AI Regulation – Who’s in Charge of the Future?

AI regulation is often framed as a contest between innovation and oversight. For leaders, the more consequential question is: what business decision will AI influence, who owns that decision, and who can challenge or stop the process?

Consider an illustrative scenario, not a client case: an organization uses an AI score to prioritize which customer cases receive human review. The model may be tested and the supplier approved, yet the score can still change who is seen, how quickly they are served, and whether a human can reverse an outcome.

Regulation helps define external duties. It does not, by itself, settle how an organization assigns internal accountability for the decision and its effects.

Rules can set expectations for particular AI uses, actors, and jurisdictions. The EU AI Act is a clear example: it establishes a risk-based framework and assigns obligations to actors such as providers and deployers. Which duties apply depends on the system, use, and role involved.

The EU timetable is staged and has changed. The AI Omnibus entered into force on 27 July 2026. As of 4 October 2026, certain provisions are in application; the Commission’s current timeline places rules for Annex III high-risk systems from 2 December 2027 and for high-risk systems within regulated products from 2 August 2028. Leaders should check the current legal text and implementation guidance for their specific use.

The governance point is my analysis: statutory roles and internal decision rights are related, but they are not interchangeable. A legal duty does not automatically name the business owner for an AI-influenced outcome or the person authorized to pause the workflow.

A label such as “AI system” is not enough to determine which obligations apply. Leaders need to understand the decision being supported, how the system is used, where the organization operates, and whether it acts as a provider, deployer, or another regulated actor.

This makes a single global “AI regulation” checklist unreliable. A control that is useful in one context may not establish compliance in another. Compliance teams and legal counsel should map applicable requirements; business owners should make sure those requirements connect to the decision process and its consequences.

Model owners, technology teams, suppliers, risk functions, and business units may each own part of the control environment. That division can leave the actual decision unowned: who is answerable for the result, who can challenge an assumption, and who has authority to stop use?

Where AI influences customer access, eligibility, prioritization, or another consequential outcome, define the human and organizational decision path before deployment. That includes what evidence is retained, when a person reviews an output, and how a decision can be reversed or escalated.

These are governance design choices, not claims that a particular organization has failed. The exposure appears when no one can connect the system’s output to an accountable decision and a workable intervention route.

NIST describes its AI Risk Management Framework as intended for voluntary use. It can help organizations organize risk work across design, development, use, and evaluation, but it is not itself a substitute for legal requirements that apply to a particular organization or use case.

Frameworks are most useful when translated into concrete decision controls: an accountable business owner, defined limits, evidence of review, clear escalation, and authority to pause or withdraw a system when assumptions no longer hold.

A policy may require human oversight, but the words alone do not prove that oversight can change an outcome. Leaders should test the actual workflow: can the reviewer see enough context, challenge the output, record a reason, and prevent an automated recommendation from proceeding?

For an illustrative customer-prioritization workflow, a meaningful intervention route would identify who can correct the data, override the score, pause the process, and escalate a pattern of adverse outcomes. The specific safeguards depend on the decision and the law that applies.

My view is that governance becomes credible when decision ownership and challenge authority are designed before launch, then tested as part of ongoing oversight.

• What consequential business decision does this AI output influence, and who is accountable for that decision and its outcome?
• Which legal roles and jurisdiction-specific obligations apply to our use, and who has validated that mapping?
• Who can challenge, override, pause, or withdraw the process—and what evidence shows that route works in practice?

Regulation can set an external floor. Leaders still have to make decision ownership and challenge authority operational before AI influences a consequential outcome.

• Regulation (EU) 2024/1689 — consolidated text, EUR-Lex
• European Commission: AI Omnibus enters into force (27 July 2026)
• European Commission: AI Act regulatory framework and implementation
• NIST AI Risk Management Framework (voluntary-use framework)
• Related: The AI Governance Question Regulators Are Forcing — And Most Leaders Can’t Answer
• Related: Before an AI Agent Acts for Your Business, Decide What You Have Authorized

Regulatory sources checked on 4 October 2026. This article offers governance analysis, not legal advice. Gary Cheung writes about AI governance, information risk, and accountability for consequential business decisions. Contact Gary to discuss a governance question.