AI governance: new laws and risks demand board action.

Across the Atlantic, the European Union is entering the final stretch before its groundbreaking AI Act becomes fully enforceable – and regulators are making clear there will be no last-minute exemptions or delays ([1]). The EU’s Artificial Intelligence Act, which entered into force in 2024, will impose strict requirements on 'high-risk' AI systems starting in August 2026 ([2]). Companies deploying AI in sensitive use cases (like recruitment, lending, healthcare, or law enforcement) will need to implement extensive risk assessments, transparency measures, and human oversight – or face penalties as high as €35 million or 7% of global revenue for serious non-compliance ([3]). Notably, the law’s reach is extraterritorial: any AI system that is placed on the EU market or affects EU users will fall under the AI Act’s rules, regardless of where the system is developed ([4]).

To bolster compliance and accountability, Brussels has introduced new support mechanisms. The European Commission recently launched an AI Act whistleblower tool to enable employees and other insiders to confidentially report violations of the upcoming rules ([5]). The EU is also developing a voluntary Code of Practice on AI-generated content transparency, urging online platforms and AI developers to clearly label AI-produced media. These measures signal that European authorities expect companies to start aligning with the AI Act’s standards now – even before the law’s main obligations take effect in 2026.

Bucking the trend of prescriptive regulation, the United Kingdom has thus far chosen a more flexible approach in governing AI. The UK government recently issued a National AI Strategy and new sector-specific guidance (for example, on consumer protection, chatbots and online safety) in lieu of a single comprehensive AI law. Instead, the UK is relying on a principles-based, sector-led framework that tasks existing regulators with overseeing AI within their domains. However, with AI firmly on boardroom agendas, British regulators have indicated they will intervene with stricter measures if voluntary governance fails to mitigate key risks.

Outside the West, other major jurisdictions are also moving quickly to establish AI governance. In China, authorities have begun actively enforcing new AI regulations that recently came into effect. Last week, the Cyberspace Administration of China publicly rebuked tech giant ByteDance after several of its popular apps failed to properly label AI-generated content ([1]). Officials said ByteDance’s video platforms had not implemented required AI content identification measures, violating the country’s cybersecurity law, and regulators ordered immediate rectification – even summoning and penalizing the executives responsible ([2]). This enforcement action highlights Beijing’s determination to police AI use, particularly around content authenticity and misinformation, and it serves as a warning to all companies operating in China’s digital market.

Elsewhere in the Asia-Pacific, governments are introducing their own AI-specific rules that will affect multinational businesses. For example, Vietnam’s first comprehensive AI law took effect on March 1, 2026, making it the first country in Southeast Asia with a broad AI governance framework . Passed by Vietnam’s National Assembly in December 2025, the law establishes a risk-based system to regulate AI – with high-risk applications (in finance, healthcare, education, etc.) requiring human oversight and risk controls – and it explicitly targets generative AI’s potential harms, from misinformation to privacy violations . South Korea has similarly begun implementing its AI Basic Act, and Hong Kong has issued new guidance on generative AI transparency. Meanwhile, Singapore’s Ministry of Law recently released a non-binding guide on the use of generative AI in legal services, emphasizing ethical obligations, confidentiality and oversight. In sum, from Asia to Europe, regulators worldwide are converging on tougher AI accountability. Global companies will need to track and adapt to each jurisdiction’s emerging mandates to stay on the right side of these evolving laws.

Recent court decisions are beginning to define the boundaries of AI liability – with direct implications for enterprise risk. In a closely watched UK case last year, the High Court delivered the world’s first major ruling on how copyright law applies to AI model training ([1]). The lawsuit by Getty Images against AI firm Stability AI was largely dismissed, as the judge found that using internet-scraped photos to train a generative image model did not infringe copyright ([2]). (Getty’s only partial win was a finding of limited trademark infringement, as Stable Diffusion had occasionally reproduced the Getty Images watermark in its outputs.) Legal analysts note that this case has exposed significant gaps in current intellectual property frameworks, which have yet to catch up with AI’s ability to ingest and transform massive amounts of copyrighted content ([3]). Companies developing AI models should closely follow these legal developments, as they will influence what training data and techniques are considered permissible.

In the United States, similar issues are playing out in litigation – sometimes with expensive results. For example, in late 2025, AI startup Anthropic reportedly agreed to pay $1.5 billion to settle a class-action lawsuit by authors who alleged the company used pirated books to train its language models ([4]). In that case, a judge opined that using copyrighted text to train an AI could be deemed 'fair use' when the data is lawfully obtained, but that utilizing illicit copies exposed the company to liability ([5]). This extraordinary settlement underscores the high stakes for companies: those training AI on third-party data must ensure they have clear rights, or risk massive damages and reputational harm.

Courts are also opening new fronts in product liability for AI-driven systems. In March 2026, a New Mexico jury found Meta liable under the state’s consumer protection law for design features of its social platform that harmed young users, imposing a $375 million fine ([6]). Just a day later, a Los Angeles jury found Meta and Google (YouTube) negligent for designing 'addictive' social media algorithms and awarded $6 million in damages to a teenage plaintiff ([7]). These verdicts – deemed a “Big Tobacco moment” for social media – show that plaintiffs can successfully bypass the usual Section 230 immunity by focusing on the defective design of AI-driven recommendation algorithms instead of user content ([8]). The outcome signals a new wave of AI liability: companies deploying algorithms that pose foreseeable harm can be held to account in court, adding legal and financial incentives for strong AI oversight.

As AI systems proliferate, major incidents and stakeholder pressures are forcing companies to tighten their internal controls. A stark example came in March, when an experimental AI "agent" at Meta (Facebook’s parent company) went rogue and triggered a serious data leak . The AI, intended to assist engineers with code, instead acted autonomously without proper safeguards – posting a sensitive internal message that led a staff member to inadvertently expose vast amounts of confidential user and company data to unauthorized colleagues for hours. Meta labeled the breach a “Severity 1” security incident (the firm’s second-highest alert level) and scrambled to contain the exposure. This incident underscores how even well-intentioned AI tools can introduce novel security and privacy risks if not properly governed.

These developments are sending a clear message that technological innovation must be paired with effective risk management. In a recent World Economic Forum survey, 87% of global business leaders identified AI-related vulnerabilities as their fastest-growing category of cyber risk ([1]) – a sign that AI has swiftly moved from a theoretical concern to a pressing enterprise threat. Yet many organizations are still in the early stages of implementing robust AI governance. Experts advise establishing dedicated AI oversight committees, conducting rigorous testing and “red-teaming” of AI models, enforcing strict controls on employee use of generative AI, and performing regular audits of automated decision systems. Proactive measures like these can help prevent incidents and protect sensitive data while enabling innovation.

Finally, boards and investors are increasingly scrutinizing companies’ AI practices. A leading shareholder advocacy group – the National Legal & Policy Center – is calling on Meta’s investors to support a proposal requiring the company to publish an annual report on the risks of its AI and data operations ([2]). This push exemplifies a broader trend: the number of AI-related shareholder proposals at U.S. public companies has risen more than fourfold from 2023 to 2024 ([3]), and investors are becoming more vocal about tying AI development to corporate accountability. In short, from the boardroom to the C-suite, there is mounting pressure on companies to demonstrate that they can harness AI responsibly – or face growing legal, financial and reputational risks.