AI governance in 2026: the rules move, accountability stays

Executive summary

The deadlines moved; the work did not go away. The EU’s AI Omnibus entered into force on 27 July 2026. Stand-alone high-risk obligations now apply from 2 December 2027 and product-embedded ones from 2 August 2028, while transparency rules have applied since 2 August 2026.[1][2] Colorado replaced its AI Act with a narrower law on automated decisions that takes effect on 1 January 2027.[4]
Confidence runs ahead of maturity. In a 2026 survey of 525 US professionals, 74% believed their organisation could pass an AI compliance audit today, while 27% reported fully mature AI governance.[6]
Agents are arriving faster in well-governed organisations. 78% of organisations with mature governance had AI agents in production, against 22% of those with developing programmes.[6]
Incidents are rising and response is weakening. Stanford counts 362 reported AI incidents in 2025, up from 233 in 2024, and the share of organisations rating their incident response as excellent fell from 28% to 18%.[7][8]
Most staff work without rules. 40% of employees say their workplace has a policy or guidance on generative AI use, and 47% have had AI training.[9]

Key findings

01EU stand-alone high-risk obligations now apply from 2 December 2027 after the AI Omnibus

02Colorado's replacement law on automated decisions takes effect on 1 January 2027

0374% believe they could pass an AI compliance audit today; 27% report fully mature governance

Confidence and maturity in AI governance

Believe they could pass an AI compliance audit

74%

Report fully mature AI governance

27%

Source: Schellman, July 2026

Organisations with AI agents in production, by governance maturity

Mature governance

78%

Developing programmes

22%

Source: Schellman, July 2026

What leaders should do

Keep a single inventory of AI systems with an owner and risk tier for each.
Report value and risk together to the board.
Assign every upcoming obligation a named owner and date.

In the full report

The rules as they stand in October 2026
Confidence versus maturity
Who is accountable
Incidents and transparency
The workforce: use without rules
What to do in 2027
Sources

Methodology

ConfX research brings together our own analysis, what we hear from senior leaders at ConfX summits, executive roundtables and briefings, and the latest published research from regulators, academic institutions, industry bodies and research firms. Analysis completed on 15 October 2026.

Every figure is attributed to its source. Samples, regions and definitions differ between studies, so figures from different sources describe different groups and should not be combined. This report is not legal advice.