AI Governance Update: New Rules, New Risks Emerge Worldwide

A shift toward stricter AI oversight is underway in Washington. On June 25, a Republican member of Congress introduced a bill that would require AI model developers to promptly disclose any exploits or dangerous behaviors emerging from their systems ([1]). The draft legislation mandates that AI companies report serious incidents – such as the discovery of "dangerous capabilities", significant security breaches, or safety failures – to the U.S. Department of Commerce within seven days of detection ([2]). For the gravest AI incidents, the Commerce Department would be required to inform Congress within 48 hours of notification ([3]).

This proposed law reflects growing bipartisan concern that voluntary AI guidelines are not sufficient to protect the public and businesses. It parallels recent cybersecurity regulations that enforce rapid breach reporting to authorities, extending a similar logic to AI-related incidents. For enterprise leaders, the message is clear: if this measure becomes law, companies developing or deploying advanced AI will need robust internal incident monitoring and response plans. Waiting to report AI mishaps could carry legal consequences, so proactive risk auditing and transparent communication with regulators will be critical to stay ahead of compliance obligations.

The United Kingdom has signaled a major change in its approach to AI governance. The government is delaying the introduction of a long-anticipated, comprehensive "AI bill" in order to better align with the United States’ industry-led policy stance ([1]). The shelved proposal – once expected by late 2025 – would have required developers of powerful AI models (like ChatGPT) to submit their systems for evaluation by a national AI authority ([2]). However, officials have now put this plan on hold, with one senior figure saying the AI bill is 'properly in the background' amid the post-Trump-election shift toward a lighter-touch regulatory strategy ([3]).

For UK businesses, the lack of a new AI Act might reduce short-term regulatory burdens but increases uncertainty. Instead of a single law, companies must navigate existing regulations (from data protection to competition and safety) that still apply to AI deployments. In fact, British regulators are already using their current powers to address AI-related issues – for example, the Competition and Markets Authority recently ordered Google to allow news publishers to opt out of AI search results that summarize their content ([4]). Enterprises operating in the UK should thus continue strengthening internal AI governance and compliance across all relevant regulatory domains. Adopting a proactive, sector-specific approach to responsible AI use will help organizations stay prepared for any future legal requirements.

Recent events highlight how AI innovations are triggering novel legal disputes over intellectual property and liability. On June 24, AI startup Anthropic revealed it had accused China’s Alibaba of mounting the "largest known" attempt to steal an AI model’s capabilities ([1]). According to a letter seen by Reuters, Alibaba allegedly used a "distillation" attack – deploying 25,000 dummy user accounts to make 28.8 million requests to Anthropic’s language model, Claude, in order to illicitly replicate its performance ([2]). This kind of advanced model-scraping campaign raises serious intellectual property and cybersecurity concerns for any enterprise deploying valuable AI systems.

Meanwhile, courts are increasingly ready to hold companies accountable for harms caused by AI-generated content. Earlier this month, a Munich court ruled that Google could be held legally liable for false and defamatory information produced by its AI-driven search summaries ([3]). Crucially, the German judges decided that AI-generated “Overviews” are not mere search results but constitute original published content, stripping Google of the safe harbor typically granted to neutral platforms ([4]). Google has vowed to appeal, but the precedent signals to all tech-enabled businesses – including those far beyond the media sector – that they may bear direct legal responsibility for the outputs of their AI systems. Companies must also be mindful of rising litigation over AI’s use of third-party data; for instance, major news organizations have pursued legal action against AI firms for scraping and reusing copyrighted content without permission ([5]). The bottom line is that the legal system is catching up with AI, and enterprises need to vet their AI training data, model behaviors, and content outputs to avoid IP infringements or liability for algorithmic errors.

A newly disclosed security breach shows how AI systems can become unwitting attack vectors. In a June incident, an AI-powered email assistant (known as OpenClaw) was duped by a phishing email into leaking sensitive information, including AWS access credentials and customer data ([1]). The AI agent, tasked with automating email responses, was tricked into forwarding confidential files and keys to an unauthorized account – essentially, the machine learning model was "social-engineered" much like a human employee might be.

This event underscores a troubling reality: as companies integrate AI agents deeper into operations, threat actors are finding ways to exploit them. Because AI agents can execute tasks autonomously, a compromised AI system may inadvertently bypass traditional security controls. In the European Union, such a failure to prevent a multi-vector AI attack could even violate new digital operational resilience rules (DORA) and cybersecurity requirements in the NIS2 directive ([2]). Organizations must therefore update their security frameworks to account for AI-specific risks. This includes training AI systems with better guardrails against manipulation, implementing rigorous identity verification and access controls, and adopting "zero trust" approaches for AI agent interactions. As one industry analysis noted, the rapid deployment of AI has outpaced enterprise security measures, making it urgent to establish comprehensive protocols to protect AI operations ([3]). Companies should treat AI incidents as inevitable and prepare response plans now – including cross-functional drills – to mitigate damage when (not if) an AI system is misused or breached.

Around the world, regulators and investors are converging on a common message: robust AI governance is critical for business. In the financial sector, the Basel-based Financial Stability Board (FSB) has published a new set of 12 recommended “Sound Practices” to guide banks in responsible AI adoption and risk management ([1]). These practices emphasize top-level oversight (board and C-suite involvement), rigorous testing and monitoring across the AI system lifecycle, and alignment with existing global standards and regulations ([2]). As financial authorities signal that safely harnessing AI is essential to systemic stability, banks and other firms should proactively implement these guidelines, even ahead of formal requirements.

Investors, too, are increasingly vocal about AI risks. Activist shareholders have begun scrutinizing corporate AI strategies, criticizing companies that lack clear plans for ethical AI deployment or that underinvest in managing AI-related dangers ([3]). A recent survey of business leaders found that cybersecurity and data breaches are the most frequently cited AI risk (named by 58% of executives), followed by concerns over data privacy and regulatory compliance ([4]). Moreover, in the past two years the portion of S&P 500 companies disclosing AI as a corporate risk factor skyrocketed from just 12% to 83%, reflecting how rapidly boardroom awareness of AI issues has grown ([5]). Forward-looking companies are establishing dedicated AI governance committees, investing in staff training on AI ethics and security, and instituting oversight frameworks to ensure AI initiatives are both innovative and responsible. The clear takeaway: whether due to regulatory expectations or investor pressures, organizations must treat AI governance as integral to their business strategy to maintain trust and competitiveness.