Sign in Subscribe

Topic

Risk & governance

Regulation, procurement and the controls that can actually change a decision: the editions on AI governance, the EU AI Act and compliance.

A rule that cannot interrupt a purchase, bind a vendor or reassign a loss is commentary. These editions test regulation, task forces and treaties with one question: which decision can this actually change?

Start with this

If It Can't Stop the Purchase, It Doesn't Govern 10 September 2026. Five bodies with the same label and five different relationships to power, from an advisory council that the statute forbids to bind anyone to an office that can restrict a model and fine its provider. Four levers decide whether a body governs: procurement, information, deployment, residual risk. The same test applies to the task force inside your own company, and the edition ends with the first ninety days.

The path

  1. AI Act Delay: A Window of Opportunity (If You Use It Well) 4 December 2025. Brussels moves the high-risk obligations to December 2027 because the standards are not ready and two thirds of member states have not named an authority. Italy had named its two first. What the extra months are for.
  2. The Treaty That Explains Everything 7 May 2026. Nine years of negotiation on autonomous weapons, no shared definition, and a consensus rule that lets one state block what a hundred and sixty-six voted for. The procedure predicts the outcome, and the same procedure will decide every other attempt at global AI rules.
  3. The AI Law That Won by Doing Less 23 July 2026. Texas regulates its own government's AI and asks the market to avoid a short list of intentional harms, wrapped in the most generous defences in American consumer law. Colorado retreated before its heavier law applied to anyone. Regulatory power now works through the price of holding a position.
  4. Truth is now a billable input 30 July 2026. Authorised systems produce plausible, wrong records without anyone breaking in. Provenance is necessary and does not settle accuracy, so integrity becomes a contract term: an integrity warranty, audit rights with retention, a duty to notify. The buyer who is left to verify every output has bought a workload, not integrity.
  5. If It Can't Stop the Purchase, It Doesn't Govern 10 September 2026. The rule turned inward: whether the body that oversees AI in your organisation can approve, condition or stop a purchase before the commercial decision, or only comments on it afterwards.

Further along the same line

What changed

December 2025 read the AI Act delay as time to use. By May 2026 the treaty edition had given the publication a rule: read the instrument, not the stated purpose, because the procedure decides the result. July applied the rule twice, to a Texas statute whose obligations are far narrower than its coverage, and to integrity, which stopped being a control and became a clause. September turned the same test on the company's own arrangements. The line through all of it: an obligation is real where someone outside the room has to respond to it.

Questions to take into a meeting

  • Which body in our company can stop an AI purchase before the commercial decision, and which only reviews it afterwards?
  • What must a vendor produce for us on request: documentation, evaluation results, subcontractors, deployment logs? Is that a right in the contract or a hope?
  • Who carries the loss when a plausible but wrong output enters a contract or a report? If the answer is "we check everything", we bought a verification workload.
  • Which regime actually reaches us: the AI Act's high-risk tier, a national supervisory authority, a US state statute through a customer? Read the enacted text, not the coverage.
  • When a deadline moves, what do we do with the time?
Language