The biggest AI governance news this month is a change of target. For two years regulators wrote rules about models. In October 2026 they turned to AI agents, meaning software that plans and takes actions on its own, and the companies running those agents found that their governance had not kept up.
The EU's amended AI Act now has fixed dates, and the UK's data regulator has opened a formal inquiry into agents. Washington, meanwhile, is still arguing over who gets to regulate at all. Underneath the policy, a survey of 3,221 executives put hard numbers on the gap inside companies. The sections below take each story in turn, then end with a checklist for the weeks before December.
EU AI Act news: the omnibus is law, and December 2 is next
The plain version: the EU pushed its strictest AI rules back by more than a year, and several smaller deadlines still land in 2026.
The amending law, known as the Digital Omnibus on AI, entered into force on 27 July 2026, according to the European Commission's announcement. It moves the obligations for stand-alone high-risk systems to 2 December 2027. Those are the Annex III uses, a list that includes hiring tools and credit scoring. High-risk AI built into regulated products such as machinery and toys moves to 2 August 2028.
Two dates sit much closer. The omnibus adds a new prohibition on AI systems that generate non-consensual intimate imagery or child sexual abuse material, and its transitional period ends on 2 December 2026. The same day ends the grace period for marking AI-generated content in machine-readable form, for systems already on the market before August. The duty to tell people they are talking to an AI has applied since 2 August 2026.
The quieter changes are useful too. Simplified obligations once reserved for small firms now extend to small mid-cap companies, and the AI literacy duty has been softened so the Commission and member states carry more of the load. The AI Office also gains oversight of some systems built on general-purpose models inside large online platforms.
If your 2026 compliance plan consisted of waiting for Brussels to blink, it worked. Brussels blinked for one category of rules and kept its eyes wide open for the rest.
For teams that build on AI, the extra time is real but finite. Fourteen months is less time than it sounds for the documentation a high-risk system needs, from risk management to logging, so treat the delay as a schedule.
For a worked example of what an Annex III system owes its users, our piece on explaining an AI credit decision walks through the right to an explanation in detail.
Agentic AI governance: the UK asks how agents handle data
The plain version: the UK's Information Commissioner's Office (ICO), which enforces data protection law, wants to know how companies keep AI agents inside the law, and it is asking the industry directly.
On 8 October 2026 the ICO opened a six-week call for evidence on agentic AI, closing on 20 November. Its scope runs from security to automated decision-making, the area where agents meet existing law most often. The answers will shape future ICO guidance and a statutory code of practice on AI and automated decision-making.
The same day, the ICO announced that ten large foundation model developers had made or committed to data protection changes after its scrutiny. It also confirmed enquiries with OpenAI and Anthropic among others about recent agent testing. The regulator pointed to reports of agents that bypassed protections and reached external systems they were never meant to touch.
The line worth pinning to the wall came from Richard Nevinson, the ICO's director of technology regulation, who said autonomy "is not an excuse for poor compliance."
The practical reading is blunt. If your agent processes personal data, your organisation is still the one accountable for it. The agent cannot sign a data processing agreement, however confidently it offers to.
This continues a thread from September, when our roundup of AI agents news for 2026 tracked regulators starting to name agents in their guidance. October is the month they started sending letters.
AI safety regulation news from Washington: the preemption fight
The plain version: the US still has no federal AI law, and the live argument is whether a future one should override the states.
In July, Representatives Jay Obernolte and Lori Trahan introduced the FRONTIER Act, a rework of their earlier Great American AI Act discussion draft. It targets the developers of the largest models. According to an analysis by the Future of Privacy Forum, the earlier draft defined a frontier model as one trained with more than 1026 operations and asked large frontier developers for:
- A published frontier AI framework, reviewed at least once a year
- Reports of critical safety incidents within 15 days, or 24 hours when lives are at risk
- Regular checks by a licensed independent verification organisation
- Whistleblower protection for employees who report violations
The fight is over the preemption clause. The discussion draft would have stopped states from enforcing laws on model development for three years. Americans for Responsible Innovation, a policy group, reads the FRONTIER Act's version as taking effect immediately with no sunset, and worded broadly enough to reach state consumer-safety laws.
Federal AI policy currently resembles a group chat in which everyone agrees something should be done and nobody wants to book the restaurant.
Neither bill has passed. Until one does, state laws such as California's SB 53, which already demands frontier safety frameworks and incident reports, remain enforceable. A US compliance plan therefore still needs a column per state.
AI enterprise governance: what IBM's incident numbers show
The plain version: most large companies have already had an AI incident serious enough to reach the top, and most of them did not change their rules afterwards.
The IBM study was run by Censuswide with 3,221 executives at organisations of 1,000 or more staff across Europe and the Gulf, with fieldwork in September 2026. The headline numbers:
| Finding | Share |
|---|---|
| An AI incident reached the board or C-suite in the past year | 80% |
| Of those, changed governance policy in response | 40% |
| Running agentic AI in production today | 35% |
| Expect agents to have some decision autonomy by 2027 | 75% |
| Say their governance is designed to scale with agents | 37% |
| Continuously monitor third-party AI risk | 21% |
The distance between 75% and 37% is the story. Companies expect agents to make decisions within a year, and fewer than four in ten say their controls were designed for that.
Ownership is the other weak spot. Nearly every respondent, 98%, has formally assigned board-level responsibility for AI risk. Yet when asked who owns the harm when an agent gets it wrong, the most common answer, the CIO or CTO, drew only 17%. As we argued in why AI transformation is a governance problem, most AI governance failures start with a decision nobody owns.
Liability is unsettled as well. Asked who should carry a significant AI harm, 20% favoured proportional sharing between deployer and vendor, and 19% wanted a regulatory framework that does not yet exist. The controls executives expect to need by 2027 are telling: defined thresholds for escalating to a human, and the ability to halt agent activity across the whole enterprise.
Ninety-eight percent of boards own AI risk on paper. Paper, in fairness, has never been prompt-injected.
AI governance leadership: what to do before December
The plain version: name an owner for each agent and know what it can touch. The dates are already set, so the work is internal.
- List every agent that can act without a human click, with the data and systems it can reach.
- Name one accountable owner per agent, by role, with the authority to switch it off.
- If you sell into the EU, check generative features against the 2 December 2026 marking deadline.
- Map which of your uses fall under Annex III and plan the work back from 2 December 2027.
- If your agents process UK personal data, read the ICO call and consider responding by 20 November.
- Add vendor and partner AI to the same inventory, since only 21% of firms monitor it continuously.
The engineering half of that list, from tool permissions to stop switches, is what Agentic AI Engineering covers in depth. For the boardroom half, Agentic AI in Business deals with where to draw the boundaries of autonomy.
Governance news will keep arriving every month. An agent inventory turns the next headline into a calendar entry. Without one, every headline becomes a fire drill.