, and regulatory frameworks in 2026.

• Navigating AI Policy Webinar (21 January 2026)
  Panel discussion on key AI legislative and regulatory developments from 2025 and what local leaders and organizations should expect in 2026, including federal/state tensions and compliance strategies.

• Kerala AI Future Con (23 January 2026)
  One-day summit in Kovalam, India, focusing on AI governance, public sector use, economic applications, and development strategy with international delegate participation.

• AAAI 2026 Conference (20–27 January 2026)
  Major international AI research conference with sessions spanning AI progress, ethics, governance implications, and safety topics (Singapore).

• Axios House at Davos 2026 (19–22 January 2026)
  Virtual discussions featuring themes on AI risk, innovation governance, and strategic implications for global policy and regulatory alignment.

• “AI in Compliance & Ethics” Webinar (22 January 2026)
  Practical webcast unpacking how organizations are using AI in compliance and ethical contexts and emerging governance practices.

Closing Thoughts

As state-level AI laws move from passage to enforcement, 2026 is already testing whether governance programs are built for execution rather than intention. With statutes like Texas’s Responsible Artificial Intelligence Governance Act now live, accountability, documentation, and intervention authority are no longer theoretical requirements. The defining question for organizations deploying AI this year is simple: if regulators asked tomorrow, could you demonstrate control over your AI systems in real operating conditions?

Until next week,
The AI Governance Today

Top 10 Trends Shaping the Future of AI Policy and Governance in 2026

1. Global baseline convergence on AI safety standards:
   There is increasing movement toward alignment across jurisdictions on what constitutes safe and responsible AI. While regulatory texts differ, the underlying concepts are converging: risk-based classification, transparency obligations, documentation of training data and evaluations, incident reporting, and human oversight expectations. Forums such as the G7 Hiroshima Process, OECD AI Principles, and international standards bodies are accelerating this alignment. The practical impact is that companies building AI systems for multiple markets will begin to see more consistent expectations around governance rather than reinventing compliance structures country by country. This narrows regulatory fragmentation and reduces uncertainty.

2. Implementation phase of the EU AI Act:
   The EU AI Act now enters its most consequential stage, where statutory language becomes operational requirements. Delegated acts will define thresholds for high-risk AI and general-purpose models. Harmonized technical standards will specify how conformity assessments are conducted. Notified bodies will be accredited to audit systems. Codes of practice will be developed for foundation models. Organizations will need to inventory AI systems, classify risk, document training processes, and be ready to demonstrate compliance throughout the lifecycle. Early enforcement actions will likely set precedents that shape industry behavior.

3. U.S. federal regulatory action without comprehensive legislation:
   The United States may not pass a single comprehensive AI law in the near term, but governance will still advance through agency action. The FTC is addressing unfair and deceptive AI practices. The CFPB is scrutinizing credit and lending algorithms. The EEOC is focused on AI in hiring and employment decisions. HHS is examining AI in clinical decision support. The SEC is watching AI-enabled financial advice and trading. This creates a patchwork of sectoral enforcement and guidance grounded in consumer protection, discrimination, safety, and securities law. For companies, this means governance remains mandatory even without one unified statute.

4. Formalization of AI risk management systems:
   AI governance is shifting from principle-based statements toward structured management systems. Frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework encourage organizations to manage AI risk with defined policies, assigned roles, documented processes, auditing, and continuous improvement. Boards are beginning to require oversight reporting on AI risk in the same way they do with cybersecurity and privacy. Internal governance structures such as AI risk committees and independent model review teams are becoming institutionalized. Assurance and certification regimes will increasingly allow organizations to demonstrate maturity to customers, regulators, and insurers.

5. Evaluation, testing, and monitoring becoming mandatory:
   There is a major shift from voluntary testing toward required evaluation across the AI lifecycle. Pre-deployment activities now include safety testing, robustness checks, bias and discrimination analysis, red-teaming for misuse, and benchmarking in realistic conditions. Post-deployment expectations emphasize continuous monitoring, drift detection, incident response plans, rollback capability, and user feedback channels. This is especially relevant in healthcare, hiring, finance, education, critical infrastructure, and the public sector. An ecosystem of third-party auditors and validation tools is developing, while companies build internal model validation teams similar to those in the banking sector after the 2008 financial crisis.

6. Governance tailored to foundation models and agentic systems:
   Different types of AI systems present different categories of risk. Foundation models trained on massive general-purpose datasets raise questions of emergent capability, dual use, and cascading downstream impact. Agentic systems that plan, act autonomously, or call external tools introduce operational and cyber-physical risk. Policymakers are beginning to differentiate between these classes. Expect obligations such as capability documentation, safeguards for high-risk functions, controlled release strategies, and stronger oversight requirements. Application-level AI that is narrow in scope will likely face proportionate but lighter regulatory treatment.

7. Growing clarity on liability for AI-driven harm:
   As AI systems influence credit decisions, hiring outcomes, medical recommendations, transportation systems, and consumer products, defining responsibility when harm occurs is essential. Courts and lawmakers are beginning to clarify duties of care for developers, deployers, and integrators. Some contexts may lean toward strict liability while others use negligence standards based on foreseeability and control. Companies will increasingly rely on indemnity clauses, insurance products, and contractual allocation of risk. Better documentation, logging, and testing processes will become crucial because legal outcomes will hinge on whether organizations can show that they acted responsibly.

8. Governance expectations embedded in procurement and commercial contracting:
   AI governance is rapidly becoming a prerequisite for doing business. Governments, financial institutions, hospitals, and enterprise buyers are embedding governance questions into procurement processes. Vendors are being asked to provide system cards, model documentation, dataset provenance, security controls, human oversight mechanisms, risk assessments, and incident response procedures. Companies unable to explain their systems or demonstrate controls will increasingly lose contracts. This makes governance capability a source of commercial advantage and revenue enablement, not just a compliance burden.

9. Expansion of transparency, documentation, and incident disclosure regimes:
   Transparency expectations are expanding in both law and market practice. Requirements include documentation of training data sources where feasible, disclosure when users are interacting with AI systems, maintenance of logs for auditability, and reporting of serious incidents and safety risks. Algorithmic impact assessments are increasingly required before deploying systems that affect access to essential services or rights. These expectations encourage better record-keeping and traceability within engineering teams and enable regulators, customers, and the public to better understand AI system behavior.

10. Professionalization of the AI governance workforce:
    AI governance is developing into a defined profession. Organizations are hiring AI risk officers, responsible AI leads, AI policy counsel, compliance engineers, and model validation specialists. Universities and training organizations are building programs specifically in AI governance and safety. Professional certifications are beginning to mirror the trajectory of privacy and cybersecurity credentials. Over time, clearer accountability structures will emerge across product management, legal, trust and safety, security, and compliance teams. Governance is becoming an operational discipline with skills, tools, and career pathways.

As AI systems become more capable and more deeply embedded in economic and social infrastructure, governance is no longer a peripheral discussion. It is becoming central to innovation, trust, and competitiveness. The coming year will test whether institutions can translate principles into operational discipline and whether organizations can move from aspirational commitments to measurable accountability. The direction of travel is clear, but the pace and quality of implementation will depend on choices made now by policymakers, companies, and practitioners. As we step into 2026, I will leave you with this question: from the top ten trends outlined here, what do you think we missed that deserves to be on the list?

Until next week,
The AI Governance Today

Welcome to the 7th issue of AI Governance Today. This week’s developments point to a clear shift in how AI governance is taking shape in practice. Regulation is moving faster at the state and sectoral level than at the national level, operational expectations are becoming enforceable before comprehensive frameworks are finalized, and accountability is increasingly judged by evidence rather than intent. As debates over jurisdiction continue, one message is consistent across regions. Organizations deploying AI are being expected to demonstrate control, traceability, and responsibility in real-world conditions, not just in policy statements. As the year draws to a close, I also want to wish you a Merry Christmas and a peaceful holiday season.

TL;DR For The Week

• State-level AI regulation is accelerating, with New York’s RAISE Act signaling a shift toward enforceable operational accountability and mandatory incident reporting.

• Federal efforts to unify AI policy are colliding with state ambitions, creating a fragmented and uncertain governance landscape for organizations operating across jurisdictions.

• Regulators are increasingly focused on outcomes and real-world behavior, not just stated safeguards or design-time risk assessments.

• Accountability is being treated as an organizational responsibility, requiring clear ownership, escalation paths, and authority to intervene.

• Traceability across the AI lifecycle is emerging as a baseline expectation for audits, enforcement, and regulatory credibility.

• Governance maturity is now measured less by principles and more by the ability to produce evidence under scrutiny.

Spotlight

State-Level AI Safety Law Signals New Phase in U.S. AI Governance

This week’s signing of the RAISE Act in New York represents a meaningful shift in how AI safety and accountability are being approached at the state level, and signals broader implications for national governance. On 19 December 2025, New York Governor Kathy Hochul enacted a comprehensive state-level AI safety law that includes mandatory incident reporting requirements and risk mitigation measures for advanced AI systems. Unlike past legislation focused narrowly on specific categories of AI use, this law is explicitly designed to create ongoing oversight mechanisms for AI systems across sectors and scales of development.

The RAISE Act’s requirements align closely with existing trends in state legislation, such as California’s AI transparency measures, but it introduces enforceable operational expectations for organizations deploying AI within the state. In doing so, New York positions itself as a governance leader while many federal initiatives remain in development or enforcement phases.

This development is particularly notable because it comes amid federal action aimed at consolidating regulatory authority over AI. Earlier this month, a federal executive order sought to establish a unified national AI policy framework and to challenge state-level AI laws deemed inconsistent with that framework, intensifying the debate over regulatory authority.

The juxtaposition of New York’s aggressive state governance and federal efforts to streamline and preempt state rules illustrates the complexity of the current U.S. regulatory landscape. Organizations operating in multiple jurisdictions must now prepare for coexisting, potentially overlapping governance regimes that emphasize operational accountability, transparent reporting, and measurable safety outcomes.

For governance teams, the broader signal is clear: enforceable operational expectations are arriving before uniform federal statutes. Whether through state legislation like the RAISE Act or through evolving federal guidance and enforcement, the imperative for traceability, accountability, and incident reporting is gaining legal force.

Policy Radar: Regional and Global Governance Shifts

1. Federal Push Toward Unified AI Policy
Region: United States
The U.S. federal government issued a new executive order aimed at establishing a centralized national AI policy framework. The order signals an intent to reduce fragmentation by limiting conflicting state-level AI regulations and reinforcing federal leadership on AI governance, safety expectations, and innovation priorities.

2. New York Enacts Comprehensive AI Safety Law
Region: United States (State-Level)
New York enacted a sweeping AI safety law introducing requirements around risk mitigation, incident reporting, and accountability for certain AI systems. The law reflects growing state-level momentum to regulate AI safety in the absence of comprehensive federal legislation.

3. States Push Back Against Federal AI Preemption
Region: United States (State-Level)
Several U.S. states publicly pushed back against federal efforts to preempt state AI laws, arguing that states must retain authority to address local harms, consumer protection, and ethical AI use. This tension highlights ongoing uncertainty over the future balance between federal and state AI governance.

4. Energy Regulators Address AI Infrastructure Risks
Region: United States
U.S. energy regulators directed grid operators to develop rules governing AI-driven data center connections. This move reflects growing policy attention on the downstream infrastructure impacts of large-scale AI deployment, including energy reliability and systemic risk.

5. India Releases Updated AI Governance Guidelines
Region: India
India issued new AI governance guidelines outlining expectations around responsible development, deployment, and oversight. The guidance signals India’s intent to formalize its AI governance posture while balancing innovation, ethics, and economic competitiveness.

6. UNESCO Advances National AI Readiness Assessments
Region: Global
UNESCO released new AI readiness assessment findings in partnership with national governments, emphasizing ethical governance, institutional capacity, and regulatory preparedness. These assessments are increasingly used as reference points for countries developing AI strategies.

7. Governments Explore Techno-Legal AI Governance Models
Region: Global
Policymakers convened high-level forums focused on techno-legal approaches to AI governance, bringing together legal, technical, and policy perspectives. These discussions reflect growing recognition that effective AI regulation requires integrated legal and technical frameworks.

Framework Focus

Accountability and Traceability as the New Control Layer

Across jurisdictions and governance regimes, a common expectation is taking shape. Organizations are increasingly expected to account for how AI systems behave and to trace how decisions are made over time.

Rather than introducing entirely new legal constructs, regulators are converging on a shared control layer built around accountability and traceability. Whether through binding regulation, voluntary frameworks, or enforcement actions, the underlying question is becoming consistent. Can an organization explain what its AI system did, why it did it, and who was responsible when it mattered?

Traceability is emerging as the technical foundation of this expectation. Regulators and auditors increasingly expect organizations to reconstruct the full lifecycle of an AI system, from data sourcing and model development to deployment decisions, system updates, and real-world outcomes. This includes the ability to show how risks were identified, how controls were applied, and how behavior was monitored and corrected after deployment.

Accountability is increasingly framed as an organizational design problem rather than a technical one. It is no longer sufficient to claim human oversight in principle. Organizations are expected to define ownership, escalation paths, and intervention authority in practice. When AI systems behave unexpectedly, ambiguity around responsibility is increasingly treated as a governance failure.

This shift applies regardless of whether a system is traditional, generative, or agentic. As AI systems gain autonomy and operate across tools and workflows, the ability to trace actions and assign responsibility becomes the primary mechanism through which governance remains possible.

Accountability and traceability are not replacing existing frameworks. They are becoming the connective tissue that determines whether those frameworks can be enforced. In the next phase of AI governance, compliance will be judged less by stated principles and more by an organization’s ability to produce credible evidence under scrutiny.

Looking Ahead

• Early January 2026 – AI Regulation Updates Webinar (Virtual)
  An expert-led webinar providing a practical overview of recent AI regulatory developments, including the EU AI Act, U.S. federal guidance, and emerging governance trends across Asia, with a focus on compliance implications for organizations.

• January 2026 – AI Risk & Evaluation Standards Updates
  Several standards bodies are expected to publish updated guidance on AI evaluation, documentation, and post-deployment monitoring practices.

Closing Thoughts

As the year comes to a close, AI governance is being tested not by intention, but by execution. Accountability and traceability are becoming the measures that matter most when systems operate in the real world.

As expectations rise and oversight tightens, are organizations truly prepared to show how their AI systems behave when it counts?

Until next week,
The AI Governance Today

Welcome to the 6th issue of AI Governance Today. This week, the focus shifts from models to systems as agentic AI moves closer to everyday deployment. With the release of the OWASP Top 10 for Agentic AI and growing attention on how autonomous systems are governed, it is becoming clear that many of the hardest AI risks ahead are not about what models generate, but about how systems behave once they are given the ability to act.

TL;DR For The Week

• The release of the OWASP Top 10 for Agentic AI marks a shift in how AI risk is understood, away from individual models and toward system-level behavior, autonomy, and control.

• Agentic AI risks are largely governance failures, not model failures, driven by excessive autonomy, weak oversight, poor observability, and unclear accountability.

• Regulators globally are moving toward lifecycle governance, stronger organizational controls, and traceability, even though no law yet targets agentic AI directly.

• Existing frameworks like the EU AI Act, NIST AI RMF, and ISO/IEC 42001 are being stretched to cover agentic systems, but they were not designed for autonomous, multi-step behavior.

• The gap between how fast agentic AI is being deployed and how slowly governance is evolving is becoming hard to ignore.

• The core challenge ahead is no longer controlling AI outputs, but controlling AI behavior over time.

Spotlight

OWASP Top 10 for Agentic AI and Why Governance Has to Catch Up

This week, the release of the OWASP Top 10 for Agentic Applications (2026) felt like a turning point in how AI risk is being discussed. For a long time, most governance and security conversations focused on models. How they were trained. What data they used. Whether outputs were biased or explainable. The OWASP list makes a different point. Once AI systems start acting, planning, and interacting with other systems, the real risks move beyond the model itself.

Agentic AI systems are no longer just generating text or predictions. They decide what to do next, call tools, pass tasks to other agents, and sometimes act with very little friction. OWASP’s Top 10 reflects that reality. The risks it highlights are not about a single bad response. They are about systems behaving in ways that were not intended, not fully understood, or not properly controlled.

What stands out immediately is how many of the risks are governance problems at heart. Agent Goal Hijack, Tool Misuse, Identity and Privilege Abuse, Cascading Failures, and Rogue Agents all point to the same issue. Autonomy is being granted faster than it is being governed. In many cases, agents are trusted to act across systems without clear boundaries, strong oversight, or a reliable way to intervene when something goes wrong.

OWASP introduces the idea of Least Agency, which builds on the familiar principle of least privilege. The idea is simple but important. If an agent does not need autonomy, it should not have it. Extra agency increases the attack surface and the blast radius of failures. Alongside that, the document repeatedly emphasizes observability. If you cannot clearly see what an agent is doing, why it is doing it, and which tools it is invoking, you are already behind.

Another important shift is how familiar risks are reframed. Prompt injection becomes Agent Goal Hijack, where the attacker changes what the agent is trying to achieve rather than just its next response. Supply chain risk becomes Agentic Supply Chain Vulnerabilities, reflecting the reality that tools, agents, and configurations are often pulled in dynamically at runtime. Reliability issues show up as Cascading Failures, where one small mistake spreads quickly across agents and workflows.

What is clear throughout the document is that these risks cannot be solved by better models alone. Many of the recommended mitigations have nothing to do with training data or architecture. They are about approvals for high impact actions, clear identity boundaries for agents, policy enforcement before execution, strong logging, and the ability to pause or roll back behavior when something drifts. These are organizational and system design choices, not model tweaks.

Overall, this release feels less like a security checklist and more like a warning. As agentic AI moves into production across finance, healthcare, infrastructure, and enterprise tooling, the biggest risks will come from systems that are too autonomous, too interconnected, and not well understood by the people responsible for them. The OWASP Top 10 makes one thing very clear. The future of AI governance is not about controlling outputs. It is about controlling behavior over time.

Policy Radar: Regional and Global Governance Shifts

1. Lifecycle Governance Gains Regulatory Momentum

Region: Global
Recent regulatory updates emphasize continuous risk management across the AI lifecycle, including post-deployment monitoring, incident reporting, and periodic reassessment. As AI regulations move from adoption to implementation, regulators are reinforcing that compliance is not a one-time exercise but an ongoing operational responsibility.

2. EU Signals Stronger Expectations on Organizational Controls

Region: European Union
EU policymakers are increasingly framing AI obligations around organizational governance structures such as risk management systems, internal controls, documentation processes, and auditability. Recent guidance and implementation updates under the EU AI Act point toward compliance as a sustained organizational capability rather than a checklist at launch.

3. U.S. Agencies Emphasize Human Oversight and Accountability

Region: United States
U.S. regulators and enforcement bodies are sharpening their focus on human responsibility in AI-assisted decision-making. Recent actions highlight expectations that organizations deploying AI remain accountable for outcomes, particularly where systems affect consumer rights, access to services, or economic opportunity.

4. Standards Bodies Accelerate AI Management System Adoption

Region: Global
Industry adoption of AI management system standards is accelerating as organizations seek scalable governance structures aligned with emerging regulation. Recent coverage highlights growing interest in ISO/IEC-based management systems as practical tools to operationalize AI governance across jurisdictions and business units.

5. Enterprises Face Pressure for End-to-End Traceability

Region: Global
Organizations are facing increased scrutiny from regulators, partners, and customers to demonstrate traceability across data sourcing, model development, deployment decisions, and real-world outcomes. Recent regulatory guidance and enterprise analysis underscore traceability as a prerequisite for accountability and audit readiness.

6. OWASP Releases Top 10 Risks for Agentic AI Systems

Region: Global
The OWASP community released a new Top 10 risk list focused specifically on agentic AI systems, reflecting growing concern that autonomous and semi-autonomous AI introduces governance challenges beyond traditional model risks. The list highlights system-level issues such as excessive agency, unsafe tool use, goal misalignment, privilege escalation, and inadequate human oversight, reinforcing the shift from model-centric safety to end-to-end system governance.

Framework Focus

Agentic AI Is Moving Faster Than Governance

This week, there is no single framework or law to focus on, and that is the problem. There is still no regulation written specifically for agentic AI, even as these systems move quickly from experiments into real-world use.

Today, agentic systems are being interpreted through existing frameworks like the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001. While these provide a starting point, they were not designed for systems that can plan, act, delegate, and adapt over time. Obligations around human oversight, accountability, and risk management become significantly harder to meet once autonomy is introduced.

The pace mismatch is becoming clear. Security communities like OWASP are already documenting concrete, high-impact agentic risks, while regulatory guidance remains largely indirect and reactive. Without faster, clearer rules for autonomy, permissions, and system-level control, organizations are left to make governance decisions on their own.

Agentic AI is not waiting for regulation to catch up. If governance continues to lag behind deployment, regulators will be forced to respond after failures rather than shape behavior before harm occurs.

Looking Ahead

• 18–20 December 2025 – Global Forum on AI Systems Governance (Virtual)
  A multi-stakeholder forum examining governance challenges in complex AI systems, including agentic workflows and multi-model deployments.

• January 2026 – AI Risk & Evaluation Standards Updates
  Several standards bodies are expected to publish updated guidance on AI evaluation, documentation, and post-deployment monitoring practices.

• Q1 2026 – Increased Regulatory Attention on AI Operations
  Early signals suggest regulators will focus more heavily on operational governance, including incident response and internal accountability mechanisms.

Closing Thoughts

Agentic AI is forcing a quiet but important shift in how we think about governance. The risks that matter most are no longer confined to biased outputs or incorrect answers. They emerge from autonomy, from delegation, and from systems acting across tools and workflows faster than humans can comfortably follow. Security communities are already mapping these risks in concrete terms, while regulators are still adapting frameworks that were never designed for agents that plan and act on their own.

Agentic AI will not wait for governance to catch up. The question is whether governance can move fast enough to shape behavior before autonomy becomes something we can no longer meaningfully supervise.

If AI systems are increasingly allowed to act on our behalf, who should be responsible when their decisions cross a line we did not intend?

Until next week,
The AI Governance Today

Welcome back to AI Governance Today. This week, the center of gravity in AI regulation shifted toward the structures that shape how AI reaches people rather than the models themselves. With Europe opening antitrust investigations into Google and Meta, and the U.S. moving toward a single national rulebook, AI governance is expanding beyond safety debates toward questions of platform power, access, and interoperability. At the same time, new proposals in India and fresh analysis on global standards underline a broader trend: the future of AI will be shaped as much by the economic architecture around it as by the technical frameworks designed to control it.

TL;DR For The Week

• The European Commission opens antitrust investigations into Google’s use of online content for AI services and Meta’s integration of a proprietary AI assistant inside WhatsApp, bringing competition law into AI governance.

• The U.S. administration signals plans for a unified national AI regulatory framework that would preempt state-level AI laws, reflecting growing concern over fragmented compliance requirements.

• The EU’s Digital Omnibus proposes delaying enforcement of high-risk AI obligations under the AI Act and linking compliance to the availability of harmonised technical standards.

• India proposes requiring AI developers to pay royalties for locally produced copyrighted content used in model training, indicating a shift in intellectual-property norms for generative AI.

• New industry analysis shows rising demand for interoperable AI safety standards, with greater alignment around frameworks such as the NIST AI RMF and ISO/IEC standards.

• Regulators highlight structural risks from platform-level AI integration, signalling a shift from model-level safety concerns toward the economic dynamics that shape access, competition and innovation.

Spotlight

AI and Antitrust: When Platform Power Shapes the Future of Governance

Two developments in Europe this week point to an emerging dimension of AI governance that goes beyond familiar debates about model transparency or ethical safeguards. Regulators are now examining how dominant digital platforms might use AI to strengthen their market positions and shape the conditions of participation for everyone else. The European Commission’s separate investigations into Google and Meta bring competition law into the center of the AI governance conversation in a way that feels directly relevant to my own experience with these products.

I have been using Google products since 2007 and WhatsApp since 2013, which means I have lived through the evolution of these platforms from utility tools into complex digital ecosystems. When I search for information, share news links, or communicate with friends in different parts of the world, I am operating within environments that now have built-in AI capabilities. The shift from passive tools to active, AI-mediated experiences is easy to miss at a day-to-day level, but it is precisely this shift that regulators are beginning to evaluate. The question they are asking is not only whether AI systems are safe, but whether the way they are deployed could reduce competition or limit the visibility of alternative services.

The investigation into Google focuses on the use of online content to train and power AI features, such as AI generated summaries in search results and new capabilities built on top of YouTube. Regulators want to understand whether the scale of Google’s access to public content gives it an advantage that others cannot realistically match and whether the current web architecture gives creators a meaningful way to control how their work is reused. This is fundamentally a governance question about value creation and value capture in a world where content is turned into training data at scale.

The inquiry into Meta centers on WhatsApp and the integration of a proprietary AI assistant, alongside potential restrictions on third-party AI services. WhatsApp has become a near default communication layer in many regions, and the introduction of AI into that layer could have direct competitive implications. If access to the messaging channel is tied to a single provider’s AI assistant, smaller firms may struggle to reach users or experiment with new types of AI based communication. The regulators are not questioning the usefulness of the technology, but the market structure that may form around it.

Both cases illustrate how AI governance is expanding from technical oversight to the economic foundations that support digital ecosystems. For those of us who use these platforms every day, this shift matters because it will influence what choices we have, how content creators are compensated, and which companies can participate in the next phase of AI development. The investigations will take time, but they raise an important question for the future of AI governance in consumer platforms: who gets to define the terms under which innovation reaches the people who use it.

Policy Radar: Regional and Global Governance Shifts

1. Trump Announces Executive Order to Establish a Single U.S. AI Regulatory Framework
Region: United States
President Donald Trump signaled he will sign an executive order introducing a unified national AI rulebook, overriding state-level AI laws and centralising regulatory authority at the federal level. The announcement reflects rising concerns over fragmented compliance requirements across multiple states, where transparency, deepfake controls, and consumer protection rules are already in force.

2. EU Digital Omnibus Proposes Delayed Enforcement for High-Risk AI Obligations
Region: European Union
As part of the “Digital Omnibus” reforms, the European Commission proposed extending key enforcement deadlines for the EU AI Act, linking obligations to the availability of harmonised technical standards. High-risk AI documentation and conformity assessments would shift from 2026 toward late 2027, acknowledging that regulatory infrastructure and guidance are still maturing.

3. EU Opens Antitrust Investigation Into Google Over AI Use of Online Content
Region: European Union
The European Commission launched an antitrust investigation into Google’s use of publisher and creator content to train and power its AI services, including AI-generated summaries and search outputs. Regulators are examining whether Google’s practices undermine competition or violate content-use rights. The probe highlights growing scrutiny on how large AI models access and reuse public data.

4. Meta Faces EU Competition Probe Over WhatsApp AI Integration Strategy
Region: European Union
Regulators opened a formal investigation into Meta’s plan to limit third-party AI chatbots on WhatsApp, potentially giving exclusive access to Meta’s own AI assistant. The inquiry will assess whether the strategy could disadvantage competing AI services and restrict innovation within a dominant messaging platform.

5. India Proposes Royalties on Local Content Used for AI Model Training
Region: India
A government panel in India proposed requiring AI developers to pay royalties when locally produced copyrighted content is used to train large-scale models. The proposal signals a shift toward revisiting intellectual-property norms for generative AI and introduces a potential remuneration model for creators whose work underpins commercial AI platforms.

6. New Global Analysis Highlights Rising Demand for Interoperable AI Standards
Region: Global
A multi-country industry analysis published this week shows growing demand for harmonised AI safety and governance standards to reduce compliance fragmentation. Companies operating across jurisdictions are converging around frameworks such as the NIST AI RMF and ISO/IEC standards, citing the need for consistent evaluation criteria, oversight structures and reporting expectations.

Framework Focus

Competition Law as a De-Facto AI Governance Framework

The investigations into Google and Meta this week are reminders that AI is entering a regulatory environment that did not start from zero. While attention has been fixed on new AI laws and safety frameworks, Europe is beginning to govern AI through tools that have existed for decades: competition law and platform regulation. It is a structural approach rather than a technical one, and it shows that the governance of AI can happen even before specialised AI regulations are fully implemented.

In the European context, this takes place through a combination of Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU) and newer platform-specific rules under the Digital Markets Act (DMA). The traditional antitrust provisions focus on anti-competitive agreements and abuse of dominance. The DMA complements this by setting behavioural expectations for “gatekeeper” platforms, including obligations on interoperability, access, data usage, and non-discrimination. What is notable is that these instruments are now being applied to behaviour driven by AI systems, rather than only to conventional pricing or market allocation practices.

This marks a different approach to AI governance. Instead of asking whether a model is safe or transparent, regulators are asking whether AI-mediated platform behaviour can distort markets or restrict innovation. When Meta deploys a proprietary AI assistant inside WhatsApp, the question is whether integration limits the ability of alternative AI providers to reach users. When Google trains models on vast amounts of online content, the question is whether its scale of access to data gives it a structural advantage that others cannot match. These are governance issues even if the underlying models are technically aligned with safety guidance.

The practical impact for organisations is that compliance is not only a future concern tied to AI-specific laws. It is already a present risk under existing frameworks. The DMA can require gatekeepers to provide equal access to core platform functionality, which means AI services may need to be interoperable rather than embedded in a closed ecosystem. TFEU provisions allow regulators to intervene if training data access or distribution channels create unfair competitive dynamics. In this view, AI governance is not waiting for the EU AI Act; it is emerging through the instruments that shape digital markets today.

This approach also demonstrates an important governance principle: many of the risks associated with AI are not purely technical. They are economic and structural. A highly accurate model can still raise governance concerns if it concentrates value, limits access, or changes the competitive landscape. By using competition law as a governance tool, Europe is reframing the conversation around AI from “what the model does” to “what the market becomes” once the model is deployed.

As the investigations continue, they may define how AI systems are allowed to integrate into dominant platforms, and whether distribution must remain open to a broader ecosystem of providers. It is a reminder that deep governance can happen through the instruments already on the books, not only those designed specifically for AI.

Looking Ahead

• 17–19 December 2025 – International AI Standards Summit 2025 (Seoul, South Korea)
  A global convening of standards bodies and stakeholders, including representatives from ISO, IEC, ITU and national standards agencies, to advance international standards for AI design, governance, and interoperability.

• 19 December 2025 – ISO/IEC 42001 Implementation Workshop (ISO)
  A practical workshop on how organisations can adopt the new ISO/IEC 42001 AI Management System standard, with implementation guidance and early lessons from industry adoption.

• 22 December 2025 – NIST AI Evaluation Working Group: End-of-Year Outlook
  A review of NIST’s evaluation roadmap going into 2026, including updates on testing benchmarks, documentation tooling and emerging priorities for AI model evaluation.

Closing Thoughts

This week’s developments are a reminder that the governance of AI is no longer confined to model documentation or technical safeguards. It is increasingly shaped by deeper questions about access, distribution, and the invisible architecture of digital platforms. As regulators turn to competition law to guide the trajectory of AI, the focus shifts from what models can do to how the systems around them define who gets to participate in the next chapter of innovation. The challenge ahead is not only building safe technology, but ensuring that the economic structures supporting AI remain open, fair, and accountable to the public interest.

As AI becomes embedded in the tools and platforms we use every day, the question becomes harder to avoid: who should decide the terms under which innovation reaches the people who rely on it?

Until next week,
The AI Governance Today

Welcome back to AI Governance Today. This week, we focus on a different kind of shift taking place in AI governance, not in technical standards or timelines, but in the basic question of who holds regulatory authority. While Europe is adjusting its implementation pathways through the Digital Omnibus, the United States is entering a pivotal debate over whether AI oversight should be shaped nationally or preserved at the state level. Alongside this, we saw updates from Australia, a global warning from the UNDP about widening AI inequality, and new calls for harmonised safety standards across borders. Taken together, these developments show that AI governance is evolving not only through new rules, but through the structures and institutions that determine how those rules come into force.

TL;DR For The Week

• Thirty-five U.S. state attorneys general oppose federal proposals that would block state-level AI regulation, signalling a growing divide in American AI governance.

• UNDP warns that rapid AI advancement may widen inequality between countries lacking infrastructure, governance capacity or regulatory readiness.

• EU faces criticism over proposed changes in the Digital Omnibus that ease data-use restrictions for AI model training under legitimate interest.

• The U.S. government launches “Mission Genesis,” a national AI research platform built on federal scientific datasets with new oversight requirements.

• Australia publishes updated guidance for high-impact AI in public services, emphasising explainability and human oversight.

• A new cross-border analysis shows rising demand for harmonised AI safety standards, with greater alignment around NIST and ISO frameworks.

Spotlight

The New Regulatory Fracture: How AI Governance Is Splitting Between U.S. States and Washington

One of the most significant developments in AI governance this week emerged from the United States, where thirty-five state attorneys general urged Congress not to restrict state-level authority over AI regulation. Their letter was a response to proposed language in the National Defense Authorization Act that would preempt state AI laws and centralise regulatory power at the federal level. While procedural in form, the debate reveals a deeper shift in how AI oversight may take shape across the country.

This moment marks the early stages of a structural divide. While Europe is focused on adjusting timelines and technical standards within a single, comprehensive regulatory framework, the United States is still determining the basic distribution of regulatory power. States have moved quickly over the past two years, introducing laws on deepfakes, automated hiring, transparency duties, consumer protection and AI-enabled deception. From their perspective, local authority allows regulators to respond more effectively to the specific risks faced by their residents, especially in areas like employment, housing, public safety and children’s rights.

Federal policymakers, on the other hand, are increasingly concerned about fragmentation. They argue that a unified national framework is important for clarity, innovation and operational consistency, particularly for companies deploying AI systems across multiple states. A patchwork of divergent state laws, each with different definitions, obligations and enforcement mechanisms, could complicate compliance and slow the adoption of AI tools in critical sectors.

This tension mirrors earlier phases of U.S. technology regulation, such as the period before the emergence of comprehensive privacy laws like the CCPA or global frameworks like GDPR. The question is no longer simply how to govern AI systems but how governance authority should be shared between federal and state institutions.

For organisations operating across the United States, this is more than an abstract policy debate. It influences their risk assessments, documentation strategies, and operational planning. Companies may need to prepare for multi-jurisdictional compliance requirements, uneven enforcement timelines and potential shifts in federal legislation. The landscape may also evolve differently depending on the domain, with some areas trending toward national consistency and others, like consumer transparency or deepfake controls, remaining firmly in state hands.

As debates continue in Washington and in state capitals, the United States is entering a formative period in its AI governance trajectory. The outcome will shape not only regulatory obligations but also the degree of predictability and coherence the AI ecosystem can rely on in the years ahead.

Policy Radar: Regional and Global Governance Shifts

1. UNDP Warns That Rapid AI Adoption Could Widen Global Inequality

Region: Global
The United Nations Development Programme issued a warning that uneven access to AI infrastructure and governance capacity may deepen inequality between states. The report highlights risks for lower-income nations lacking investment, regulatory readiness, or computing resources.

2. U.S. State Attorneys General Oppose Federal Plan to Block State AI Laws

Region: United States
A coalition of 35 state attorneys general asked Congress not to pass federal provisions that would preempt state-level AI regulation. The letter argues that states must retain authority to enforce rules on transparency, deepfakes, and AI-related harms.

3. EU Faces Backlash Over Proposed Loosening of AI Data-Use Safeguards

Region: European Union
Following the European Commission’s “Digital Omnibus” proposals, civil-society groups criticised amendments that expand legitimate-interest allowances for personal data used in AI training and reduce certain transparency obligations. Critics warn the changes dilute privacy protections embedded in the GDPR.

4. U.S. Government Launches “Mission Genesis,” a National AI Research Platform

Region: United States
The U.S. announced “Mission Genesis,” an AI platform integrating federal scientific datasets to support large-scale research in health, climate, energy, and infrastructure. The initiative introduces new governance and oversight requirements for federal AI research environments.

5. Australia Updates Guidance on High-Impact AI in Public Services

Region: Australia
Australia’s Digital Transformation Agency released new internal guidance on classifying and managing high-impact AI systems used in government services. The update stresses explainability, human oversight, and ongoing monitoring for AI used in public decision-making.

6. New Cross-Border Analysis Shows Demand for Harmonised AI Safety Standards

Region: Global
A new multi-country industry analysis published this week shows growing demand for harmonised AI safety and governance standards, particularly among companies operating across jurisdictions. The report notes increasing alignment around frameworks such as the NIST AI RMF and ISO/IEC standards.

Framework Focus

The EU Digital Omnibus on AI: What It Is and Why It Matters Now

We have been tracking the EU’s Digital Omnibus on AI across the past two editions, so it is worth taking a clear look at what this proposal actually is and why it represents a significant moment in the rollout of the EU AI Act. Released on 19 November, the Digital Omnibus is a package of targeted amendments designed to update, refine and in some cases rebalance the regulatory architecture surrounding AI in Europe. Although positioned as a technical adjustment, the Omnibus signals a meaningful shift in how the EU is approaching both timelines and expectations for high-risk AI systems.

At its core, the Omnibus acknowledges that the original AI Act deadlines were too ambitious for regulators and industry to implement effectively. Several high-risk obligations, originally scheduled for enforcement in August 2026, are proposed to be pushed to December 2027. This includes deadlines related to conformity assessments, technical documentation and the availability of harmonised standards. The extension is framed as a pragmatic step: meaningful implementation requires standards, guidance and infrastructure that are still maturing.

The Omnibus also introduces notable changes to data governance. It broadens the conditions under which personal data may be used for model training under the GDPR’s legitimate-interest basis, reducing strict consent requirements. This marks a significant recalibration of Europe’s long-standing privacy posture. Supporters see it as necessary for competitiveness and innovation. Critics argue it may weaken fundamental rights and reduce transparency around how data is used in AI systems.

Another element of the proposal is the streamlining of obligations for low-risk and general-purpose AI systems. Registration pathways and administrative requirements are simplified, reflecting a more risk-based and proportionate approach to compliance. This aligns with a broader recognition that not all AI systems carry the same societal or operational risk and should not be governed in the same way.

The Digital Omnibus represents an evolution of Europe’s approach to AI governance. Instead of a static regulatory design, the EU is shifting toward adaptive implementation, shaped by technical realities and industry capacity. For organisations preparing for AI Act compliance, the Omnibus is an important signal: governance will be phased, standards-driven and responsive to the practical challenges of deploying high-risk AI systems at scale. It is less a retreat and more a recalibration, designed to ensure that enforcement lands in a way that is both credible and workable.

Looking Ahead

• 3 December 2025 – AI Governance Strategies Virtual Summit (ISACA)
  A global online summit discussing enterprise-grade AI governance architectures, risk oversight, audit readiness, and governance for organisations deploying AI systems.

• 8 December 2025 – EU Digital Omnibus Explained: GDPR, AI Act & ePrivacy Changes (OneTrust Webinar)
  An expert panel unpacking the recent EU Digital Omnibus proposals, exploring how the changes to the AI Act, GDPR, and ePrivacy may affect compliance, data use, and AI governance across Europe.

• 8 December 2025 – All Tech Is Human team for an end-of-year Responsible Tech Mixer at Kingston Hall (149 2nd Ave, New York, NY 10003).
  Join the All Tech Is Human community for an end-of-year Responsible Tech Mixer at Kingston Hall in NYC. It’s an informal gathering to reflect on the past year, connect with practitioners across the Responsible Tech ecosystem, and celebrate the work ahead.

Closing Thoughts

This week’s signals remind us that AI governance is no longer moving along a single path. Different regions are converging on similar principles but diverging on authority, timing and implementation. Europe is refining its regulatory machinery, the United States is negotiating the boundaries of state and federal power, and global institutions are warning that governance capacity itself is becoming a new axis of inequality.

For organisations building and deploying AI, this is not just background noise. It is the environment in which systems will be evaluated, questioned and held accountable. The rules may change, but the expectation of evidence, transparency and responsibility is only growing stronger.

As AI becomes more embedded in decisions that matter, the real challenge will not be keeping up with individual regulations but understanding how these fragmented approaches interact, and what that means for trust.

In a world where AI governance is being shaped by competing jurisdictions, emerging standards and shifting expectations, what does it take for an organisation to build trust that endures across all of them?

Until next week,
The AI Governance Today

Welcome back to AI Governance Today. Before we go for a much-needed break with family and friends later this week for Thanksgiving, we look at a shift that is quickly becoming central to responsible AI: the move from talking about principles to actually operationalising frameworks. Around the world, organisations are realising that fairness, transparency, and accountability only matter when they are translated into repeatable processes and real oversight. The City of San José’s adoption of the NIST AI Risk Management Framework captures this change in momentum. It reflects a broader recognition that AI governance is no longer about what we believe, but about how we implement those beliefs in practice. As AI systems become more embedded in public services and critical decisions, framework adoption is emerging as the clearest signal of maturity and the most reliable path to trustworthy deployment.

TL;DR For The Week

• San José becomes the first U.S. city to formally adopt the NIST AI Risk Management Framework, signalling a shift from principles to operational governance.

• European Commission proposes delaying high-risk EU AI Act obligations to December 2027 as part of a broader regulatory simplification effort.

• EU introduces a digital regulation simplification package, including updates to GDPR interpretations for AI training and streamlined consent processes.

• Tennessee adopts a statewide AI governance framework requiring transparency, risk evaluation, and documented oversight across all state agency AI systems.

• West and Central African governments emphasise structured AI governance, data management, and digital readiness at the World Bank’s regional summit.

• Global analysis shows accelerating adoption of formal AI governance frameworks such as NIST AI RMF, ISO/IEC standards, and sector-specific models.

• Japan updates its national AI governance strategy, advancing voluntary guidelines and targeted rules for high-impact sectors.

Spotlight

Frameworks Are Becoming the New Infrastructure of AI Governance

Something important took place this month that did not make global headlines, yet it represents a quiet turning point in the evolution of public sector AI governance. The City of San José formally adopted the NIST AI Risk Management Framework as the foundation for how it evaluates, deploys, and oversees artificial intelligence across its municipal services. On the surface, this sounds like a procedural decision. In reality, it signals a shift that many governments, companies, and institutions will soon have to make.

For years the AI governance landscape has been filled with principles. Every organisation has a version of the familiar triad of fairness, accountability, and transparency. These principles are valuable, but they do not answer the operational questions that determine whether a system is actually safe or trustworthy. Principles cannot tell you how to run a risk assessment, how to judge whether a dataset is appropriate for a given use case, or how to monitor a model after deployment. They offer direction, but they do not offer procedure.

This is why San José’s decision matters. It marks the point where an organisation shifts from asking what its values are to asking how those values will be implemented in practice. The NIST AI RMF gives city teams a common language and a shared method for doing that work. It provides a lifecycle that begins with defining context, continues through data and model evaluation, and carries into deployment, monitoring, and incident response. It replaces vague expectations with concrete actions. Most importantly, it allows different departments to govern AI in a consistent and predictable way instead of improvising their own methods.

When a city commits to a framework, the effects ripple outward. Vendors who want to work with San José are now expected to provide evidence about how their systems were developed and tested. Procurement teams have a structure to evaluate AI proposals instead of relying on marketing language. Legal teams understand their role in risk classification. IT and data teams can map controls to actual engineering tasks. Citizens can understand the roadmap the city follows to protect their rights and wellbeing. This is what it looks like when governance becomes a practice rather than a set of ideals.

There is also something deeper happening underneath the surface. Framework adoption closes a gap that has held back AI governance for years. Many organisations know their intentions but lack the tools to operationalise them. A framework provides the scaffolding on which good governance can be built. It turns questions like “Is this system fair?” into disciplined activities such as documenting dataset lineage, testing for disparate impact, or validating model performance under edge cases. It ensures that every new AI system enters the city’s ecosystem with a documented, repeatable, and reviewable record.

San José is not alone. It is simply early. Many more governments, hospitals, research institutions, and enterprises will follow this path. As AI becomes more embedded in critical services, municipalities and companies alike will need an operating system for governance. Frameworks like the AI RMF provide that foundation. They bring discipline to decision making, make risks visible, and establish a reliable pattern of oversight.

The lesson is simple and increasingly unavoidable. AI governance will not advance through principles alone. It will advance through frameworks that genuinely translate those principles into actions, responsibilities, and evidence. The organisations that adopt these frameworks early will be the ones best prepared for upcoming regulation, public expectations, and the realities of managing complex AI systems in real environments.

Policy Radar: Regional and Global Governance Shifts

1. European Commission Proposes Delay on High-Risk AI Rules

Region: European Union

• The European Commission announced that key high-risk obligations under the EU AI Act will be delayed from August 2026 to December 2027.

• The postponement is part of a broader regulatory simplification effort aimed at easing compliance for both industry and public-sector adopters.

• The delay affects conformity assessments, technical documentation deadlines and oversight requirements for high-risk systems.

2. EU Introduces Digital Regulation Simplification Package

Region: European Union

• The Commission unveiled a new digital regulation simplification package.

• Proposed adjustments include updated GDPR interpretations related to data use for model training and more streamlined consent processes.

• The package aims to harmonise rules across data, privacy and AI governance.

3. Tennessee Adopts a Statewide AI Governance Framework

Region: United States

• Tennessee approved its 2025 Action Plan for AI, creating a formal framework for AI use in state government.

• The plan outlines expectations for transparency, risk evaluation and protections for citizen rights.

• State agencies must document system impacts, assess risks and maintain governance records for all AI deployments.

4. World Bank Summit Highlights AI Governance Priorities in West and Central Africa

Region: Africa

• A regional digital transformation summit in Cotonou focused on the role of AI frameworks in government modernisation.

• Delegates emphasised data governance, infrastructure development and digital skills training as priorities.

• The Cotonou Declaration encourages governments to embed structured AI governance into national digital strategies.

5. Global Industry Overview Shows Rising Adoption of AI Governance Frameworks

Region: Global

• A November global analysis highlighted the growing adoption of formal AI governance frameworks across enterprises and public institutions.

• Organisations are increasingly aligning with the NIST AI RMF, ISO/IEC standards and sector-specific models.

• Framework alignment is becoming a standard expectation in procurement, risk management and compliance workflows.

6. Japan Updates Its National Approach to AI Governance

Region: Japan

• Japan released updated insights on its evolving national AI governance strategy.

• The country continues to combine voluntary guidelines with targeted regulations in high-impact sectors such as healthcare and public administration.

• Recent updates focus on promoting transparency, reliability and responsible deployment across industry and government services.

Framework Focus

Operationalising AI Governance: The NIST AI RMF in Practice

As organisations expand their use of AI across public services, healthcare, finance and critical infrastructure, the real challenge is no longer identifying risks but managing them through systematic and repeatable processes. This is why the NIST AI Risk Management Framework is gaining so much traction this year. Cities like San José are now using it as the foundational approach for evaluating and overseeing AI systems across departments.

Across sectors, teams are moving away from high-level principles and towards lifecycle governance models that can actually be implemented. The AI RMF provides that structure. It gives organisations a common vocabulary and a practical way to translate values such as fairness, accountability and transparency into daily operational work.

The NIST AI RMF Lifecycle:

1. Govern

This is the foundation. Organisations define roles, responsibilities, documentation pathways and oversight requirements before any model is designed or purchased. It includes internal policies, vendor expectations and processes for recording assumptions and risks.

2. Map

Teams describe the context in which an AI system will be used. They document the system’s purpose, map data sources, identify affected groups and anticipate potential impacts. Mapping helps prevent a mismatch between intended use and real-world consequences.

3. Measure

Models are tested and validated through performance evaluation, red-teaming, robustness checks and analysis of failure modes. The focus is on producing evidence that shows how the system behaves, where it works well and where it struggles.

4. Manage

After deployment, systems are monitored continuously. This includes incident tracking, escalation procedures, updates based on real-world feedback and long-term performance assessment. Manage is where governance becomes a living process rather than a single approval point.

Why this matters?

Organisations adopting the AI RMF are discovering a clearer path from ethical intention to practical implementation. Public-sector agencies are using it to bring structure to procurement, decision-making and oversight. As AI becomes more deeply embedded in essential services, frameworks like the AI RMF are becoming essential tools for trustworthy deployment and long-term accountability.

Looking Ahead

• 2 December 2025 – Defining an AI Agent Policy: Governing the Next Wave of Intelligent Systems (OneTrust)
  A session focused on how organisations can build AI agent policies, establish governance controls, and prepare for the operational implications of agentic workflows.

• 3 December 2025 – AI Governance Strategies Virtual Summit (ISACA)
  A global virtual summit exploring enterprise AI governance models, risk controls, audit readiness, and board-level expectations for responsible AI deployment.competitive.

Closing Thoughts

AI governance is entering a phase where maturity is measured not by published principles but by the discipline of operational frameworks and the consistency of their application. As more governments and institutions adopt structured models like the NIST AI RMF, oversight becomes less about isolated approval gates and more about continuous, evidence-driven stewardship across the full lifecycle of an AI system. This evolution mirrors the technology itself: dynamic, adaptive, and deeply interconnected.

But with that progress comes a more strategic challenge. Frameworks provide structure, yet organisations must still confront the fundamental question: Does our level of oversight truly match the complexity and risk of the systems we are deploying?

Until next week,
The AI Governance Today

Welcome back to AI Governance Today. This week, we focus on a clear global shift in AI oversight. Regulators are no longer debating whether humans should remain part of critical AI decisions; that question was settled long ago. The conversation has now moved to a more urgent frontier: how deeply human oversight must be embedded into complex, autonomous, multi-agent systems, and what effective oversight looks like as these systems scale across sectors and jurisdictions. The world is slowly aligning around a principle aviation learned decades ago: the more capable the system becomes, the more essential the human becomes.

TL;DR For The Week

• UK introduces stronger safeguards against AI-generated CSAM and expands enforcement powers.

• UK launches a new Cyber Security and Resilience Bill with implications for AI-related cyber risks and critical digital infrastructure.

• Asia-Pacific judicial bodies receive training on AI, rule of law, transparency, and due-process considerations.

• OECD releases a new report on AI and competitive dynamics across downstream markets.

• Global survey highlights major differences in public trust toward AI regulation across regions.

• Chile advances its national AI regulatory bill, adding to momentum across Latin America.

• Human Oversight 2.0 emerges as a core governance theme as regulators emphasise human–AI teaming across safety-critical sectors.

Spotlight

Human Oversight Is Not Optional: Lessons From Aviation for the Next Era of AI

If you have ever worked around flight systems, you learn one truth early: automation only works when humans and machines understand each other’s roles. My time in the aviation industry made that lesson impossible to ignore. Aircraft today are marvels of automation, yet every system, from flight management to engine health to collision avoidance, is designed with one assumption in mind: that human judgment will remain the final stabilising force when complexity peaks.

Recently, that same principle resurfaced in AI governance. EASA’s new trustworthiness proposal explicitly foregrounds human and AI teaming. Across sectors, regulators are converging on a message aviation learned decades ago.

The more capable the system becomes, the more important the human becomes.

In aviation, automation failures rarely come from a single catastrophic event. They emerge from a drift between what the system was designed to do and what the human operator believes it is doing. Misaligned mental models, unanticipated edge cases, and opaque automation logic can turn minor anomalies into major incidents. The lesson extends directly to modern AI.

Large, distributed, multi-agent AI systems behave much like advanced avionics. They are powerful, probabilistic, context-sensitive, and unpredictable at the edges. And just like in the cockpit, the danger is rarely the AI alone; it is the gap between AI autonomy and human understanding.

This is why human oversight must evolve beyond the simplistic idea of placing a human in the loop. Oversight today must be active, contextual, risk-based, and continuous. It must recognise that humans are no longer supervising a single model, but entire pipelines of agents that communicate, coordinate, and generate downstream effects at scale.

The aviation world calls this human and automation teaming. AI governance now calls it human and AI teaming. The meaning is the same: machines handle volume and speed, humans provide judgment and accountability, and humans retain the ability to recognise when the system is confidently wrong.

As AI systems expand into courts, hospitals, airspace, supply chains, and public administration, we are entering the same phase aviation entered in the 1980s and 1990s: a shift from designing systems that humans use to designing systems that humans must understand and manage.

And if aviation taught us anything, it is this:
True safety comes not from autonomy, but from partnership.

The next era of AI governance will belong to organisations that build that partnership deliberately, with oversight, with transparency, and with a deep respect for the distinct strengths of both humans and intelligent systems.

Policy Radar: Regional and Global Governance Shifts

1. UK Strengthens AI-Generated Child Sexual Abuse Material (CSAM) Safeguards
Region: United Kingdom

• The Internet Watch Foundation (IWF) reported that AI-generated child sexual abuse material (CSAM) cases more than doubled in the past year, rising from 199 in 2024 to 426 in 2025.

• Under new legislation, designated bodies, including AI developers and child-protection organisations, will be empowered to test AI models and ensure they cannot be misused to generate CSAM.

• The legislation amendment will also broaden the ban to include creation, possession or distribution of AI models specifically designed to generate CSAM.

2. UK Introduces the Cyber Security and Resilience Bill Addressing AI-Relevant Cyber-Risks
Region: United Kingdom

• The bill was formally introduced in Parliament to update the UK’s cybersecurity and resilience regime (including digital infrastructure, supply chains and essential services).

• Among its provisions: enhanced incident-reporting timelines, expanded regulatory powers over critical suppliers, and heavier penalties for non-compliance.

• While not strictly an “AI regulation” bill, its relevance to AI arises from the interplay between AI systems, cybersecurity risks (e.g., model poisoning, supply-chain vulnerabilities) and resilience of digital services where AI is embedded.

3. Regional Training on “AI & the Rule of Law” in Asia-Pacific
Region: Asia-Pacific (Bangkok, Thailand)

• The UNESCO together with the United Nations Development Programme (UNDP) and the Thailand Institute of Justice (TIJ) organised a regional training event for judges, prosecutors and justice-sector officials from 11 Asian countries, to explore how AI intersects with the rule of law (e.g., bias, transparency, due process).

• The event emphasises that as AI tools are increasingly adopted in judicial settings (case management, legal research, etc.), governance and human-rights issues must be addressed.

4. Organisation for Economic Co‑operation and Development (OECD) Publishes Report on AI & Competitive Dynamics
Region: Global / OECD Member Countries

• The OECD released a policy paper titled “Artificial intelligence and competitive dynamics in downstream markets”.

• The report signals how international organisations are increasingly shaping the policy discourse on AI governance and competition frameworks.

5. Global Survey on Public Trust in AI Regulation
Region: Global

• A survey across 25 countries found wide disparities in public confidence in how well major powers (e.g., the European Union, United States, China) can manage AI regulation. For example, respondents in Germany and Netherlands showed much higher trust in the EU than those in Latin America did.

• It reflects a significant policy-signal about the political legitimacy and societal acceptance of AI governance frameworks.

6. Legislative Progress on AI-Regulation in Chile
Region: Latin America (Chile)

• The lower house of Chile’s Congress advanced a bill to regulate artificial intelligence systems, which is now moving to the Senate.

• This adds to the trend of Latin American jurisdictions pursuing formal regulatory frameworks, albeit this item is “in progress” rather than fully enacted.

Framework Focus

Human Oversight 2.0: A Framework for High-Risk, Multi-Agent AI Systems

As AI systems become more autonomous and increasingly deployed in aviation, justice, healthcare, and critical public services, the old idea of simply “keeping a human in the loop” is no longer sufficient. Two developments this week make that clear: EASA’s new aviation trustworthiness guidance emphasises human–AI teaming, and UNESCO’s Asia-Pacific judicial workshop highlighted the due-process challenges when AI supports legal decision-making.

Across sectors, organisations are recognising that oversight must evolve from reactive intervention to active governance across distributed, multi-agent systems.

The Human Oversight Spectrum:

1. Human-in-the-Loop (HITL)
A human must approve or intervene before the system takes an action. Typical in high-risk decision pipelines such as clinical judgments and adjudication tools.

2. Human-on-the-Loop (HOTL)
Real-time supervision with the ability to override system behaviour. Common in aviation, autonomous operations, and continuous monitoring systems.

3. Human-over-the-Loop (HOVTL)
Periodic monitoring informed by risk triggers, dashboards, and escalation logic. Suited to multi-agent LLM systems, adaptive workflows, and predictive pipelines.

4. Human-beyond-the-Loop (HBTL)
Humans provide long-horizon oversight such as audits, red-team reviews, post-market surveillance, and governance checkpoints for autonomous agents. Essential for systems that learn or evolve after deployment.

Why it matters:

• EASA’s proposed guidelines formalise human–AI teaming as a required safety layer.

• Judicial bodies in Asia-Pacific are being trained on how oversight must adapt when AI participates in legal reasoning.

• Multi-agent AI architectures are becoming the norm, and oversight must match that complexity.

Looking Ahead

• 20 November 2025 – Technology Oversight in the Age of AI: Risks and Opportunities (NACD)
  Board-focused webinar on how directors should approach AI risk, governance responsibilities, and oversight of rapidly evolving AI systems from a strategic and fiduciary perspective.

• 20 November 2025 – AI in Discovery: Real-World Litigation Applications (ABA)
  A practical session examining how AI is transforming evidence review, e-discovery workflows, and litigation strategy through real-world case applications.

• 21 November 2025 – A New Frontier of AI Readiness: How Legal Employers Are Adopting AI and What It Means for New Lawyers (ABA)
  A forward-looking discussion on how law firms, courts, and legal departments are integrating AI tools, and what competencies new lawyers must build to stay competitive.

Closing Thoughts

Oversight is shifting from static supervision to dynamic, continuous governance, not over a single system but across networks of interacting AI agents that learn, coordinate, and evolve over time. As organisations move from pilot deployments to scaled, production-grade AI, the challenge is no longer just adding a human checkpoint but understanding how oversight distributes across agents, interfaces, and decision pathways.

This raises a deeper and more strategic question for every organisation deploying AI today: At which level of oversight are we operating, how does that map to the actual risk profile of our systems, and is it enough for the decisions and consequences we are now responsible for?

Until next week,
The AI Governance Today

Welcome to the first issue of AI Governance Today, a weekly briefing that explains how governments, companies, and institutions are shaping the rules of artificial intelligence. Each edition tracks the global pulse of AI policy: the regulations that define boundaries, the frameworks that translate ethics into practice, and the governance models that determine how technology earns public trust.

We begin this journey at a pivotal moment. Europe’s landmark AI Act, long regarded as the world’s most comprehensive AI regulation, is facing its first real test. How it weathers this moment will shape the future of global AI governance.

TL;DR For The Week

• EU’s AI Act under pressure: The European Commission may delay enforcement and soften penalties, prompting concerns that Europe’s landmark law could lose credibility before it begins.

• Global governance realignment: China proposed a World AI Cooperation Organization at APEC, signalling ambitions to shape multilateral AI rules.

• China’s new AI standards: Three national standards for generative AI, covering data annotation, dataset safety, and cybersecurity, came into force on 1 Nov 2025.

• U.S. states step up: California and New York lead with new AI transparency and safety laws as federal regulation stalls.

• Sector spotlight – Aviation: EASA issued new guidelines on AI trustworthiness and human-AI teaming for safety-critical systems.

• India’s governance push: India launched AI Governance Guidelines 2025 (“Do No Harm”) and proposed deepfake-labeling amendments under its IT Rules.

• Framework focus: The new Five-Layer AI Governance Model connects regulation → standards → assurance → certification → implementation, offering a practical blueprint for operationalising AI governance ahead of 2025–26 compliance deadlines.

Spotlight

The European Union’s landmark Artificial Intelligence Act is facing what may be its first true stress test. Reports suggest that the European Commission is preparing to soften enforcement measures and offer a grace period before fines take effect. At first glance, this may appear to be a pragmatic move. Europe is under growing pressure to remain competitive as the United States, China, and other regions rapidly advance their AI capabilities. Compliance costs under the Act are significant, especially for smaller firms and open-source developers. A phased or flexible rollout could, in theory, allow innovation to continue while regulators build capacity. But there’s a deeper concern. The AI Act was meant to be the world’s first comprehensive AI law, a model of human-centric governance that balances innovation with safety, transparency, and accountability. If its enforcement is diluted before it even begins, the EU risks undermining its credibility as a global rule-setter. The message to the world would be that strong AI regulation is aspirational, not operational. Europe’s position has always been distinctive. It may not lead in the raw development of AI models, but it has long sought to lead in setting ethical and legal standards. Weakening those standards now, especially under pressure from major tech firms, could erode public trust and discourage smaller innovators who depend on a fair, predictable regulatory environment. The lesson here is not that Europe should be rigid. Rather, it should be resilient. A regulatory framework can evolve without surrendering its integrity. Enforcement flexibility can be balanced with firm commitments to transparency, oversight, and rights protection. The AI Act’s greatest strength was its moral clarity. Its next challenge will be proving that clarity can survive real-world pressure.

Policy Radar: Regional and Global Governance Shifts

1. EU Rethinks AI Act Enforcement Timeline
Region: Europe

The European Commission is considering easing the timeline for enforcing provisions of the Artificial Intelligence Act following pressure from industry and U.S. officials. Proposed changes include:

• A one-year grace period for high-risk AI systems placed on the market before the Act’s enforcement date.

• Loosening registration requirements for narrowly scoped systems.

• Phased enforcement of transparency rules for AI-generated content.

These revisions are part of a broader “Digital Omnibus” draft expected to be unveiled mid-November. Final approval is still pending from the EU Parliament and member states.

2. China Proposes Global AI Governance Body at APEC
Region: Global (China-led)

At the APEC summit, China proposed the creation of a “World Artificial Intelligence Cooperation Organization” to establish global AI rules. Framing AI as a public good, China positioned itself as a leader in multilateral AI regulation, contrasting with the U.S. preference for domestic approaches.

3. China Implements New Domestic AI Security Standards
Region: China
Date Effective: November 1, 2025

China activated three new national standards to govern generative AI:

• Data annotation security guidelines

• Dataset safety evaluation protocols for pre-training and fine-tuning

• Baseline cybersecurity requirements for generative AI platforms

These technical rules further formalize China’s risk-based approach to AI safety and ethics.

4. U.S. States Take the Lead in AI Legislation
Region: United States

With no comprehensive federal AI law, states like California and New York are leading the charge:

California:

• Enacted the Transparency in Frontier Artificial Intelligence Act (SB 53), requiring developers of advanced models to assess catastrophic risks and publish transparency reports.

• Vetoed the “No Robo Bosses Act” (SB 7), citing overlapping regulations and implementation concerns.

• Finalized privacy regulations for automated decision-making, effective 2027, focused on notification, opt-outs, and risk assessments.

New York:

• Passed the Responsible AI Safety and Education (RAISE) Act, now awaiting the governor’s approval. Targets frontier models with >$100M training costs.

• Additional bills address AI labeling on social media, synthetic performer disclosures in ads, AI likeness protections, and expanded oversight of state agency AI use.

5. EASA Releases AI Trustworthiness Guidelines for Aviation
Region: Europe

The European Union Aviation Safety Agency (EASA) issued a Notice of Proposed Amendment for AI use in aviation. The framework includes:

• Validation protocols for AI-based decision aids

• Human-AI teaming requirements

• Ethical and transparency safeguards for safety-critical applications

This proposal is now open for public consultation and aligns closely with the broader EU AI Act.

6. India Launches AI Governance Guidelines and Tackles Deepfake Risks
Region: India

India’s Ministry of Electronics and IT (MeitY) released the “India AI Governance Guidelines,” outlining a principle-based framework centered on the motto “Do No Harm.” Key features include:

• Establishing new institutions: AI Governance Group (AIGG), Technology & Policy Expert Committee (TPEC), and AI Safety Institute (AISI).

• Short-, medium-, and long-term actions on infrastructure, capacity, regulation, and risk.

• Reliance on existing laws (IT Act, DPDP Act, etc.) for regulation, with new legislation possible in the future.

• Emphasis on voluntary ethical guidelines and sector-specific regulation.

Simultaneously, MeitY proposed amendments to the IT Rules, 2021, requiring social media platforms to label and watermark AI-generated content. Public consultation on these amendments was extended to November 13. Industry stakeholders have expressed concern about feasibility and potential impact on innovation. A full-fledged “AI Act” is being considered for Parliamentary introduction in the near future.

Framework Focus

The most pressing challenge in AI governance isn’t crafting new rules – it’s making them work in practice. A fresh framework offers a clear way for organisations and regulators to bridge that gap.

The Five-Layer AI Governance Model
This model sees governance as a stack of five inter-dependent layers:

1. Regulation – Broad laws, statutes and policy mandates (for example the EU AI Act or NIST’s AI Risk Management Framework).

2. Standards – Operational definitions and normative norms (for example ISO/IEC 42001, IEEE 7000) that translate regulation into technical or organisational terms.

3. Assurance – Independent audits, conformity assessments and third-party checks of compliance with standards.

4. Certification – Formal validation or accreditation demonstrating that an organisation or system has achieved a recognised level of compliance maturity.

5. Implementation – The on-the-ground processes, documentation, monitoring systems, lifecycle controls and governance practices that embed all the previous layers into daily operations.

Why it matters:

• It delivers a practical blueprint linking high-level rules (layer 1) to everyday operational realities (layer 5).

• It highlights that good regulation or standards alone don’t guarantee effective governance – you also need assurance, certification and strong internal implementation.

• With many jurisdictions moving toward compliance deadlines in 2025–2026, this stack helps organisations spot where their weakest link might be (e.g., laws in place but no assurance mechanism; good standards but poor implementation).

• For practitioners designing and deploying AI systems (especially across borders, multiple agents or supply-chains) it offers a roadmap to ask: Which layer are we weakest in? Where will regulators likely focus next?

• For regulators and policy-makers it suggests that enforcement isn’t just about laws – it’s about ensuring standards are adopted, audits are credible, certifications count and firms embed the practices.

Looking Ahead

• 1 January 2026 – New U.S. state-level AI and data-governance laws take effect in California, Colorado, and Connecticut, introducing algorithmic-accountability and transparency requirements for companies deploying AI in consumer and employment contexts.

• 19–20 February 2026 – AI Impact Summit, Delhi, India
  Global event spotlighting applied AI governance, responsible deployment, and regional collaboration on AI policy.

• 24–26 February 2026 – International Association for Safe and Ethical AI (IASEAI) 2026 Conference, Paris
  A leading forum on safe and ethical AI practices convening regulators, researchers, and industry leaders to discuss implementation of global frameworks.

Closing Thoughts

AI governance is entering a defining phase. The headlines this week, from Europe’s wavering enforcement to China’s push for global coordination and India’s principle-based approach, show that the world is no longer debating whether to regulate AI but how to do it. The balance between flexibility and credibility will determine which regions lead in shaping responsible innovation.

Rules alone are not enough. The Five-Layer Governance Model underscores that true oversight lives in the details of implementation, assurance, and certification. As new compliance timelines draw near, the real challenge for both regulators and organisations will be translating ideals into everyday practice while safeguarding trust, accountability, and human values. One question looms large: Can humanity govern intelligence that is learning faster than our ability to regulate it?

Until next week,
The AI Governance Today