Regulated AI governance that enables delivery

The weakest AI governance forums behave like permission committees. They slow everything down, create paper trails after decisions have effectively been made, and make delivery teams work around them.

The stronger version is an intake and decision system. It clarifies what problem the use case solves, what data it touches, who is accountable, what the model can influence, and where human judgement remains in control.

Classification comes first

In regulated environments, the first job is classification. A document assistant, a customer segmentation workflow, an underwriting recommendation, and an autonomous execution agent do not belong in the same risk bucket. The governance model has to distinguish advisory, operational, customer-facing, and control-affecting use cases, because the evidence each one needs before release is different.

Tier	What the system can influence	Evidence before release	Who signs
Advisory	Drafts, summaries and search for a human who decides	Data access review, output logging, acceptable-use rules	Business owner
Operational	Internal process steps with no direct customer effect	Evaluation set, failure-mode register, rollback route	Business owner and data owner
Customer-facing	Communications, recommendations or decisions a customer experiences	Fairness testing, Consumer Duty outcome evidence, explainability, complaints route	Accountable Senior Manager
Control-affecting	Credit, pricing, financial crime, capital or regulatory reporting	Model risk validation under SS1/23, independent review, board visibility	Senior Manager plus model risk committee

From there, the operating questions become concrete. What evidence is needed before release? How will prompts, outputs, evaluations, and exceptions be logged? What failure modes are unacceptable? What is the escalation route? When does the use case need model risk review, legal review, security review, or board visibility?

What the EU timetable now looks like

Firms with EU customers or EU entities spent the first half of 2026 waiting to learn whether the AI Act's high-risk obligations would land on 2 August 2026 as written. They did not. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, six days before the original deadline.

Date	What applies
2 August 2026	Article 50 transparency obligations for new systems, including disclosure of AI interaction and marking of synthetic content
2 December 2026	Article 50(2) marking duties reach generative systems already on the market; new prohibitions on non-consensual intimate imagery and child sexual abuse material apply
2 August 2027	Member States must operate at least one national AI regulatory sandbox
2 December 2027	High-risk obligations apply to stand-alone Annex III systems, including credit scoring, insurance pricing and employment decisions
2 August 2028	High-risk obligations apply to AI embedded in products covered by EU product safety law (Annex I)

Two details matter more than the headline deferral. Systems already placed on the EU market before the new deadlines are grandfathered out of full high-risk compliance unless they are later substantially modified, and the threshold for substantial modification has not yet been defined. That makes the change log on every deployed model a regulatory document. And the penalty tiers are unchanged: up to seven per cent of global turnover for prohibited practices, and three per cent for transparency and high-risk breaches.

What UK regulators actually expect

The UK has taken a different route. As of 2026 the FCA has said it does not plan to introduce AI-specific regulation, and the Bank of England and PRA reiterated a technology-agnostic approach in their April 2026 response to Parliament. That is not the same as a light touch. It means AI will be judged under rules that already carry personal accountability.

The Treasury Committee's January 2026 report on AI in financial services was blunt about the gap between that stance and firms' readiness. It recommended that the FCA publish practical guidance by the end of 2026 on how consumer protection rules apply to AI, and on the assurance expected of Senior Managers under SM&CR for harm caused through its use. It also recommended that the major AI and cloud providers be designated as Critical Third Parties, and in July 2026 HM Treasury did exactly that for Amazon Web Services, Google Cloud, Microsoft and Oracle, with the Bank, PRA and FCA overseeing them jointly from 13 July.

For a governance system, the practical consequences are these. Every AI use case that influences a customer outcome must be able to evidence fair treatment under Consumer Duty. Every model that affects credit, pricing or capital falls within the PRA's model risk management expectations in SS1/23, whether or not anyone has called it a model. And every material use case needs an accountable Senior Manager whose name is on the intake record, because that is the person who will be asked to explain it.

Governance as a delivery enabler

This is where AI governance can become a delivery enabler. Teams move faster when they know the path. A well-run intake takes a use case from idea to a tier, an owner and an evidence list in a single session. Executives gain confidence because the risks are visible. Auditors can inspect the decision trail. The organisation learns which use cases are genuinely valuable instead of treating every AI idea as either magic or danger.

The minimum viable system has five parts: a use-case register with tiers, an intake form that captures data touched and decisions influenced, an evidence checklist per tier, a log of prompts, outputs and exceptions for anything above advisory, and a quarterly review that retires use cases which have not earned their keep. None of it requires new technology. All of it requires somebody to own it.

AI governance is not the opposite of innovation. In regulated firms, it is the mechanism that lets useful innovation survive contact with accountability.

Sources

• Gibson Dunn, EU AI Act Omnibus agreement and postponed high-risk deadlines
• Cloud Security Alliance, EU AI Act high-risk deadline deferred, not cancelled, August 2026
• House of Commons Treasury Committee, AI in financial services, responses to the Committee's first report
• Covington, UK financial services regulators' approach to AI in 2026
• Bank of England, PS16/24 Critical third parties to the UK financial sector