Governance and enterprise readiness
As AI moves from generating answers to making commitments, organisations need to show who authorised an action, which conditions supported it and what happened. Regulation, standards and procurement make that evidence a practical design concern.
Selected official sources reviewed 21 October 2026
From policy to the next action
| Governance question | Control to define | Evidence to examine |
|---|---|---|
| Who is responsible? | Name the organisational authority, workflow owner and permitted reviewer. | Approval scope, accountable role and exception history. |
| What can the system do? | Bind the proposed action to its current mandate and the enforced execution route. | Selected inputs, versions, action scope and decision basis. |
| What changed? | Identify affected work and establish authority for a revised arrangement. | Original record, reason for change and linked successor. |
| What actually happened? | Separate permission from attempt and observed effect. | Receiving-system confirmation or an explicit unresolved outcome. |
| Can a person correct or challenge it? | Provide review, correction and accessible escalation within the service. | Review request, responsible decision-maker and resolution. |
These are evaluation questions for OSYRA’s authority architecture. The organisation determines its applicable duties and the wider controls needed for its deployment. Scope-specific evidence supports that assessment.
See how execution coverage is assessedOctober 2026 developments
AI cybersecurity guidance
Published 14 October 2026. Addresses AI-specific security threats across the system lifecycle and complements established cybersecurity practices.
Connect an agent’s permitted actions and execution controls to the wider AI threat model. Model and data security remain separate responsibilities.
ISO · publication and scopeQuality management for the EU AI Act
CEN-CENELEC JTC 21 reports its Official Journal citation on 14 October 2026 under Decision (EU) 2026/2274. The voluntary harmonised route concerns the Article 17 quality-management requirements within the cited scope.
Connect documented responsibilities and change control to evidence from the actual workflow. A workflow component alone does not establish conformity for the complete system.
JTC 21 · harmonisation and scopeOrganisational AI governance
Published 16 October 2026. A recommended practice addressing governance principles and processes for organisations developing or using AI.
Give leadership a clear view of accountable roles, permitted actions and escalation. This is a governance reference, not a product certification.
IEEE · active standardPublic summaries of publisher information. Standards, law and certification have distinct roles. OSYRA does not claim certification or conformity to these standards.
Global context
Select a jurisdiction to see the status, relevant milestone and practical preparation question. The preparation prompts are OSYRA’s interpretation for workflow design, not duties imposed by every source.
Covered APP entities must add specified privacy-policy information where computer-assisted decisions use personal information and could significantly affect people’s rights or interests. This is a defined transparency obligation, not a general AI licensing regime.
Preparation question
Identify the affected decisions, information categories and responsible process owners. Connect reviewable workflow records to the organisation’s explanation and correction processes.
The AI Act distinguishes providers, deployers and system categories. The Commission’s current timeline places specified Annex III high-risk duties from 2 December 2027 and product-related Annex I duties from 2 August 2028. Other provisions already apply.
Preparation question
Determine the system’s classification and your role, then scope the required risk management, documentation, records and human oversight.
IMDA’s Model AI Governance Framework for Agentic AI was launched in January 2026 and updated in May. It offers a practical governance framework for organisations deploying agents. It is guidance, separate from applicable legal duties.
Preparation question
Define the agent’s permissions, human checkpoints and response when instructions, sources or task conditions change.
METI and MIC’s AI Guidelines for Business version 1.2, dated 31 March 2026, set out governance principles for AI developers, providers and business users. The guidelines are distinct from sector-specific legal obligations.
Preparation question
Assign responsibilities across the development and use of the system. Define the human review, records and operational controls for the selected task.
DIFC Regulation 10 addresses personal-data processing through autonomous and semi-autonomous systems. Its scope is DIFC-specific. A June 2026 consultation proposed further changes; that proposal is not treated here as enacted or as a UAE-wide requirement.
Preparation question
Establish the controller, deployer and operator responsibilities, relevant processing, oversight and evidence before defining the technical scope.
California’s privacy regulator states that businesses using automated decisionmaking technology for significant decisions must meet the ADMT requirements from 1 January 2027. Coverage and exceptions are specific to the regulations; this is not a single US-wide AI regime.
Preparation question
Identify covered decisions and the evidence needed to support the applicable notices, consumer rights and organisational response.
The ICO opened an agentic-AI call for evidence on 8 October 2026 to inform how data-protection law applies to these systems. Its work addresses emerging accountability and oversight questions; a call for evidence is not a new statutory deadline.
Preparation question
Map the information an agent can access, the actions it can take and the route for meaningful human intervention.
The Federal Chancellery describes work on an AI bill for consultation by the end of 2026, implementing the Council of Europe AI Convention. This is a legislative-development milestone, not the commencement date of a new AI law.
Preparation question
Keep a record of intended use, accountable roles, transparency and oversight requirements as the applicable framework develops.
SDAIA publishes AI Ethics Principles covering responsible development and use. Apply these alongside the data-protection, sector and institutional requirements relevant to the proposed deployment.
Preparation question
Define the responsible owner, selected information, human review and evidence requirements for the application.
Selected market context, not an exhaustive legal survey. Applicability depends on the intended use, responsible party, data, sector and location. Source dates and legal status should be checked when defining a deployment.
Cryptographic transition
ASD recommends a refined plan by the end of 2026, transition underway by the end of 2028 and completion by the end of 2030.
NCSC targets discovery and initial planning by 2028, highest-priority migration by 2031 and completion by 2035.
These are different planning targets, not a prediction of when a practical quantum attack will arrive. OSYRA’s roadmap addresses the continuity of authority records and verification as approved mechanisms change. Migration capability requires implementation-specific testing.
Read the guidance and OSYRA’s roadmapMake readiness concrete
Bring the requirement, the action it affects and the evidence your team needs to review.
