AI Governance: Who Is Held to Account When the Machine Errs?

The European Union wrote the first comprehensive law on artificial intelligence, and it entered into force on 1 August 2024. It then needed an amending package, published in the Official Journal in July 2026, to postpone the obligations for high-risk systems from August 2026 to December 2027. This is less a flaw in the legislators than a reminder that rules are written over years while technology changes over months. So who is held to account in the gap between the two?

Governance is not only law

When we say "governance" we do not mean a single piece of legislation but layers: binding laws, technical standards, declared principles, institutional oversight, and a culture of responsibility inside the developing organisation. Each layer closes a gap in the others; law is slow, and voluntary principles have no teeth. In Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA) published its AI ethics principles in September 2023, among them an "accountability and responsibility" principle which, according to a published summary, covers clear ownership of systems, incident reporting and channels for redress.

Regulation by risk

The European law sorts systems into four levels: unacceptable risk (banned, such as social scoring), high risk (permitted under strict conditions such as risk management and human oversight), transparency risk (such as telling people they are dealing with a machine), and minimal risk with no special rules. The logic is sound: a spam filter is not treated like a system that affects someone's hiring or education.

In the latest amendments the regulator itself acknowledged the weight of compliance on smaller firms, extending some of the relief granted to small companies to "small mid-caps" with fewer than 750 employees and turnover not exceeding 150 million euros. Here lies a delicate balance: a strict rule protects society, but if it is too costly, only the large can afford it.

Who bears responsibility?

When harm occurs, the act is spread across a chain: who designed the model, who collected its data, who deployed it, who used it. The OECD principles (adopted in 2019 and updated in May 2024) state that those who develop, deploy or operate AI systems should answer for their proper functioning according to their role and context, and keep records of data, processes and decisions that allow outputs to be reviewed and enquiries to be answered.

One practical step is a European approach to product liability. The new directive, in force since 8 December 2024 and applying to products placed on the market from 9 December 2026, covers software and AI systems, and makes the manufacturer liable for defects present when the product is released and for defects arising after an update or from machine-learning features. The injured person must prove the defect, the damage and the causal link between them, which is easier in a complex system than hunting for the intent of a particular actor. This is one model, and other countries may choose different paths.

Beyond borders

Models are trained in one country and used in dozens. In August 2025 the United Nations General Assembly established an international scientific panel of 40 members to prepare non-binding assessments, and an annual forum for dialogue on AI governance, the first full session of which is to be held in Geneva in 2026 and the second in New York in 2027. The world will not agree on a single law, but it may agree on a common language for dialogue between its systems.

What should an organisation do?

• Appoint a named, responsible owner for every AI system.
• Record data and important decisions in a way that allows traceability.
• Keep a human as decision-maker when the decision touches a person's fate: health, job or money.
• Distinguish an entertainment application from a system that affects people's rights, and tighten oversight in proportion to the risk.

Responsibility is a trust, and it does not fall away from its bearer because he handed the decision to an algorithm. The machine is not questioned; whoever made it, deployed it and permitted it is.