AI Governance Moves From Principles to Obligations

For most of the last decade, AI governance meant principles: fairness, transparency, accountability, published in frameworks and adopted voluntarily. That era is ending. Regulators in major jurisdictions are converting principles into obligations with deadlines, documentation requirements and penalties. Boards are being asked not whether they have an AI policy but whether they can evidence that it works.

What happened

Three developments converged. Risk-based AI regulation moved from adoption to enforcement phases. Corporate governance codes and disclosure expectations began to reference AI oversight explicitly. And insurers, facing claims involving AI systems, started asking detailed questions about controls before writing cover.

The agent problem

Most governance frameworks assume an AI system produces an output that a human then uses. Agents break that assumption: they take actions, chain decisions and operate continuously. Questions that frameworks did not anticipate are now urgent. Who is accountable for an action an agent took? How is an agent's authority scoped and evidenced? What does meaningful human oversight look like when the agent makes a thousand decisions an hour?

Why now

• Enforcement phases of AI regulation are beginning in key markets.
• Agent deployments create incidents that existing frameworks cannot attribute.
• Insurers and auditors are demanding AI-specific evidence.

What to do

1. Inventory every AI system and agent in production, with owners and permissions.
2. Define accountability for agent actions before deployment, not after an incident.
3. Log actions, not only outputs, so oversight can be evidenced.
4. Align control frameworks with regulatory timelines in each operating jurisdiction.