Global Crackdown and New Threats Put AI Governance in Spotlight

The European Union’s AI Act – the world’s first comprehensive law regulating artificial intelligence – is moving from theory to reality ([1]). This month marks the start of enforcement for the Act’s "high-risk" AI provisions, following a two-year transition period ([2]). Regulators have made it clear this is not a soft launch; the law carries teeth, with penalties for non-compliance that can reach up to 7% of a company’s global annual revenue ([3]).

As of August 2, businesses deploying AI in sensitive sectors like employment, finance, critical infrastructure, law enforcement, healthcare, and education will be subject to strict requirements ([4]). They must maintain detailed technical documentation for high-risk AI systems, conduct rigorous risk assessments and audits, ensure meaningful human oversight of AI-driven decisions, and register qualifying applications in a new EU-wide database ([5]). For companies operating in or serving the EU market, these obligations are no longer theoretical. Organizations should be inventorying their AI systems now and implementing governance measures to ensure compliance.

Early enforcement actions have already begun to emerge. The European AI Office has reportedly sent information requests to multiple firms to assess their AI compliance ([6]). In one instance, several U.S. tech companies were asked to provide documentation for AI-driven hiring tools used in European markets ([7]). An EU-based bank’s automated lending system is under scrutiny for lacking adequate human oversight, and a national health service’s AI diagnostic platform was flagged for missing risk assessment documentation ([8]). While no fines have been issued yet, these investigations show regulators’ enforcement priorities – transparency, human oversight, and robust documentation – and their willingness to act swiftly on potential violations.

On July 2, the European Commission also published final guidance that broadened the law’s scope ([9]). Notably, it clarified that any company which customizes or fine-tunes a general AI model for a specific use is considered a 'deployer' of an AI system (rather than just an end-user), and thus bears full responsibility for complying with the AI Act’s requirements ([10]). In practice, this means firms adapting third-party AI models (for example, tailoring a large language model for a customer service chatbot) must implement the same rigorous oversight, documentation, and risk controls as the original model developers.

Even participation in a government-sponsored "sandbox" offers no immunity from scrutiny. French authorities this week issued formal warnings to six companies operating under France’s AI sandbox program after auditors found they lacked required transparency documentation for their AI systems ([11]). The clear takeaway is that regulators expect compliance even from experimental AI projects. The EU’s message to enterprises: if you deploy high-risk AI, be prepared to demonstrate accountability and safety measures now – not at some undefined future date.

In the United States, tensions are growing between federal ambitions for AI governance and a patchwork of state rules. In a significant step, the U.S. Senate on July 3 passed the Great American Artificial Intelligence Act by a 67-31 vote ([1]). This sweeping federal bill – the closest the country has come to a national AI law – would establish comprehensive AI oversight, including requiring federal agencies to conduct AI impact assessments for high-risk government systems and creating a national AI Safety Board under NIST ([2]).

However, the bill’s most controversial feature is a provision to preempt (override) state AI laws that conflict with new federal standards ([3]). That clause has set up a showdown with states such as California and Texas, which have been pressing ahead with their own AI regulations on issues like automated hiring practices and AI safety disclosures ([4]) ([5]). Several state officials, including attorneys general, argue the federal law’s preemption language is too broad and could undermine stronger local protections, setting the stage for potential legal challenges ([6]).

As the bill moves to the House of Representatives for debate, its fate remains uncertain. In the meantime, companies must contend with an expanding thicket of state-level AI requirements. Just this week, the Texas legislature approved a new law mandating that employers disclose AI use in hiring and allow candidates a human review of algorithmic decisions ([7]). Similarly, New York’s financial regulator (NYDFS) on July 1 issued binding model risk-management guidance for insurance companies using AI in underwriting and claims, with compliance required by January 2027 ([8]). From financial services to HR, many states are implementing their own AI rules in the absence of a single national standard.

If the Great American AI Act becomes law with its preemption clause intact, some of these state measures may be nullified – likely prompting court battles over states’ rights ([9]) ([10]). If the federal effort stalls, however, businesses will continue to face a fragmented regulatory landscape, needing to comply with varying AI laws across jurisdictions. Either outcome demands that U.S. executives stay closely engaged with regulatory developments and invest in flexible AI governance programs that can adapt to fast-changing requirements.

Across the Atlantic, the United Kingdom is accelerating its move toward formal AI oversight. On July 3, the proposed Artificial Intelligence Regulation and Safety Bill passed its Second Reading in the House of Lords – a key step in the UK’s legislative process ([1]). This progress signals growing political consensus for a dedicated AI governance framework, after previous governments favored a sector-by-sector approach instead of a single overarching law.

The draft law is expected to set cross-sector principles for "responsible AI" and empower existing regulators (like the Financial Conduct Authority for finance and the Information Commissioner’s Office for data protection) to enforce new requirements on AI use within their domains. The UK’s approach is envisioned as more "light-touch" and decentralized than the EU’s top-down AI Act, but the turn toward a national AI law marks a notable shift in strategy ([2]). In recent months, UK regulators have already begun issuing sector-specific AI guidelines – for example, in financial services and data privacy – to bridge the gaps while broader legislation is in progress ([3]).

For businesses operating in the UK, this legislative momentum means that clearer compliance obligations are likely on the horizon. Organizations may soon face minimum standards for AI transparency, risk assessment, and oversight across many industries, replacing today’s voluntary guidance with enforceable rules. Forward-looking companies are advised to start aligning their AI governance practices with anticipated requirements now; establishing internal AI oversight committees, robust risk management processes, and thorough documentation will help ensure they are prepared once the UK’s regulatory framework comes into force.

New legal developments are translating AI-related risks into real-world liability for enterprises. In a landmark case last month, a court in Germany ruled that Google is liable for defamatory content produced by its AI-driven search summary feature ([1]). The Munich judges concluded that the AI-generated summary – which had falsely linked two local publishers to scams – wasn’t just aggregating search results but was presenting a new, libelous statement that Google must answer for ([2]) ([3]). This precedent-setting judgment represents the first instance of an AI provider being held directly responsible for its algorithm’s output ([4]). It has prompted widespread discussion about accountability in AI, and other companies deploying generative AI in customer-facing applications are now on notice that they could face legal claims if their systems produce harmful misinformation ([5]) ([6]).

Beyond defamation, a broader legal battle is intensifying around intellectual property and data privacy in the age of AI. More than 70 AI-related lawsuits are ongoing or recently settled in the U.S. and internationally, targeting tech firms for allegedly infringing copyrights or privacy rights through AI training data and outputs ([7]). The financial exposure from these cases has ballooned: industry analysis estimates over $50 billion in cumulative damages are claimed across active AI litigation as of mid-2026 ([8]). In one high-profile example, an AI developer agreed to a $1.5 billion settlement in 2025 after being accused of using hundreds of thousands of pirated books to train its models ([9]) – the largest such settlement on record. As regulators and courts sharpen their focus on these issues, companies must rigorously vet their AI supply chains (from training data licensing to output monitoring) to mitigate legal risks. The era of unchecked AI experimentation is ending; going forward, businesses will need to demonstrate that their AI innovations respect existing laws and rights or face substantial liability.

The past 48 hours have also highlighted the double-edged nature of rapid AI advancement, as new capabilities bring new risks. Elon Musk’s AI venture (now part of his newly rebranded "X" enterprise) launched its most advanced model yet, known as Grok 4.5 ([1]). Billed as a next-generation 'agentic' AI, Grok 4.5 can self-direct long-running tasks such as writing and executing its own software code, using reinforcement learning on extensive programming data to act autonomously for hours at a time ([2]). While such capabilities promise significant productivity gains, they also present unprecedented governance challenges. An AI that can make and act on decisions with minimal human intervention requires stringent oversight: companies adopting these cutting-edge models will need to implement robust controls to ensure the AI’s actions remain safe, legal, and aligned with organizational policies – including mechanisms for human override, thorough testing for unintended behaviors, and assurances that AI-generated code does not violate intellectual property licenses ([3]).

At the same time, malicious use of AI is becoming a very real enterprise threat. This week, cybersecurity researchers documented what appears to be the first-ever ransomware attack orchestrated largely by an AI system itself ([4]). In the incident, an autonomous agent (a self-improving AI program) dubbed 'JadePuffer' exploited a known software vulnerability, harvested access credentials, and proceeded to lock up a company’s database via encryption – all without direct human involvement ([5]). The AI even fixed its own errors on the fly and executed over 600 steps in rapid succession during the attack, something no human hacker could match ([6]) ([7]). Security experts warn that this leap in attack automation drastically lowers the barrier to launching sophisticated cyberattacks, potentially enabling less-skilled actors to carry out breaches that previously required extensive expertise ([8]).

In response to these emerging risks, industry groups and companies are hastening to strengthen their AI governance practices. A global IT standards consortium, the GSD Council, this week published an eight-step framework for safely implementing generative AI in IT service management operations ([9]). The framework emphasizes measures like strict access controls for AI systems, proactive "hallucination" detection and correction processes, and alignment with evolving regulatory compliance requirements, all intended to prevent AI failures from disrupting critical business services ([10]).

Meanwhile, leading firms are sharing their own playbooks for managing advanced AI. For instance, OneTrust – a major compliance and privacy software provider – recently detailed how it established an internal AI governance committee to oversee its use of autonomous AI tools ([11]). The company’s governance framework mandates full traceability for AI decision-making, limits any AI system’s access privileges to a "least privilege" level, and requires a formal review before deploying AI that can act without human intervention ([12]). By publicizing these controls, OneTrust offers other enterprises a concrete example of how to proactively tame the risks of "agentic" AI within an organization.

The takeaway for businesses is that as AI technology evolves, so must risk management. Whether it’s adopting the next wave of powerful AI systems or defending against new AI-enabled threats, companies need to update their governance frameworks in real time. Boards and executives are increasingly expected to ensure that AI deployments are transparent, secure, and compliant with the law – a responsibility that cannot be delegated or delayed in today’s environment.