K&L Gates Volckrick Luxembourg’s Post

Regulators in the world's two biggest AI jurisdictions just switched on their agent rules, and both landed on a document your desk already owns. One read: what changed on 2 August, and the matrix worth dusting off. 🏛️   GenAI Watch, Wednesday.   First, one definition. An AI agent is software that acts on its own within a mandate, rather than waiting for a person's click. This month's news is about authority: who decides what such software may decide.   On 2 August, the EU AI Act's enforcement stage went live. AI that interacts with people must now disclose itself, obligations on the big general-purpose models begin, and penalties apply. In the same move, Brussels re-cut its high-risk deadlines, credit scoring among them, to 2 December 2027, an explicit runway to let usable standards catch up.   Three weeks earlier, China's rules for AI agents became enforceable, and their design is worth reading twice: decision authority in three tiers. Routine actions run on their own. Material decisions need human approval. And the highest tier, with financial trading authorisations named in it, cannot run autonomously at all. It goes to a person. Illinois, the same month, became the first US state to mandate third-party audits of AI safety plans. Different legal systems, one design: authority in tiers.   🔹 The shape you already own: this is a delegation-of-authority matrix. Sanction limits, maker-checker, refer it upward. Banking has run tiered decision authority for a century, and the rulebooks are now asking for that same schedule written for software: which decisions it may take, which it may only recommend, which it must hand up.   🔹 The runway: the EU's postponement is not a reprieve, it is a date. A desk that writes its AI authority matrix now walks into 2027 holding the template the regulators are converging on, instead of waiting to receive one.   If you wrote the three tiers for your own desk tomorrow, what sits in the top one, the tier no software may touch? Tell me below. 👇   #TheSightDraft #TradeFinance #ArtificialIntelligence #AIGovernance #Banking #Compliance #EUAIAct

Everyone's watching AI regulation this week. The rule that actually decides who gets to do business in Europe just got finalized quietly. The EBA finalized its Third-Country Branch authorisation Guidelines. Not a headline. But TCB rules are the actual gate: which non-EU entities get to run a branch in the EU, on what capital endowment, under whose supervision. This is the perimeter question underneath every other perimeter question. Before a firm's AI governance matters, before its reporting matters, it has to clear the door. TCB authorisation is that door, and it just got more defined. If you operate branches into the EU, or you're evaluating whether to, this belongs on the same desk reviewing capital planning, not filed under "international footprint, someday." The institutions that treat this as a compliance footnote will be the ones renegotiating their EU presence on someone else's timeline.

The EU AI Act reaches another major milestone in August 2026. While many UK financial services firms won't be directly regulated, its impact is already being felt through vendors, clients and evolving governance expectations. Read why the Act should still be on your radar. #FinancialServices #EUAIAct #MicrosoftUK https://lnkd.in/gmNe_xQc

AI Governance in Finance: The FCA Keeps AI Within Existing Financial Rules AI Governance in Finance (1/4) In June 2026, the UK Financial Conduct Authority (FCA) reiterated that it does not intend to introduce AI-specific financial regulation. Instead, it considers existing rules on governance, consumer protection, and operational resilience sufficient to oversee AI-enabled financial activities. Several implications stand out: * The FCA focuses on the outcomes produced by financial firms rather than the technology they use. * Firms remain accountable when AI systems contribute to lending, compliance, or other regulated activities. * Existing supervisory frameworks continue to apply when firms rely on third-party AI providers or cloud infrastructure. * Compared with the EU’s cross-sector AI framework, the UK approach places greater emphasis on institutional accountability within existing financial regulation. AI may change how financial decisions are made, but it does not change who regulators hold responsible for those decisions. PERMITFOLIO Regulation Research Institute #Permitfolio #AIGovernance #FCA #FinancialRegulation #ResponsibleAI #FinancialServices #RegTech

The EU Digital Omnibus on AI was published Friday, and it's in force today. (Regulation (EU) 2026/1744, if you want to look it up). Most of what I've read focuses on the delay, and fair enough: high-risk deadlines have slipped to Dec 2027 and Aug 2028. If you're running credit scoring models at a bank, that's the date you should care about. But there's a quieter change I haven't seen anyone talk about yet. A new Annex XIV puts "agentic AI" into the text of the AI Act for the first time. It doesn't actually require anything yet. What it does is give the Commission a way to change that later without going back through Parliament. So I wrote up what moved, what stayed put, and why that little code matters more than it looks. Read it at: https://lnkd.in/gBiSmrDZ The infographic below is the short version. Every date on it is already in the whichrule.ai registry at http://whichrule.ai/. This one was a good test, honestly: the regulation changed on about 24 hours' notice, and the registry was updated the same day, each date tied back to the exact article it came from. That's the whole reason we built it. One last thing: if you own AI compliance in financial services, keep an eye on the dates that didn't move. They'll probably eat more of your time this quarter than the ones that did. #ai-governance #financial-services-compliance #eu-ai-act #agentic-ai Views my own, in a personal capacity. Not the views of any current or former employer.

Last week, the UK government published its AI Adoption Plan for financial services, based on ten recommendations from Lloyds' head of AI, Rohit Dhawan PhD and Starling CIO, Harriet Rees. As a little bit of background, the pair were named AI champions in January, reporting to Economic Secretary to the Treasury Lucy Rigby, with a mandate to find where adoption could move faster and where barriers were holding firms back. It covers the regulatory perimeter, consumer disclosure standards for AI-driven services, rollout of the Critical Third-Party regime for AI and cloud providers, and a voluntary framework for sharing AI incidents across the sector. The plan takes a different approach from the EU AI Act, as, rather than adopting a standalone AI law, the UK is folding AI oversight into existing regimes such as consumer duty, SMCR, and operational resilience. There's no new rulebook, just more interpretation, as compliance and governance functions map AI use cases onto obligations written before agentic systems existed. Millions of people are already using general-purpose AI tools to shape financial decisions without ever consulting a regulated adviser. That is why the plan calls for a Financial Conduct Authority review. Where that regulatory boundary ultimately sits, however, remains fluid and likely will for some time. The Critical Third-Party regime is where this plan gets some teeth on big tech. It doesn't attempt a broad AI conduct regime; instead, it targets systemic risk in financial services specifically, which is narrower than the EU's approach but also more enforceable within its scope. But that will remain to be seen… The plan is betting that flexibility produces better outcomes than prescription. And after all, if you’ve ever heard me talk, it’s outcomes, not activity, that we should be focusing on. Whether that works will depend less on regulation than on whether firms invest now in governance, accountability and model assurance before regulators start defining those expectations for them. Here’s the full publication: https://lnkd.in/e3gXWfDj #AIAdoption #AIGovernance #FinancialServices #UKAIAdoption

According To Global Banking And Finance Review... Exciting development in the intersection of AI and media law: Germany’s media regulator confirms that Google's AI overviews fall under German media law. This reinforces the importance of regulatory clarity as AI tools become more integrated into information ecosystems. Read more about the implications and industry reaction in our latest report. https://lnkd.in/dyd7iqG4 German-media-regulator-googles-ai-overviews-subject-german/ https://lnkd.in/dbJBvqYs https://lnkd.in/d2Gtj6dz https://lnkd.in/dyd7iqG4

In a couple of days, EU AI Act Article 50 obligations bite. The high-risk obligations are not due until December 2027 and most firms will read that as relief. The ones who read it as a 'countdown' will be ahead of everyone else in 18 months. #EUAIAct #AIGovernance #RegulatoryChange #FinancialServices

The EU AI Act high-risk deadline just moved. August 2026 to December 2027. A 16-month extension for standalone Annex III systems — credit scoring, employment, education, critical infrastructure, essential services. The obligations haven't moved. Not one of them. The risk-based framework, the governance requirements, the penalties all remain, it's just the timeline that's moved, the work is the same. Not everything moved. Article 50 transparency obligations — requiring AI-generated content to be marked and labelled — still land on 2 August 2026. That's days away. If you have generative AI features in production, you're either ready or you're not. The delay reflects standards-readiness gaps at the EU level — not a reduction in the Act's substantive requirements. The regulators needed more time to finalise the technical standards. They didn't decide the requirements were too hard. The firms that use December 2027 as breathing room to build a proper governed, AI-ready foundation will arrive at that deadline audit-ready. The firms that use it as a reason to pause will be scrambling in Q3 2027 with the same gaps they have today. #EUAIAct #AIGovernance #DataGovernance #FinancialServices

Everyone posting "EU AI Act Annex III is now in force" today got the headline wrong. It isn't. December 2, 2027 is the new date for standalone high-risk systems. That's not a rumor — it's Regulation (EU) 2026/1744, the Digital Omnibus, which entered into force on July 27. Here's the part that gets missed. The 16-month delay isn't the story. The story is why it happened. 𝗧𝗵𝗲 𝗿𝗲𝗮𝘀𝗼𝗻𝘀 𝗯𝗲𝗵𝗶𝗻𝗱 𝘁𝗵𝗲 𝗱𝗲𝗹𝗮𝘆 → National competent authorities weren't designated on schedule → Conformity assessment bodies weren't ready to certify anything → Harmonized standards and Commission guidance simply didn't exist yet The EU built a compliance regime and discovered, close to launch, that the infrastructure to actually run it wasn't there. That's not a footnote. That's the whole lesson. 𝗪𝗵𝗮𝘁 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗹𝗮𝗻𝗱𝗲𝗱 𝘁𝗼𝗱𝗮𝘆 → Article 50 disclosure duties for new AI systems — chatbot disclosure, content labeling — on schedule from today → Legacy systems already on the market get a shorter grace period on watermarking specifically, to December 2026 → Annex I (product-embedded high-risk) pushed further out, to August 2028 If your compliance team spent this week celebrating a deadline that moved, ask what else moved without anyone checking. Genuinely curious where people land on this: does a 16-month delay mean the EU overreached on the original timeline, or does it mean enforcement infrastructure was always going to lag the law that created it? #AIGovernance #EUAIAct #ISO42001 #RegulatoryCompliance #ResponsibleAI