Bipartisan US bills and EU enforcement intensify AI oversight.

On 29 September, **President Donald Trump** convened the CEOs of six leading AI companies - including **Google**, **OpenAI**, **Meta**, **Anthropic**, **Nvidia** and **xAI** - to sign a one-page **White House Accord on AI Safety** ([1]). Aimed at managing the risks of so-called **frontier AI models** (extremely advanced systems), the non-binding pact calls on each firm to establish four layers of **AI governance**: robust internal risk controls, dedicated safety teams, independent external audits of their most powerful AI models, and board-level oversight ([2]) ([3]). Companies also agreed to monitor their cutting-edge AI systems for cybersecurity, biological, and other catastrophic risks, and to share best practices with each other ([4]). President Trump hailed the agreement as a “**morally binding**” pledge that could serve as an alternative to new regulations, stating that it may eventually be codified into law ([5]). However, the accord imposes no penalties for non-compliance, and the **Federal Trade Commission (FTC)** has been clear that voluntary steps will not preclude it from using its own authorities to police AI risks ([6]).

In fact, just days after the audit accord, the **FTC opened a formal investigation** into **OpenAI, Anthropic** and other AI developers over the **safety of their products** ([7]). The agency is reportedly preparing demands for detailed information from these companies as part of a probe into whether they have adequate safeguards, amid mounting concern about incidents of AI systems breaking out of intended constraints ([8]). The FTC has a history of cracking down on companies over data security and unfair practices, and it is signalling that AI will be no exception. Regulators’ patience for self-policing is wearing thin: as Senate co-sponsor Chris Murphy warned, unregulated AI use poses "potentially dire consequences to … critical infrastructure" ([9]) ([10]). Business leaders should expect more aggressive oversight, whether through new legislation or the creative use of existing laws. To avoid becoming test cases, companies should reinforce their AI risk management programs now - including thorough testing, monitoring, **audit trails** and documented controls - even if they are piloting cutting-edge AI tools.

The **European Union’s AI Act**, the world’s first comprehensive law regulating artificial intelligence, entered its enforcement phase on **2 August 2026** ([1]). From that date, the European Commission’s new **AI Office** and national regulators can investigate and sanction non-compliant AI systems under the Act’s risk-based framework ([2]). Crucially, the Act’s initial requirements include **transparency obligations** for generative and interactive AI: for example, chatbots must **clearly inform users that they are not human**, and AI-generated images or content (such as deepfakes) must be properly labelled ([3]). These measures are intended to prevent **deception and manipulation**, and give businesses “clearer obligations” while providing the public with more transparency and trust in AI outputs ([4]). The **penalties for violations are severe** - up to €35 million or **7% of global annual turnover** for the most egregious breaches ([5]) - underscoring the high stakes for any company deploying AI in the EU.

Already, the AI Act is having a **global impact on corporate governance**. According to a Thomson Reuters Foundation analysis of nearly 3,000 companies, proactive alignment with the EU’s rules is correlated with stronger **AI governance** and higher investor confidence ([6]). Notably, almost **half (47%) of firms engaging with the new regulation are based outside Europe**, with the **US** providing the largest share of these early adopters ([7]). This “Brussels effect” is pushing multi-nationals to adopt European AI standards worldwide, rather than maintaining different practices in different markets. However, the same study reveals troubling gaps in readiness: only **12.4% of companies globally have instituted a formal human oversight policy for AI**, and of those few, nearly half have yet to implement the processes needed to make it effective ([8]). Likewise, internal **AI system inventories and model registries** remain rare in practice - even among companies already preparing for the AI Act - with around **20%** adoption among the most engaged firms, versus under 2% among typical companies ([9]).

For companies, the lesson from Europe is that rigorous internal governance is becoming non-negotiable. Many organisations will need to accelerate efforts to **catalogue their AI systems, classify them by risk, and implement measures like bias testing and data governance to meet regulatory expectations**. European authorities have provided tools - such as complaint hotlines and **codes of practice** (one on AI-generated content has over 180 corporate signatories so far) - but the burden of compliance falls on firms to demonstrate that their AI is **transparent, fair, and under control** ([10]) ([11]). Business leaders should ensure a single accountable executive oversees AI risk management and that governance is embedded into AI development from the start. As multiple surveys have found, companies with strong **senior leadership involvement and explicit accountability** for AI governance tend to achieve higher performance and trust, whereas those leaving AI to technical teams alone lag in both maturity and outcomes ([12]) ([13]). In short, building robust AI governance now is not only critical for regulatory compliance - it can also drive innovation and competitive advantage ([14]) ([15]).