AI under scrutiny: new rules, lawsuits, and investor demands.
Regulatory developments: Europe leads amid global splits.
European authorities are pressing ahead with stricter AI rules – but also giving companies more time to adapt. This week, EU lawmakers reached a provisional agreement to adjust the implementation timeline of the landmark Artificial Intelligence Act ([1]). The deal, part of the EU’s broader 'Omnibus VII' legislative package to simplify digital regulations, postpones enforcement of new 'high-risk' AI requirements by roughly 16 months, aligning them with the availability of necessary technical standards and compliance tools. EU officials say this delay will reduce recurring administrative costs for businesses and ensure greater legal certainty and smoother implementation of the rules across the single market ([2]).
At the same time, the updated EU proposal tightens certain safeguards in response to public concern. Lawmakers introduced a new provision explicitly prohibiting AI systems from generating non-consensual sexual or intimate content – including deepfake pornography and child sexual abuse material (CSAM) ([3]). They also reinstated an earlier requirement for providers to register all high-risk AI systems in an EU database, bolstering the powers of the new European AI Office and reducing governance fragmentation ([4]). Some obligations will be eased for smaller AI developers – for example, extending certain compliance exemptions for small businesses to 'small mid-cap' companies – and the law will allow limited processing of sensitive personal data for bias detection ([5]). Nonetheless, the message from Brussels is clear: the EU is doubling down on AI accountability, even as it fine-tunes implementation details to help industry meet these sweeping requirements.
Elsewhere, governments are charting different paths. In the United States, there is still no comprehensive AI statute – but in late 2025, President Trump issued an executive order aimed at pre-empting a patchwork of state AI laws and promoting minimally burdensome nationwide standards ([6]). Earlier this month, top U.S. AI firms – Microsoft, Google’s DeepMind, and Elon Musk’s xAI – agreed to let the U.S. government’s AI security center vet their most advanced models for safety before release . This voluntary 'pre-release testing' program reflects Washington’s preference for cooperation over new hard regulations. Meanwhile in the UK, the government has likewise put a dedicated AI law on hold; a draft AI Bill once expected by late 2025 is now delayed until at least the summer of 2026 ([7]) ([8]). Britain’s shift – widely seen as aligning with the U.S.’s hands-off approach – means it will continue relying on existing sectoral regulators and guidance for AI oversight, a sharp contrast to the EU’s more prescriptive regime.
International coordination on AI remains elusive. At a global AI summit in Paris this week, co-hosted by France and India, dozens of countries (including China) signed a declaration calling for AI to be open, inclusive, secure, and sustainable ([9]). The United States and United Kingdom, however, refused to support this pledge ([10]). U.S. Vice-President J.D. Vance, speaking at the Paris summit, warned that 'excessive regulation of the AI sector could kill a transformative industry' ([11]). He also hinted that overly restrictive policies might push democratic nations into closer technological cooperation with authoritarian regimes – a pointed critique of Europe’s regulatory stance. This trans-Atlantic split underscores the challenge for global companies: they must navigate an increasingly fragmented landscape as major jurisdictions pursue starkly different approaches to governing AI.
Legal & liability: courts confront AI accountability.
High-profile lawsuits are now putting AI accountability to the test. The most dramatic example came on May 18, when a California jury unanimously threw out Elon Musk’s $150 billion lawsuit against OpenAI as time-barred ([1]). Musk – who had co-founded OpenAI as a nonprofit – claimed that CEO Sam Altman and others improperly turned the research lab into a for-profit enterprise for personal gain. The court, however, never weighed in on that allegation; instead it ruled that Musk simply waited too long to sue, dismissing his case on a strict statute-of-limitations technicality ([2]). This verdict eliminated the threat of a massive $150 billion payout (and even a potential unwinding of OpenAI’s corporate structure) while clearing the path for the company’s anticipated $1 trillion IPO ([3]).
OpenAI’s legal victory, however, came with some reputational cost. The trial saw several former OpenAI insiders testify – under oath – that Altman and his team had betrayed the organization’s founding principles by prioritizing aggressive commercialization ([4]). Musk has vowed to appeal, but because the case was decided on a procedural technicality, most experts doubt the verdict will be reversed on appeal.
Meanwhile, a new set of lawsuits is exploring whether AI providers can be held liable when their systems cause harm. On May 20, the Superior Court of California ordered 12 pending suits against OpenAI – all alleging that its ChatGPT chatbot is 'unreasonably dangerous' – to be combined into a single proceeding ([5]). The plaintiffs argue that ChatGPT’s design and lack of safeguards allowed it to encourage harmful behaviors, leading to severe real-world injuries to users’ mental health ([6]). In one tragic case, a 14-year-old took their own life after interacting with a different company’s AI chatbot that reportedly encouraged suicidal ideation ([7]). Such cases represent a novel attempt to apply traditional product liability and negligence law to generative AI services ([8]) – raising the stakes for any business deploying AI without proper safety controls.
Regulators are also stepping in to enforce AI accountability using laws already on the books. In recent months, U.S. agencies – including the FTC, SEC, DOJ and EEOC – have all launched AI-related investigations or enforcement actions under existing consumer protection, privacy, and anti-discrimination statutes ([9]). State attorneys-general are similarly probing AI systems suspected of facilitating fraud, bias or privacy violations ([10]). The upshot: even without new AI-specific legislation, companies face real legal exposure for AI-driven harms. The common thread in these developments is that when AI systems cause damage or rights abuses, it’s the companies behind them – not the algorithms – that will be held responsible ([11]).
Boardrooms and investors push for responsible AI.
Regulatory and legal pressures are now reaching the boardroom. A key example unfolded at Amazon, where an investor coalition declared this week that it will vote against four veteran board members after Amazon’s leaders blocked several shareholder resolutions on AI governance ([1]). (One rejected proposal, for instance, had urged the company to ensure its AI products and cloud services align with its stated Responsible AI principles ([2]).) This highly unusual revolt at one of the world’s largest tech companies shows that shareholders are no longer willing to tolerate lax oversight of AI risks.
The Amazon clash is part of a broader wave of investor activism demanding stronger AI risk management. Major companies including Microsoft, Alphabet, and Apple have all faced shareholder pressure to improve transparency and controls around their use of AI and data ([3]). In April, a group of Alphabet investors wrote to Google’s parent company – after management opposed an AI risk disclosure proposal – seeking details on how it governs the use of its AI and cloud technologies by government clients ([4]). They pointed to Google’s recent US$68 million settlement over claims that its voice assistant illegally recorded users without consent ([5]) as a costly example of how unchecked AI practices can erode trust and invite financial penalties. The takeaway from investors and governance experts alike: formal board-level oversight of AI is now seen as essential for safeguarding corporate reputation and long-term value.
Regulators are echoing the call for better board oversight of AI. In late April, the Australian Prudential Regulation Authority (APRA) warned banks that their boards must treat AI as a distinct risk domain spanning the entire AI lifecycle – or face 'stronger supervisory action' and potential enforcement measures ([6]) ([7]). And on May 15, the Bank of England, together with the UK’s Financial Conduct Authority and HM Treasury, issued a joint statement warning that the 'cyber capabilities of current frontier AI models are already exceeding what a skilled practitioner could achieve' – and at far greater speed ([8]). The clear message: governing AI has become a C-suite and board-level responsibility. Organizations that fail to embed robust AI governance and risk controls at the highest levels risk regulatory intervention, legal liabilities, and loss of stakeholder trust.