AI Governance Reaches a Crossroads as New Rules and Risks Surge

European Union institutions are putting the finishing touches on the landmark EU AI Act as its most significant provisions near full enforcement. EU negotiators reached a provisional agreement in early May to streamline the AI Act’s rules, including a new ban on AI that generates non-consensual deepfake imagery and child sexual abuse material ([1]). They also agreed to extend the deadlines for certain high-risk AI requirements: standalone high-risk systems now have until December 2027 to comply, and high-risk AI systems embedded in products until August 2028 ([2]). This delay gives companies more time to meet strict compliance obligations, even as other rules – such as a shortened three-month timeline for labeling AI-generated content – have been tightened ([3]).

From August 2, 2026, the EU’s AI Act will be fully enforceable, marking the world’s first comprehensive law regulating artificial intelligence. The Act imposes hefty penalties of up to €35 million or 7% of global annual turnover for non-compliance ([4]) – the toughest fines ever for AI violations. High-risk AI systems in areas like healthcare, finance, education, employment, and law enforcement will require rigorous risk management, data governance measures, technical documentation, record-keeping, transparency, human oversight, accuracy, and cybersecurity controls before deployment ([5]). National agencies in each EU member state will enforce these requirements, while a new European AI Office will coordinate cross-border supervision of “general purpose” AI models.

These developments mean any company operating in or selling AI systems into the EU must swiftly align with the AI Act’s requirements. Enterprises should be auditing their AI applications now to determine if they fall into a regulated risk category and, if so, implement the necessary compliance steps – from bias testing and data documentation to human-in-the-loop oversight. With the EU setting a de facto global benchmark for AI governance, even companies outside Europe may face pressure to adopt similar safeguards in order to maintain market access and public trust.

The United Kingdom – which has so far favored a lighter, principles-based approach over new AI-specific legislation – is encountering growing calls to shore up its AI governance framework. In March 2025, a member of the House of Lords introduced an Artificial Intelligence Regulation Bill that would create an independent AI Authority to monitor AI-related economic risks and enforce principles of security, fairness, and accountability ([1]). Lord Chris Holmes, the bill’s sponsor, has criticized the government for failing to keep pace with rapid AI developments, noting that his earlier attempt to pass similar legislation in 2023 saw little action from ministers despite broad agreement on its urgency ([2]).

The UK government has also shown reluctance toward some international AI oversight efforts. Britain – alongside the United States – declined to sign an AI governance agreement at a recent global summit in Paris, citing concerns about unclear guidelines for global AI regulation and unresolved national security issues ([3]). Additionally, officials quietly repurposed the planned AI Safety Institute (initially meant to tackle algorithmic bias and digital rights) into an AI Security Institute focused primarily on preventing criminal misuse of AI, prompting criticism that broader ethical concerns are being sidelined ([4]).

Facing criticism from lawmakers and experts, UK officials now say they will launch a public consultation to develop a more comprehensive regulatory framework for AI in the coming months ([5]). For British businesses, these signals indicate that more concrete rules or binding guidance could emerge sooner rather than later. Companies – especially in regulated industries like finance or healthcare – should engage proactively with policymakers and adopt strong internal AI risk management practices, anticipating that the UK may tighten its oversight to keep pace with global standards.

In the U.S., federal authorities are taking bold actions that underscore how critical AI has become to national interests and corporate accountability. On June 5, President Donald Trump issued a memorandum instructing national security agencies to use multiple AI providers rather than relying on a single vendor ([1]). This directive followed a clash between the Pentagon and AI firm Anthropic PBC – until recently the Defense Department’s sole contractor for advanced AI – after the company insisted on strict limits on how its technology could be used in warfare and surveillance. Those negotiations collapsed in February, when the Pentagon labeled Anthropic a supply-chain risk and moved to drop it as a vendor ([2]). In response, Trump’s memo seeks to ensure that no one AI company can hold critical military systems hostage; it directs agencies to diversify suppliers and sever ties with firms that refuse to support all lawful military use cases for their AI ([3]).

The administration’s aggressive posture doesn’t end there. Alongside the memo, President Trump also signed an executive order aimed at preventing AI-enabled cyberattacks, and even raised the possibility of the U.S. government taking equity stakes in leading AI labs ([4]). Such measures – practically unheard of in recent decades – reflect a determination to maintain American leadership in artificial intelligence and to mitigate potential threats. They also send a clear message to AI vendors: those seeking federal contracts must be prepared to comply with government oversight and operational requirements, or risk losing access to a lucrative market.

Meanwhile, a showdown is brewing between federal and state authorities over AI regulation. In an unprecedented step, the U.S. Department of Justice intervened in April to support a lawsuit by Elon Musk’s startup xAI that challenges Colorado’s new law outlawing algorithmic discrimination in AI systems ([5]). The DOJ argues that Colorado’s law – which requires AI developers to actively prevent even unintentional bias – oversteps constitutional bounds, characterizing such mandates as imposing 'woke' ideology on technology providers ([6]). This is the first time Washington has formally contested a state’s AI-specific regulation in court ([7]). For companies, the situation foreshadows a complex compliance environment: differing state AI laws (covering issues from bias to data privacy) could conflict with each other or with eventual federal rules. Until a unified national policy is established, businesses operating across the U.S. must closely track state-level developments and be ready to adapt their AI systems to varying legal requirements.

Courts are becoming key arenas for defining the liabilities and intellectual property boundaries of AI. One pivotal case will reach a courtroom in the coming days: on June 11, the Third Circuit Court of Appeals is set to hear Thomson Reuters v. Ross Intelligence, the first U.S. appellate case on whether training an AI on copyrighted text can qualify as fair use ([1]). The lawsuit originates from a 2025 district court ruling that found the AI startup (Ross) infringed copyrights by using proprietary legal materials (Westlaw headnotes) to train its model, since the use was not deemed 'transformative' under fair use doctrine ([2]). The appellate decision will have far-reaching implications; if the lower court is upheld, AI firms will need to obtain licenses or drastically change their data training practices to avoid liability, whereas a reversal could widen access to data for AI but intensify content owners’ concerns.

Media and entertainment companies are also stepping up efforts to protect their content from AI systems. In late May, CNN filed a lawsuit accusing AI search startup Perplexity.ai of illegally scraping over 17,000 articles, images, and videos from CNN’s platforms and other news outlets ([3]). The complaint also alleges that Perplexity misled users about its sourcing, even implying a partnership with CNN – a potential trademark violation ([4]). This suit joins a growing list of at least nine major publishers and content creators (including The New York Times, News Corp, Getty Images, Reddit, and others) that have sued AI developers for copyright or trademark infringement in the past year ([5]). The proliferation of such cases is a warning sign: companies deploying AI, or providing data to AI firms, must ensure they have rights to the data being used, and that their AI outputs don’t run afoul of defamation, privacy, or IP laws.

These ongoing legal battles are a reminder that ethical and compliant AI use isn’t just a regulatory matter, but a business risk. With regulators also eyeing the outcomes – and the EU AI Act explicitly holding providers liable for certain AI harms – organizations should consult legal counsel to review their AI training datasets, vendor agreements, and deployment strategies. Preparing for potential litigation now, through audits and robust risk mitigation, will put companies in a stronger position as precedent-setting rulings emerge.

This week’s events also highlight that responsible AI is increasingly a boardroom and investor priority. In a proactive step, OpenAI has published a detailed Frontier Model governance framework (on May 28) to transparently align its internal AI safety measures with expected regulations like the EU’s general-purpose AI guidelines and California’s new transparency laws ([1]). By voluntarily mapping its practices to upcoming legal standards, one of the leading AI firms is not only trying to build public trust but also setting a precedent that others in the industry may be pressured to follow.

Across industries, board oversight of AI is surging. An analysis by proxy adviser ISS found that about one-third (31.6%) of S&P 500 companies formally disclosed board or board-committee oversight of AI in 2024 – a jump of over 84% from the prior year ([2]). Boards are increasingly adding directors with AI expertise and establishing dedicated frameworks for reviewing AI initiatives, ensuring issues like bias, privacy, and security are addressed at the highest levels. This shift indicates that companies recognize AI as a mission-critical risk and opportunity that requires governance on par with other strategic priorities.

Investors are likewise intensifying their scrutiny of corporate AI practices. According to FTI Consulting, 16 shareholder proposals on AI ethics and governance were filed in the first half of 2024, more than double the number in 2023 ([3]). These proposals demand greater transparency into how companies use AI and manage associated risks – in some cases even calling for third-party audits of AI systems or formal assignment of board-level responsibility for AI oversight ([4]). While many boards initially resisted such resolutions (some seeking to block them via the SEC), most of these proposals reached shareholder votes, and a few companies responded by improving disclosures or establishing AI ethics committees to pre-empt further investor action ([5]) ([6]). The takeaway for executives is clear: failing to proactively address AI risks and ethics can lead not only to regulatory penalties and litigation, but also to lost investor confidence and reputational damage.

The transformative power of AI is now being felt in labor markets and investor behavior – trends with direct implications for enterprise strategy and risk management. A new industry report by Bain & Company reveals that global private equity technology deal value plunged 70% year-on-year to about $20 billion in the first quarter of 2026, as uncertainty over AI’s impact made investors more cautious about big tech acquisitions ([1]). Fears that generative AI could upend traditional software business models have led to a dramatic slowdown in transactions, stranding many companies in longer holding patterns and signaling that capital markets may punish firms perceived as unprepared for AI disruption.

At the same time, major employers are bracing for AI-driven workforce upheaval. In the banking sector, chief executives from JPMorgan, Citigroup, Standard Chartered and others have publicly warned that AI will eliminate jobs and “replace lower-value human capital” with technology ([2]). Indeed, new data shows banks have already cut recruitment for junior analyst roles by as much as two-thirds, even as they redeploy roughly 62% of those entry-level positions into new AI and data specialist tracks within their organizations ([3]). While these moves aim to boost efficiency and innovation, they raise serious questions for boards around talent strategy, corporate culture, and operational resilience. Companies must manage re-training and up-skilling for existing employees, address morale and public perception issues related to potential layoffs, and ensure that automated decision systems do not inadvertently create compliance headaches (for example, by entrenching bias in hiring or lending).

For C-suites and directors, the key is to integrate AI considerations into broader risk management and human capital planning. Regulators and policymakers are increasingly attuned to the societal impacts of AI – from job displacement to algorithmic fairness – and could intervene if companies are seen as acting irresponsibly. By proactively developing ethical AI use policies, conducting impact assessments on workforce changes, and communicating transparently with stakeholders, business leaders can harness AI’s benefits while avoiding pitfalls that could harm reputation or invite regulatory action.