AI ethics is no longer philosophical — it's regulatory. The EU AI Act is now fully enforced, the US has issued AI executive orders with sector-specific guidance, and AI governance failures are generating legal liability. Every business deploying AI in 2026 needs a documented AI use case inventory, a risk classification framework, human oversight policies for high-stakes decisions, and a bias testing protocol. Building this infrastructure now is substantially cheaper than retrofitting it after a regulatory audit or a public incident.
Why This Can't Wait Until 2027
I've spent a decade covering Silicon Valley, and I've watched the AI ethics conversation cycle through several distinct phases: academic abstraction, public concern, corporate pledges, and now — finally — regulatory reality. The EU AI Act's full enforcement began in August 2026. The FTC's guidance on AI in advertising and consumer products has teeth. The EEOC has issued detailed guidance on AI in hiring decisions. This is no longer a hypothetical risk landscape.
More importantly, the governance failures are starting to generate headlines — and lawsuits. An AI hiring tool at a major logistics company was found to systematically downgrade applications from candidates who attended historically Black colleges and universities. A financial services firm's AI credit model was found to charge minority applicants 1.3 percentage points more in interest, correlating with zip code as a proxy for race. Both resulted in regulatory investigations and significant settlements. Neither company had intentionally built discriminatory systems. Both had failed to test for discriminatory outcomes.
The EU AI Act: What Businesses Need to Know Right Now
The EU AI Act classifies AI systems into four risk tiers, with obligations scaled to risk level:
- Unacceptable risk (banned): Social scoring systems, real-time biometric surveillance in public spaces, AI that exploits vulnerable groups.
- High risk (significant obligations): AI used in hiring, credit scoring, healthcare decisions, biometric identification, critical infrastructure, and education assessment. These systems require conformity assessments, human oversight mechanisms, transparency documentation, and registration in the EU AI database.
- Limited risk (transparency requirements): Chatbots and AI-generated content must be disclosed as AI. Deepfakes require labeling.
- Minimal risk (no specific obligations): Spam filters, AI in video games, recommendation systems meeting specific criteria.
Fines for violations scale with severity: up to €35 million or 7% of global annual turnover for the most serious violations, and €15 million or 3% for other high-risk system failures. If your business operates in, or sells to, EU markets — which includes most global enterprises — you need an AI Act compliance audit. The European Commission's AI portal provides the official guidance documents.
Bias and Discrimination: The Risk Most Businesses Are Ignoring
Algorithmic bias is not exotic. It emerges naturally from training data that reflects historical inequalities — and virtually all business data reflects historical inequalities. An AI system trained to predict "good employees" using historical performance data will encode whatever biases existed in past hiring and promotion decisions. An AI credit model trained on historical loan performance will encode historical lending discrimination.
The practical implication: before deploying any AI system that affects people — hiring, lending, pricing, healthcare — conduct a disparate impact analysis. This means testing whether the AI produces materially different outcomes for different demographic groups, even if protected characteristics are not explicit inputs. The NIST AI Risk Management Framework provides a structured methodology for this assessment and should be on every AI team's reading list.
AGI Timelines: What We Actually Know
No topic in AI generates more confident predictions with less empirical basis than artificial general intelligence timelines. I've interviewed dozens of leading AI researchers over the past five years, and the honest summary is: there is genuine, deep uncertainty. Estimates from serious researchers range from "within 5 years" (a minority view among active researchers at frontier labs) to "not in our lifetime" (a minority view among academic skeptics) to "somewhere between 10 and 50 years" (the plurality position).
What's clear is that the pace of AI capability improvement has consistently surprised experts in both directions — sometimes faster than expected, sometimes slower. The benchmark-based approach to measuring AI progress has significant limitations; many benchmarks that AI systems have "saturated" fail to capture important dimensions of human cognition, including causal reasoning, physical world modeling, and robust transfer learning to genuinely novel domains.
The practical business implication: plan for AI capability to continue improving rapidly, but don't bet your governance framework on any specific timeline. The most resilient approach is to build AI oversight structures that are robust to a wide range of capability levels — which is good practice regardless of when or whether AGI arrives.
Building Your AI Governance Framework: The Minimum Viable Version
For businesses not yet doing anything on AI governance, here is the minimum viable framework I'd recommend for 2026:
- AI use case inventory. Know every AI system you're using — including third-party tools. Many businesses have AI embedded in their CRM, ATS, financial software, and marketing platforms without realizing it.
- Risk classification. Map each AI use case to a risk level using the EU AI Act categories or the NIST RMF as your guide. High-risk use cases need more governance.
- Human oversight policy. For every high-risk AI decision, specify who reviews it, what authority they have to override the AI, and how overrides are logged.
- Vendor due diligence. Any third-party AI tool affecting people needs a review: What data does it train on? Who owns the outputs? What bias testing have they done? Can you audit the system?
- Incident response process. Define in advance how you'll handle an AI-related error, bias finding, or regulatory inquiry. Having a process before you need it is exponentially better than improvising under pressure.