AI Governance Daily, 21 May 2026

Yesterday Brussels dropped a 174-page rulebook on how to classify high-risk AI.

Today OpenAI announced a global push into education. Which, funnily enough, sits squarely inside Annex III high-risk territory.

And the FTC started posting warning letters on the TAKE IT DOWN Act.

The vendors didn't pause to read the rulebook. The regulators didn't pause to wait for the vendors. Leaders = the people stuck in the middle, closing the gap. That's your quarter. Let's get into it.

🇪🇺 Europe & Regulation

• The AI Act is creaking under the weight of agents. Newsletter #102 covers the Digital Omnibus deal, the transparency guidelines now out for consultation, and the increasingly awkward question of whether the AI Act was ever designed for agentic systems. Short answer: no. Longer answer: you'll be expected to comply anyway. Read this before your next steering committee. Read

🇺🇸 US

• Lawfare: should Congress sign off on big government AI deployments? A serious proposal that advice-and-consent should apply to executive branch AI use in abuse-prone functions. Whether or not it ever becomes law, it reframes the conversation: AI deployment = a constitutional act, not a procurement decision. Worth reading even if you're nowhere near DC. Read
• FTC warning letters on TAKE IT DOWN are in the post. Platforms now have to offer a real mechanism for removing non-consensual intimate images on request. If you host user content and you've been sitting on your hands, the regulator just stopped being theoretical. Read
• OpenAI's next phase of Education for Countries. New partnerships, teacher training, tools aimed at national learning outcomes. Read it with the EU AI Act in your other hand: education = Annex III high-risk. Anyone procuring this for schools is going to own a compliance file, not just a contract. Read

🏢 Enterprise & Operating Model

• Ramp's engineers are reviewing code in minutes, not hours, with Codex and GPT-5.5. This is the kind of mundane productivity story that quietly resets baseline expectations across an engineering org. If your devs aren't using something like this yet, your velocity assumptions are already wrong. Read
• MIT Sloan: data transformation is the CEO's business. A Caterpillar case study via MIT CISR, arguing CEO-owned data governance = the precondition for any serious AI strategy. If your AI roadmap sits one rung above a swamp of ungoverned data, this is your nudge. Read
• Bernard Marr: rebuild your AI strategy before agents break it. Most current AI strategies assume a human in the loop on every meaningful decision. Agentic systems quietly violate that assumption. Marr's argument: most strategy decks are already out of date. He's right. Read
• The AI Factory, CEO edition. Marr's framing of the AI operating model in language a board will actually engage with. Useful if you're trying to drag the conversation out of pilot purgatory. Read

🧠 Voices worth 5 minutes

• An OpenAI model just disproved an 80-year-old discrete geometry conjecture. Unit distance problem, cracked. File this under capability milestone, then ask yourself the uncomfortable question: if frontier models are doing original mathematics, what exactly is the ceiling you've been quietly planning around? Read

⚠️ Watchlist

• Article 50 transparency consultation closes 3 June 2026 (13 days).
• High-risk classification consultation closes 23 June 2026 (33 days).
• Article 50 transparency obligations apply 2 August 2026.
• High-risk AI obligations apply 2 August 2026 on the current calendar.
• EU Omnibus formal adoption still pending.
• Trump AI security executive order still expected.

---

The rules are landing. The moves are happening. The gap between them is where your job actually lives this quarter. Pick one thing on this page, and move it forward today.