By Shane Tierney
Responsible AI matters because the technology arose prior to any regulation; and now rules are arriving faster than most governance programmes can absorb.
While responsible AI is high on the agenda today, the core idea and philosophical principle has been around for nearly 50 years. Yet, AI adoption is significantly outpacing the agreement and introduction of any regulatory governance. Some frameworks are attempting to close that gap, such as the EU AI Act. Different jurisdictions are moving at different speeds and with different regulatory instincts. This makes it harder for companies to build AI governance programmes that are both practical and durable.
Responsible AI has everything to do with governance
Microsoft defines responsible AI as “an approach to developing, assessing, and deploying AI systems safely, ethically, and with trust. AI systems result from many decisions made by their creators. Responsible AI helps guide these decisions—from defining system purpose to user interaction—toward more beneficial and equitable outcomes.”
The concept seems straightforward at first glance, but these legal standards and ethical principles are open to interpretation. However, it is possible to agree on certain values. Transparency now has a date attached. Since 2 August 2026, Article 50 of the EU AI Act has applied, establishing mandatory transparency, labelling and machine-readable marking rules for providers and deployers of AI systems. Non-compliance carries fines of up to €15 million or 3% of global turnover. Generative systems already on the market have until 2 December 2026 to meet the machine-readable marking requirement; a short runway, not a reprieve.
“A computer can never be held accountable, therefore a computer must never make a management decision.” This famous quote originates from a 1979 internal IBM management training presentation slide. Since then, this sentence has become the foundation for modern technology ethics, particularly regarding AI governance.
Technology amplifies judgment and optimises data, but authority over decisions with real-world consequences stays with a person. Systems can be autonomous; responsibility is not transferable. You can outsource labour to a machine. You cannot outsource the consequences.
AI adoption outpaces regulation
Technology reaching the market ahead of its rules is not new. Early automobiles arrived before traffic law, and it took years of accidents before say, the Highway Code in the UK caught up. AI is following the same pattern on a much steeper gradient.
Whether the lag comes from regulators not understanding the technology, not grasping its societal impact, or facing political pressure not to regulate, the effect is identical: the adoption curve and the governance curve are not aligned.
Many CISOs, Chief Legal Officers or General Counsel I speak with agree with the concept that the business imperative of adopting AI agents is the absolute priority, especially with SaaS providers and the software industry overall. Ungoverned risk is a second-order concern next to the risk of being left behind.
The gap between responsible AI as a principle and as an operating model
Modern frameworks like Human-in-the-Loop and the EU AI Act enforce the principles set by the 1979 IBM quote by ensuring humans retain final decision-making power. However, the market is moving past vague AI principles. It wants evidence, disclosures, traceability, and proof that people are held accountable for the outcomes of the automated decisions being made.
A responsible AI operating model transforms abstract ethical policies into daily business processes that span the entire technology lifecycle. Instead of acting as a final checklist before launch, the model will link governance, risk management, organisational roles, and automated tooling directly to business outcomes.
For instance, the EU AI Act in its article 50 operationalises core responsible AI principles, such as accountability, user autonomy, and deception prevention.
However, responsible AI is not just about labelling content or choosing sides in a geopolitical debate, but rather translating broad responsible AI expectations into policies, controls, documentation, and accountability structures that organisations can actually operate. Enterprises need to know what went into the decision-making process and how the AI came to the results it did.
The different AI Governance approaches emerging between jurisdictions
For a multinational organisation, AI responsibility means more than following one framework. They must contend with the mismatch between the rules, the timelines, and the enforcement cultures across various jurisdictions.
For example, the EU approach towards AI governance is focused on key features such as transparency, traceability, documentation. The Digital Omnibus on AI entered into force on 27 July 2026, deferring the high-risk obligations under Annex III from August 2026 to December 2027 while letting the transparency obligations take effect on schedule. Read that correctly: Brussels is adjusting sequencing, not softening intent.
Looking forward, Brussels does not like the fact that all the frontier models are controlled by U.S companies. In response, the bloc is pushing towards digital sovereignty, through the EU Tech Sovereignty Package, featuring key legislative frameworks such as the Cloud and AI Development Act (CADA) and the Chips Act 2.0, which would tie public sector cloud procurement to four graduated sovereignty assurance levels, rising to a requirement for EU ownership and control. For any vendor selling into European public bodies, that is a commercial fact, not a policy debate.
Conversely, the US is moving the other way. Federal and state lawmakers disagree on what AI regulation should even look like, and the result is fragmentation.
The adoption of national federal legislation on responsible AI or data privacy remains unlikely for the foreseeable future. This is more due to political considerations and the will of US lawmakers to maintain a deregulatory philosophy. In contrast, an increasing number of states are voting and adopting AI regulations, focusing on data privacy. In my opinion, I expect that to be corrected. The current federal trough looks like a phase, not an equilibrium.
Smart organisations are getting ready for that shift now, before the regulations even come. They may even proactively take a voice in trying to guide and shape future regulation, enabling them down the line to implement AI governance programmes that are practical and durable.
Moving forward
The companies that win will be the ones that can prove human control, not merely assert it. Find the common denominators across AI regimes, implement those as a global baseline, and layer jurisdiction-specific requirements on top. That gives you flexibility where you need it and consistency where regulators and customers look for it, which in turn would build trust with both parties.
To that extent, organisations should seek to adopt responsible AI through practical governance, focusing on features like AI usage policy, protecting confidential and personal data, and ensuring continuous human review for high-impact outputs. Companies should also train employees on appropriate AI use, and integrate AI controls into existing security, privacy and compliance processes.
Responsible AI matters because businesses are deploying systems that are moving faster than their governance habits allow. However, the market can no longer contend with vague ethical principles. A responsible AI operating model should and must turn these into actionable business processes.
In the fragmented regulatory environment, the winning companies will be the ones that can prove human control and ethical standards in line with those existing across various AI governance frameworks.
Shane Tierney
