AI regulation in 2026 demands proactive governance, not delay

At a glance

What this is: Holistic AI argues that AI regulation in 2026 is moving through uncertainty, but the compliance expectations around risk assessment, documentation, oversight, and monitoring are already converging.

Why it matters: IAM, GRC, AI governance, and security teams need a governance model that can handle AI across jurisdictions, use cases, and deployment stages without waiting for legal clarity.

Context

AI regulation in 2026 is defined less by a single law than by a governance gap: organisations are being asked to manage conflicting timelines, overlapping obligations, and unresolved policy questions at the same time. That creates a practical problem for AI governance programmes because legal uncertainty does not remove the need for controls.

The article centres on the operational challenge of governing AI systems across jurisdictions while policy direction shifts. For identity and security teams, the key issue is not only compliance, but whether the organisation can maintain evidence, oversight, and accountability when AI use cases touch employment, personalisation, and other regulated decisions.

This is a typical problem for organisations adopting AI at scale. The governance burden is now multi-jurisdictional and cross-functional, so delay becomes a control weakness rather than a neutral waiting strategy.

Key questions

Q: What breaks when AI governance is delayed while regulations are still unsettled?

A: Delay creates an evidence and accountability gap. AI systems continue to make or support decisions while teams wait for legal clarity, which means risk assessments, oversight, and documentation are not keeping pace with deployment. The result is unmanaged exposure, especially in high-impact use cases where regulators expect controls even before every rule is finalised.

Q: When should organisations prioritise AI identity governance over new AI deployments?

A: They should prioritise it before broad deployment, because the first wave of AI usage often creates the largest blind spots. If the identity model, approval path, and review cadence are not defined early, the organisation inherits shadow usage and excess access that are harder to unwind later. Governance should precede scale.

Q: How do teams know whether AI governance is actually working?

A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement. If auditors can ask for a transaction and receive a complete record in hours, not weeks, the programme is producing usable control evidence rather than just documentation.

Q: Who should be accountable for POPIA compliance across legal, security, and business teams?

A: Accountability should sit with a designated Information Officer, but effective POPIA compliance requires shared execution across legal, security, HR, procurement, and business owners. The Information Officer coordinates oversight and regulator communication, while each team must control the personal information it collects, stores, or shares. Without clear ownership, privacy obligations tend to fail at handoff points.

Technical breakdown

Why overlapping AI laws create governance friction

AI regulation is becoming difficult to operationalise because different jurisdictions are regulating similar use cases with different scopes, timings, and enforcement paths. That matters because compliance programmes usually depend on stable rule sets, clear ownership, and fixed evidence requirements. When those assumptions break, teams cannot rely on a single policy baseline. Instead, they need governance that can absorb uncertainty while still producing consistent assessments, documentation, and oversight across the AI lifecycle.

Practical implication: build a jurisdiction-aware control map for AI use cases before the rules settle.

Risk assessments, documentation, and monitoring are the common control pattern

Across the article, the recurring control pattern is clear: high-risk AI systems are being governed through risk and impact assessments, data governance controls, oversight mechanisms, documentation, and post-deployment monitoring. These are not isolated compliance tasks. Together, they form the evidence chain that shows the system was assessed, reviewed, and monitored over time. For practitioners, the technical point is that AI governance has moved from one-time review to continuous assurance.

Practical implication: treat assessment, documentation, and monitoring as linked controls, not separate compliance checkboxes.

Regulatory delay does not suspend existing obligations

The article makes an important distinction between delayed or uncertain AI-specific legislation and the broader body of existing laws that still applies to AI systems. That means governance cannot be paused simply because one regime may be simplified or deferred. The practical mechanism is straightforward: if the organisation depends on future clarity before acting, it creates an unmanaged period where controls are absent even though legal exposure remains.

Practical implication: maintain baseline governance controls even when a specific AI rule is still in flux.

NHI Mgmt Group analysis

AI governance delay has become a control failure mode, not a planning preference. The article shows that organisations are being asked to operate while legal direction remains unsettled, yet the need for risk assessment, oversight, and documentation is already present. That makes postponement a governance gap because the system still makes decisions while the control framework waits for certainty. Practitioner conclusion: treat delay as residual risk, not as a neutral holding pattern.

Risk-based AI regulation is converging around the same operational controls. Different jurisdictions may diverge on scope and timing, but the control expectations are increasingly familiar: assess risk, govern data, maintain oversight, and monitor after deployment. That convergence matters because it gives programme teams a stable design target even when the legal text moves. Practitioner conclusion: standardise your AI control baseline around the common obligations, then localise by jurisdiction.

Proactive governance is now an enterprise operating model issue. The article is right to frame AI compliance as a whole-company responsibility because AI use cases cut across legal, security, product, HR, and data functions. For identity and access teams, the intersection is real wherever AI systems influence decisions, approvals, or automated actions tied to human identity and access. Practitioner conclusion: assign clear accountability across business and control owners before expansion creates governance debt.

Dynamic pricing and HR automation show where AI governance pressure will land first. The article points to employment decisions, personalisation, and other high-impact uses as the most visible regulatory targets. Those are the areas where poor governance quickly becomes visible to regulators, employees, and customers. Practitioner conclusion: prioritise the AI workflows with the greatest downstream impact on people, not just the highest model complexity.

Post-deployment monitoring is the named concept that most programmes still underbuild. The article repeatedly ties future compliance to ongoing oversight, yet many programmes still behave as if validation ends at release. That is structurally weak because AI systems can drift in behaviour, context, and use case after deployment. Practitioner conclusion: make monitoring part of the approval standard, not an optional maturity add-on.

What this signals

AI governance debt is now a programme risk. When teams postpone controls because the regulatory picture is unsettled, they accumulate deferred decisions, missing evidence, and inconsistent oversight across AI use cases. The practical response is to build a baseline control model now, then tune it as jurisdictions clarify.

Post-deployment monitoring should be treated as part of approval, not as an afterthought. AI systems change after release, especially in high-impact contexts such as employment and personalisation. Teams that separate monitoring from approval usually discover too late that the operating model never matched the risk.

For practitioners

• Build a jurisdiction-by-use-case AI obligations map Map each AI use case to the jurisdictions, sectors, and decision types it touches so teams can see which obligations apply now and which are likely to change. Include employment, pricing, financial services, and other high-impact uses separately because the regulatory pattern is not uniform.
• Standardise risk and impact assessment templates Use one assessment structure across AI programmes so legal, security, data, and business owners can compare decisions consistently. The article’s core point is that assessment, documentation, oversight, and monitoring need to be repeatable controls rather than one-off reviews.
• Create post-deployment monitoring for high-risk AI Define what will be measured after release, who reviews it, and what triggers re-assessment when outputs, users, or contexts change. This is especially important where AI influences employment decisions, essential services, or other regulated outcomes.
• Assign a single governance owner per AI system Set explicit accountability for each system across legal, security, and operational teams so uncertainty does not become a reason for inaction. Governance only works when someone owns evidence, change control, and review cadence from deployment onward.

Key takeaways

• AI regulation in 2026 is being shaped by uncertainty, but the need for governance does not pause while laws are debated or delayed.
• The article repeatedly points to the same control pattern: risk assessment, documentation, oversight, and monitoring across the AI lifecycle.
• Teams should build a durable governance baseline now and localise it by jurisdiction rather than waiting for a single settled regime.

Key terms

• AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
• High-Risk AI System: A high-risk AI system is one whose outputs can materially affect a person’s rights, opportunities, or safety. These systems need stronger oversight because errors, bias, or unauthorized actions can create legal exposure as well as security and trust problems.
• Post-Deployment Monitoring: The ongoing review of AI system behaviour after release to detect drift, harm, or policy violations. It is more than logging, because it should produce evidence that decisions, outcomes, and exceptions are being reviewed and acted on over time.
• Risk-based regulation: A regulatory approach that applies stricter obligations to AI use cases based on their potential impact, not just whether AI is present. It requires organisations to classify use cases, apply proportionate controls, and prove that higher-risk systems receive deeper oversight and documentation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps security and identity practitioners build the governance foundations that support broader AI and identity programmes.