AI Governance Practices

This report provides the first comprehensive analysis of how the EU AI Act regulates AI agents, increasingly autonomous AI systems that can directly impact real-world environments. Our three primary findings are: 1. The AI Act imposes requirements on the general-purpose (AI GPAI) models underlying AI agents (Ch. V) and the agent systems themselves (Ch. III). We assume most agents rely on GPAI models with systemic risk (GPAISR) Accordingly, the applicability of various AI Act provisions depends on (a) whether agents proliferate systemic risks under Ch. V (Art. 55), and (b) whether they can be classified as high-risk systems under Ch. III. We find that (a) generally holds, requiring providers of GPAISRs to assess and mitigate systemic risks from AI agents. However, it is less clear whether AI agents will in all cases qualify as (b) high-risk AI systems, as this depends on the agent's specific use case. When built on GPAI models, AI agents should be considered high-risk GPAI systems, unless the GPAI model provider deliberately excluded high-risk uses from the intended purposes for which the model may be used. 2. Managing agent risks effectively requires governance along the entire value chain. The governance of AI agents illustrates the “many hands problemˮ, where accountability is obscured due to the unclear allocation of responsibility across a multi-stakeholder value chain. We show how requirements must be distributed along the value chain, accounting for the various asymmetries between actors, such as the superior resources and expertise of model providers and the context-specific information available to downstream system providers and deployers. In general, model providers must build the fundamental infrastructure, system providers must adapt these tools to their specific contexts, and deployers must adhere to and apply these rules during operation. 3. The AI Act governs AI agents through four primary pillars: risk assessment, transparency tools, technical deployment controls, and human oversight. We derive these complementary pillars by conducting an integrative review of the AI governance literature and mapping the results onto the EU AI Act. Underlying these pillars, we identify 10 sub-measures for which we note specific requirements along the value chain, presenting an interdependent view of the obligations on GPAISR providers, system providers, and system deployers. By Amin Oueslati, Robin Staes-Polet at The Future Society Read: https://lnkd.in/e6865zWq

The Irish Government has just announced plans to introduce the Regulation of Artificial Intelligence Bill in its Spring 2025 legislative programme, a pivotal piece of legislation aimed at giving full effect to the European Union’s Artificial Intelligence Act (EU Regulation 2024/1689). Even though the AI Act as a regulation has direct effect, this move is set to shape the national regulatory framework for AI governance in Ireland and establish national enforcement mechanisms in line with the EU’s approach. At the heart of the bill is the designation of Ireland’s National Competent Authorities: the entities that will be responsible for enforcing compliance with the AI Act. These authorities will oversee risk classification, conduct market surveillance, and impose penalties for violations. Given Ireland’s role as the EU base for major technology firms including Google, Anthropic, Meta, and TikTok, the effectiveness of its enforcement regime will be closely scrutinised across the EU and beyond. The Irish Government’s approach will be particularly significant due to the country’s track record in regulating the digital sector. Ireland’s Data Protection Commission (DPC) has wielded considerable influence over EU-wide enforcement of the GDPR, given the presence of multinational tech firms within the state. The DPC was designated as one of ireland’s nine fundamental rights authorities under the AI Act in November 2024. The bill will include provisions for penalties, though details remain unspecified. Under the EU AI Act, non-compliance can result in fines of up to €35 million or 7% of a company’s global annual turnover, whichever is higher. For Ireland, the challenge will be ensuring its enforcement framework has sufficient resources and expertise to oversee AI systems deployed within its jurisdiction. Tech industry leaders and legal experts will be closely monitoring how Ireland structures its national framework. The AI Act imposes strict obligations on high-risk AI applications, including those used in healthcare, banking, and recruitment. Companies will be required to maintain transparency, conduct impact assessments, and ensure that their AI systems do not lead to unlawful discrimination or harm. Ireland’s legislative initiative comes at a time of growing regulatory scrutiny over AI’s impact on society, innovation, and human rights. The AI Act represents the world’s most comprehensive attempt to regulate artificial intelligence, at a time other jurisdictions such as the USA are moving in the opposite regulatory direction. The Regulation of Artificial Intelligence Bill is still in its early stages, at the “Heads in Preparation” point. In the Irish legislative process, the Heads of a Bill serve as a blueprint for the eventual legislation. As Ireland moves toward full implementation of the AI Act, the government’s decisions on AI oversight will have significant implications for businesses, consumers, and the broader EU regulatory landscape.

Today the OECD - OCDE launched its new Due Diligence Guidance for Responsible AI - the most comprehensive government-backed AI risk management framework available. AI has the potential to transform society for the better, enhance productivity, and solve complex challenges. But for these benefits to materialise, AI needs to be trustworthy. Whether your company is investing in, developing, or using AI, this guidance provides you with an authoritative, internationally agreed framework to: ➡️Implement and demonstrate due diligence relevant for your company's position in the AI value chain ➡️Support safe and responsible AI innovation, investment and uptake ➡️Navigate and simplify compliance with domestic and industry AI risk management frameworks The new guidance is backed by all the OECD’s member countries, the EU, and 17 partner governments. It is based on and fully consistent with the OECD Guidelines for Multinational Enterprises and the OECD AI Principles. You can find the new guidance here: https://brnw.ch/21x074j And do read the accompanying blog post by the OECD's Barbara Bijelic and Rashad Abelson: The OECD’s new responsible AI guidance: A compass for businesses in a complex terrain - OECD.AI #OECDAI #IndiaAIImpactSummit2026 #ResponsibleAI Sara Rendtorff-Smith Audrey Plonk, Ulrik Vestergaard Knudsen Pam Wood Alan Krill David C. Turnbull Felipe HENRÍQUEZ PALMA Aini Suzana Ariffin John Morrison Caleb Orr Office of the Under Secretary of State for Economic Affairs (E)

Common Sense Media recently released a comprehensive risk assessment of AI teacher assistants/lesson planning tools. Their findings reveal that while these tools promise increased productivity and creative support, they're also creating "invisible influencers" that could fundamentally undermine educational quality. Unlike GenAI foundation model chatbots, these tools are specifically designed for instructional planning and classroom use and are rapidly being adopted across districts. Key Concerns from their report: • "Invisible Influencers" in Student Learning: AI-generated content directly shapes what students learn through potentially biased perspectives and historical inaccuracies that teachers may miss; evidence also shows these tools suggest different approaches and responses based on student race/gender • “Outsourced Thinking" Problem: Tools make it dangerously easy to push unreviewed AI instructional content straight to classrooms, while novice teachers lack experience to spot subtle errors and biasses • High-Stakes Outputs: IEP and behavior plan generators create official-looking documents that could impact student educational trajectories even though these plans should be human-generated (and in the case of IEP goals are mandated to be human generated) • Undermining High-Quality Instructional Materials: Without proper integration, these tools fragment learning and can undermine coherent, research-backed curricula Recommendations from the report: • Experienced educator oversight required for all AI-generated educational content • Clear district policies and guidelines for AI teacher assistant implementation • Integration with existing high-quality curricula rather than replacement of established materials • Robust teacher training on identifying bias and evaluating AI outputs • Careful oversight of real-time AI feedback tools that interact directly with students We'd also recommend foundational AI literacy for teachers before they begin using GenAI teacher assistants, so that they are aware of the potential limitations. While AI teacher assistants aren't inherently problematic, they require the same careful implementation and oversight we'd expect for any tool that directly impacts student learning. The potential for enhanced productivity is real, but so are the risks to educational equity and quality. This report underscores the urgent need for GenAI EdTech tool makers to provide evidence of how their tools mitigate these issues along with evidence-based policies and professional development to help educators navigate AI tools responsibly. All of which underline how important AI Literacy is for the 2025-2026 school year. Link in the comments to check out the full report. Also check out our 5 Questions to Ask GenAI EdTech Providers resource in the comments if you are planning to implement any of these tools in your school or district. #AIinEducation #ailiteracy #Education #K12 AI for Education

I recently spent time getting more hands-on with LLM & Agentic AI engineering through Ed Donner's training. Instead of stopping at examples, I built a mini multi-agent logistics delivery optimization framework. Building real AI systems quickly makes one thing clear: 𝙏𝙝𝙚 𝙝𝙖𝙧𝙙 𝙥𝙖𝙧𝙩 𝙞𝙨𝙣’𝙩 𝙩𝙝𝙚 𝙢𝙤𝙙𝙚𝙡 — 𝙞𝙩’𝙨 𝙩𝙝𝙚 𝙖𝙧𝙘𝙝𝙞𝙩𝙚𝙘𝙩𝙪𝙧𝙚 𝙙𝙚𝙘𝙞𝙨𝙞𝙤𝙣𝙨 𝙖𝙧𝙤𝙪𝙣𝙙 𝙞𝙩. A few practical lessons: 1. 𝗟𝗟𝗠 𝗺𝗼𝗱𝗲𝗹 𝘀𝗲𝗹𝗲𝗰𝘁𝗶𝗼𝗻 𝗶𝘀 𝗳𝗮𝗿 𝗺𝗼𝗿𝗲 𝗻𝘂𝗮𝗻𝗰𝗲𝗱 𝘁𝗵𝗮𝗻 𝗰𝗼𝘀𝘁 𝘃𝘀 𝗹𝗮𝘁𝗲𝗻𝗰𝘆. Trade-offs: • reasoning maturity for complex planning • context window & memory strategy • proprietary models vs smaller open models • infra costs (GPU/hosting) vs token-based API costs • tool-calling reliability & structured output adherence • benchmark performance vs real task behavior • model stability across releases In practice, it becomes a hybrid strategy: 𝘀𝗺𝗮𝗹𝗹𝗲𝗿/𝗰𝗵𝗲𝗮𝗽𝗲𝗿 𝗺𝗼𝗱𝗲𝗹𝘀 𝗳𝗼𝗿 𝗿𝗼𝘂𝘁𝗶𝗻𝗲 𝘁𝗮𝘀𝗸𝘀 + 𝗦𝗟𝗠 𝘄𝗶𝘁𝗵 𝗳𝗶𝗻𝗲-𝘁𝘂𝗻𝗶𝗻𝗴 𝗳𝗼𝗿 𝗱𝗼𝗺𝗮𝗶𝗻 𝗽𝗿𝗼𝗯𝗹𝗲𝗺𝘀 + 𝘀𝘁𝗿𝗼𝗻𝗴𝗲𝗿 𝗿𝗲𝗮𝘀𝗼𝗻𝗶𝗻𝗴 𝗺𝗼𝗱𝗲𝗹𝘀 𝗳𝗼𝗿 𝗰𝗼𝗺𝗽𝗹𝗲𝘅 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻𝘀. 𝟮. 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗺𝗲𝗻𝘁 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 𝗺𝗮𝘁𝘁𝗲𝗿𝘀 𝗮𝘀 𝗺𝘂𝗰𝗵 𝗮𝘀 𝘁𝗵𝗲 𝗟𝗟𝗠: Many AI demos over-engineer the stack. In reality, simplicity, latency, security and reliability matter more than novelty. • Use orchestration frameworks only where coordination complexity exists • Combine prompts with structured outputs to reduce ambiguity • Watch serialization and tool-call overhead — they impact latency and UX • Reduce unnecessary LLM calls when deterministic code can solve the task Besides lowering token cost, this improves context efficiency, letting models focus on real reasoning. Sometimes best architecture decision is 𝙣𝙤𝙩 𝙞𝙣𝙩𝙧𝙤𝙙𝙪𝙘𝙞𝙣𝙜 𝙖𝙣𝙤𝙩𝙝𝙚𝙧 𝙡𝙖𝙮𝙚𝙧. 3. 𝗕𝗶𝗴𝗴𝗲𝗿 𝗺𝗼𝗱𝗲𝗹𝘀 ≠ 𝗯𝗲𝘁𝘁𝗲𝗿 𝗼𝘂𝘁𝗰𝗼𝗺𝗲𝘀 Smaller models with fine-tuning on domain data can perform more consistently than larger ones. Fine-tuning helps when: • tasks are repetitive but require precision • domain vocabulary is specialized • prompts become fragile But 𝗳𝗶𝗻𝗲-𝘁𝘂𝗻𝗶𝗻𝗴 𝗮𝗹𝘀𝗼 𝗶𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗲𝘀 𝗹𝗶𝗳𝗲𝗰𝘆𝗰𝗹𝗲 𝗼𝘃𝗲𝗿𝗵𝗲𝗮𝗱. Base model upgrades trigger retesting and partial rewrites. 4. 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝗴𝗮𝗽: 𝗽𝗿𝗼𝘁𝗼𝘁𝘆𝗽𝗲 → 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 Demos are easy. Production requires 𝙚𝙫𝙖𝙡𝙪𝙖𝙩𝙞𝙤𝙣 𝙛𝙧𝙖𝙢𝙚𝙬𝙤𝙧𝙠𝙨, 𝙤𝙗𝙨𝙚𝙧𝙫𝙖𝙗𝙞𝙡𝙞𝙩𝙮, 𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮, 𝙥𝙚𝙧𝙛𝙤𝙧𝙢𝙖𝙣𝙘𝙚, 𝙘𝙤𝙨𝙩 𝙜𝙤𝙫𝙚𝙧𝙣𝙖𝙣𝙘𝙚 & 𝙜𝙪𝙖𝙧𝙙𝙧𝙖𝙞𝙡𝙨. That’s where most engineering effort goes. 𝟱. 𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗳𝗼𝗿 𝗹𝗲𝗮𝗱𝗲𝗿𝘀 𝗿𝘂𝗻𝗻𝗶𝗻𝗴 𝗔𝗜 𝗽𝗿𝗼𝗴𝗿𝗮𝗺𝘀 Many AI conversations focus on SDLC productivity- Useful but the bigger opportunity is 𝙧𝙚𝙞𝙢𝙖𝙜𝙞𝙣𝙞𝙣𝙜 𝙡𝙚𝙜𝙖𝙘𝙮 𝙗𝙪𝙨 𝙥𝙧𝙤𝙘𝙚𝙨𝙨𝙚𝙨 𝙪𝙨𝙞𝙣𝙜 𝘼𝙜𝙚𝙣𝙩𝙞𝙘 AI. By simply automating existing steps, we risk making inefficient tasks efficient and missing the real transformation.

This new white paper by Stanford Institute for Human-Centered Artificial Intelligence (HAI) titled "Rethinking Privacy in the AI Era" addresses the intersection of data privacy and AI development, highlighting the challenges and proposing solutions for mitigating privacy risks. It outlines the current data protection landscape, including the Fair Information Practice Principles, GDPR, and U.S. state privacy laws, and discusses the distinction and regulatory implications between predictive and generative AI. The paper argues that AI's reliance on extensive data collection presents unique privacy risks at both individual and societal levels, noting that existing laws are inadequate for the emerging challenges posed by AI systems, because they don't fully tackle the shortcomings of the Fair Information Practice Principles (FIPs) framework or concentrate adequately on the comprehensive data governance measures necessary for regulating data used in AI development. According to the paper, FIPs are outdated and not well-suited for modern data and AI complexities, because: - They do not address the power imbalance between data collectors and individuals. - FIPs fail to enforce data minimization and purpose limitation effectively. - The framework places too much responsibility on individuals for privacy management. - Allows for data collection by default, putting the onus on individuals to opt out. - Focuses on procedural rather than substantive protections. - Struggles with the concepts of consent and legitimate interest, complicating privacy management. It emphasizes the need for new regulatory approaches that go beyond current privacy legislation to effectively manage the risks associated with AI-driven data acquisition and processing. The paper suggests three key strategies to mitigate the privacy harms of AI: 1.) Denormalize Data Collection by Default: Shift from opt-out to opt-in data collection models to facilitate true data minimization. This approach emphasizes "privacy by default" and the need for technical standards and infrastructure that enable meaningful consent mechanisms. 2.) Focus on the AI Data Supply Chain: Enhance privacy and data protection by ensuring dataset transparency and accountability throughout the entire lifecycle of data. This includes a call for regulatory frameworks that address data privacy comprehensively across the data supply chain. 3.) Flip the Script on Personal Data Management: Encourage the development of new governance mechanisms and technical infrastructures, such as data intermediaries and data permissioning systems, to automate and support the exercise of individual data rights and preferences. This strategy aims to empower individuals by facilitating easier management and control of their personal data in the context of AI. by Dr. Jennifer King Caroline Meinhardt Link: https://lnkd.in/dniktn3V

How To Handle Sensitive Information in your next AI Project It's crucial to handle sensitive user information with care. Whether it's personal data, financial details, or health information, understanding how to protect and manage it is essential to maintain trust and comply with privacy regulations. Here are 5 best practices to follow: 1. Identify and Classify Sensitive Data Start by identifying the types of sensitive data your application handles, such as personally identifiable information (PII), sensitive personal information (SPI), and confidential data. Understand the specific legal requirements and privacy regulations that apply, such as GDPR or the California Consumer Privacy Act. 2. Minimize Data Exposure Only share the necessary information with AI endpoints. For PII, such as names, addresses, or social security numbers, consider redacting this information before making API calls, especially if the data could be linked to sensitive applications, like healthcare or financial services. 3. Avoid Sharing Highly Sensitive Information Never pass sensitive personal information, such as credit card numbers, passwords, or bank account details, through AI endpoints. Instead, use secure, dedicated channels for handling and processing such data to avoid unintended exposure or misuse. 4. Implement Data Anonymization When dealing with confidential information, like health conditions or legal matters, ensure that the data cannot be traced back to an individual. Anonymize the data before using it with AI services to maintain user privacy and comply with legal standards. 5. Regularly Review and Update Privacy Practices Data privacy is a dynamic field with evolving laws and best practices. To ensure continued compliance and protection of user data, regularly review your data handling processes, stay updated on relevant regulations, and adjust your practices as needed. Remember, safeguarding sensitive information is not just about compliance — it's about earning and keeping the trust of your users.

Your board does not have an AI risk framework. If it did, someone would have asked about it in the last six months. Three in four boards have approved major AI investments. Fewer than half have set governance expectations for them. (Grant Thornton, 2026.) Usage is not the problem. Most companies already run AI somewhere — often in more places than the board has been told. Sit in a board meeting and you will hear adoption numbers and a slide about productivity gains. Everyone nods, and the agenda moves on. Adoption is not governance. Governance is the part where the board can answer who is accountable when an AI-driven decision goes wrong. Ask that in most boardrooms and you get a pause — then a look towards whoever manages IT. A real framework has five parts, and most companies have none of them: ✅ A model inventory: every AI system you actually run, including the tool your CMO bought on a credit card ✅ A human-in-the-loop policy: which decisions need a person to sign off, and which do not ✅ An incident playbook: what happens when the model misbehaves at 11pm on a Sunday ✅ Vendor accountability: when a third-party AI breaks, the accountability is still yours. PDPA does not let you contract it away ✅ A decision audit trail: could you reconstruct a customer-impacting AI decision if a regulator asked tomorrow · Frontier models change weekly. Your board meets quarterly. That maths only works if governance is structural: checked at every meeting, owned by a named director, stress-tested at least once a year. If you want a starting point that already exists, look at IMDA's Model AI Governance Framework. It now covers AI agents specifically. The boards that sort this out in 2026 are the ones not writing apology letters in 2027. Take those five into your next board meeting and count how many you can answer without leaving the room. Under three and you have an AI strategy with no governance underneath it. Tell me your number. #AIGovernance #BoardLeadership #AIRisk

🗞️ A must-read for anyone interested in European AI governance right now: this study, drafted for the Committee on Industry, Research and Energy (ITRE) of the European Parliament by the Policy Department for Transformation, Innovation & Health 👉🏼Analyses how the AI Act adopted mid-2024 is articulated with other key EU digital regulations 🔎 Examines interactions with: • GDPR • Data Act (DA) • Data Governance Act (DGA) • Digital Services Act (DSA) • Digital Markets Act (DMA) • Cyber Resilience Act (CRA) • NIS2 Directive, the New Legislative Framework (NLF) and product-safety / digital-elements rules 📖 A timely document as the #EU faces the demanding task of building digital rules that the world still lacks, balancing innovation, transparency and fundamental rights. ➡️ creating a broad legal ecosystem connecting data, algorithms and human values. 🎯 3 goals • Ensure trustworthy #AI in Europe — safe, transparent, respectful of rights and EU values. • Foster innovation and competitiveness • Provide legal certainty through a proportionate, risk-based approach. 🗺️ The study maps the interplay among current acts: 🔹with GDPR – Encourage joint guidance between data-protection and AI authorities to simplify impact assessments and ensure consistent supervision across Member States. 🔹with Data Act -Streamline obligations on data quality and access so that compliance supports, rather than slows, AI innovation. -Coordinate governance to prevent duplication and promote data flows for trustworthy AI. 🔹with Data Governance Act -Build bridges between data-sharing frameworks & AI requirements through interoperable standards and clear responsibilities for data use. 🔹with DSA / DMA -Use platform transparency & risk-assessment mechanisms to reinforce, not duplicate, AI Act duties -promote a coherent, innovation-friendly environment for general-purpose models 🔹with CRA / NIS2 / NLF -Align product-safety, cybersecurity & AI conformity processes to create 1 coherent certification pathway for digital products. 👉🏼an #AI Act as integrated regulatory ecosystem covering data, algorithms, products, platforms and rights = smart coordination turning compliance into trust and competitiveness. Future model proposed : • Principle-based horizontal rules with sectoral modules • Clear layering — data → algorithms → systems → services • Aligned definitions & conformity regimes • Simplified compliance for SMEs, rigorous oversight for high-risk systems 🧭 Practical steps forward ▶️Short term: joint guidelines (AI Act / GDPR), shared sandboxes, harmonised templates. ⏩️Medium term: clarify mandates, connect conformity procedures. ⏭️Long term: build a unified digital framework linking data, AI and platform rules, strengthen international standardisation& partnerships. ➡️ AI for good, trustworthy by design, aligned with rights and values. 🙏🏻 Authors Hans Graux Krzysztof G. Nayana Murali Jonathan Cave Maarten Botterman

The Rise of the Autonomous Enterprise for Government... For decades, government modernization has focused on digitizing forms, automating workflows, and moving systems to the cloud. Those investments were necessary. But they were only the foundation. The next phase of transformation is the rise of the Autonomous Enterprise for Government. Across government, agencies face the same challenge: increasing demands for services, workforce constraints, growing regulatory complexity, and pressure to do more with limited resources. AI is creating an opportunity to fundamentally rethink how administrative and mission-support work gets done. The first generation of AI focused on chatbots and individual agents. The next generation is Agentic Applications: systems that combine AI agents, enterprise data, business processes, and governed execution into a single experience focused on delivering outcomes. Instead of employees searching through policies, regulations, and procedures, Agentic Applications continuously monitor signals, identify issues, perform analysis, recommend actions, and execute approved work. A staffing challenge is identified before it impacts mission delivery. A procurement bottleneck is surfaced and resolved before it delays a critical program. A compliance risk is detected and remediated before it becomes an audit finding. This is the shift from systems of record, to systems of engagement, to systems of outcomes. The value is no longer measured by how many forms are digitized, dashboards are created, or agents are deployed. The value is measured by outcomes achieved: faster hiring, improved mission readiness, reduced compliance risk, accelerated procurement cycles, better workforce planning, and higher-quality citizen services. The goal isn’t replacing public servants. It’s allowing them to focus on judgment, leadership, and mission execution while Agentic Applications handle analysis, coordination, and routine operational work at scale. The future of government modernization isn’t simply digital government. It’s the Autonomous Enterprise for Government, powered by Agentic Applications and measured by outcomes.