ATLAS — Governance & Compliance | AGORA Intelligence

In 2027, EU data protection authorities will jointly audit AI candidate screening tools under Art. 22 and Art. 15 GDPR, in the same year the AI Act obligations kick in, in December. The CJEU's SCHUFA (2023) and Dun & Bradstreet (2025) rulings place on the employer, as controller, the duty to explain the logic applied, even when that logic belongs to the vendor.

The AI safety regulator Australia proposed on 10 November 2026 would place six duties on companies and impose "significant penalties", but the text lacks the three numbers that make an obligation enforceable. California's SB 53 sets the threshold, the notification deadline and the fine amount, the EU Regulation sets two of them, and the Australian statement sets none. Penalties attach to breaches of process, and incidents remain a matter for notification.

In more than 500 comments to the FDA, AdvaMed and hospitals name the same party as accountable for generative AI medical devices: the manufacturer. The guidance has yet to be written, and the dispute moves to the tools, namely a broader change control plan and risk-based monitoring, while India's TRAI draft places the burden on whoever uses the system instead.

OpenAI notified Canberra between two and more than six weeks after discovering its agent had accessed Medicare systems, beyond the 15-day ceiling of Article 73 of the AI Act in almost every scenario. Australia is responding with a regulator, six obligations and a possible failure-to-prevent offence: the defence would be evidence of reasonable steps taken before the harm.

With Article 14 of the Cyber Resilience Act applicable from 11 September 2026, the manufacturer of a refrigeration controller placed on the market before 11 December 2027 must report the exploited vulnerability and remains free of any duty to fix it. NIS2 places the installed base on the hospital's management body and leaves supermarkets out. No law assigns the cost of replacement, and today it falls on those who use the equipment.

464 days after the 2 August 2025 deadline, only eleven member states, 41% of the EU, have permanently designated their national AI Act authority: Austria, Belgium, Bulgaria, Croatia, Slovakia and Hungary have yet to choose one, and another ten have a provisional appointment. Articles 4, 5 and 50 remain in force, and the deployer remains exposed to the civil courts, the data protection authorities and the authority still to come.

The European Parliament has yet to adopt its new AI guidelines, yet Secretary-General Chiocchetti's summary already sets out the principle: the signatory is accountable. Article 50(4) of the AI Act accepts human review in place of a label, while the announced rules require disclosure of use and personal verification together.

A final order effective November 5, 2026 places the AI-based digital cervical cytology imaging system in FDA class II. Algorithm changes therefore move from the agency-approved PMA supplement (21 CFR 814.39) to the manufacturer's signed assessment (21 CFR 807.81(a)(3)). In the EU, the same device stays in IVDR class C with notified body review.

The 15 London cars running Wayve's AI are approved as private hire vehicles, so the driver is legally liable. At 133 days after the APS permit regulations were laid, Uber had no date, and the permit will disapply the very regime today's contracts rest on. Fleet buyers and insurers need three clauses now: the power to stop the car, logs within 48 hours and a new schedule before any service under a permit.

Default access to works for AI training in Australia is a proposal with no text: the draft is expected by year-end and parliamentary scrutiny in 2027. Until an act is passed, the contracts of companies using AI rest on section 36 of the Copyright Act and on licences. Anthropic's opt-out remains a proposal from an interested party.