Governing AI Without Killing the Momentum

Balancing AI Speed and Safeguards

With the EU AI Act's prohibitions on unacceptable-risk practices (such as manipulative subliminal techniques, social scoring, and predictive policing beyond narrow exceptions) already enforceable since February 2, 2025, attention has shifted to the August 2, 2026, application of requirements for high-risk AI systems listed in Annex III. Providers and deployers must conduct risk assessments, ensure data quality, maintain technical documentation, undergo conformity assessments, and register systems in an EU database—obligations that apply even to systems placed on the market before that date if still in use.

This deadline matters because high-risk AI permeates critical sectors: biometric identification in law enforcement, AI aiding hiring decisions, creditworthiness evaluations, and educational assessments. Companies operating in or serving the EU market face direct impacts—disrupted supply chains if vendors lack compliance, halted deployments, or retrofits costing millions in engineering and legal resources. Fines reach €15-35 million or 3-7% of global turnover depending on the violation, dwarfing many firms' AI investment budgets.

The UK contrasts sharply. Absent a dedicated AI bill in early 2026 (with prospects uncertain beyond potential frontier model measures later in the year), regulators apply existing laws on data protection, equality, and sector-specific rules. Initiatives like AI Growth Zones and regulatory sandboxes aim to accelerate adoption while building assurance tools. This divergence heightens cross-border complexity for multinationals: EU exposure demands rigorous controls, while UK operations encourage experimentation—yet both jurisdictions grapple with the same core tension.

The central trade-off is momentum versus safety. AI development races ahead—capabilities double roughly every few months—yet governance lags, as frameworks cannot match pace without stifling breakthroughs. Waiting for perfect rules risks paralysis; rushing invites bias amplification, privacy erosion, or societal harms already evident in early deployments. Businesses balancing both must invest in pragmatic governance—using AI itself for compliance tasks like data tagging and risk detection—while navigating uneven global enforcement.