Skip to content
Ludivine Gustave Dit Duflo路迪
  • AI Governance Brief
  • AI Governance
  • Digital Sovereignty
  • Tech Geopolitics
  • 9 min read

AI regulation: what your board must decide before 2027

The AI Act has been postponed, not suspended. Switzerland is preparing its response, while the United States and China follow other logics. What this new map demands of leaders, and the five decisions to make now.

Ludivine Gustave Dit Duflo

Strategic Advisor & speaker, Lausanne

Published
September 13, 2026

Status of the texts as of 13 September 2026.

In brief

  • Europe has postponed, not given up. AI Act obligations for high-risk AI systems will apply on 2 December 2027 instead of 2 August 2026. The prohibitions, the rules on general-purpose AI models and the transparency obligations already apply.
  • Switzerland will not have an AI Act, but it is not out of scope. A Swiss company whose AI systems are used in the EU is covered by the European regulation. And the Swiss draft on AI is due to be put out for consultation by the end of 2026.
  • The major blocs are diverging. Europe regulates by risk, the United States is fragmenting, and China regulates in layers while building its own sphere of global governance. An international group can no longer wait for a single rule.
  • The issue is not legal, it is decisional. The next fifteen months are for establishing the inventory, the responsibilities and the framework. Not for waiting.

The postponement is not a reprieve

On 27 July 2026, Regulation (EU) 2026/1744, known as the "Digital Omnibus" on AI, entered into force. It amends the AI Act on a point many leadership teams had been waiting for: the timeline.

High-risk AI systems listed in Annex III of the regulation, those used for example in recruitment, creditworthiness assessment, access to education or essential services, will have to comply by 2 December 2027, instead of 2 August 2026. For systems embedded in products that are already regulated, such as medical devices or machinery, the deadline moves from 2 August 2027 to 2 August 2028.

The reason for this postponement is telling. The harmonised technical standards, the ones meant to let a company demonstrate its compliance in practice, were not ready. Lawmakers acknowledged that you cannot demand proof when the measuring instrument does not yet exist.

But the postponement only affects part of the text. What already applies:

  • Prohibited practices, since 2 February 2025: social scoring, manipulation exploiting people's vulnerabilities, emotion recognition in the workplace or in educational institutions, among others. From 2 December 2026, the Omnibus adds a ban on systems that generate non-consensual intimate content or child sexual abuse material.
  • Obligations for providers of general-purpose AI models, since 2 August 2025.
  • Transparency obligations, since 2 August 2026: informing people that they are interacting with an AI, disclosing deepfakes. For systems already on the market, machine-readable marking of generated content benefits from a grace period until 2 December 2026.
  • AI literacy within teams. The obligation has existed since February 2025. The Omnibus has simplified it and gives the Commission and Member States a greater role in promoting it. Companies are still expected to support the upskilling of their teams.

Penalties remain a strong deterrent: up to 35 million euros or 7% of worldwide annual turnover for prohibited practices.

For a board, the reading is therefore simple. Fifteen months is roughly the time needed to inventory uses, classify them, fix what needs fixing and document. An organisation that reads the postponement as a pause will discover in 2027 that it has not gained time: it has lost it.

Switzerland: no AI Act, but no vacuum

Switzerland has made a different choice from the EU. On 12 February 2025, the Federal Council decided not to replicate the AI Act, but to ratify the Council of Europe Framework Convention on Artificial Intelligence and to adapt Swiss law where necessary, favouring a sector-based approach. Switzerland signed the Convention on 27 March 2025. The Federal Department of Justice and Police is due to present a draft for consultation by the end of 2026, covering in particular transparency, data protection, non-discrimination and surveillance. Observers do not expect entry into force before 2028.

Yet three misreadings keep coming up in leadership teams.

First misreading: thinking the AI Act does not concern a Swiss company. The European regulation applies to providers that place an AI system on the EU market, wherever they are established, and to situations where the output produced by a system is used in the EU. A company in the Lake Geneva region that sells software with embedded AI to European clients, or whose recruitment tool assesses candidates based in France, is in scope.

Second misreading: believing that nothing applies until Swiss law is in place. The Federal Data Protection and Information Commissioner made this clear as early as November 2023: the Data Protection Act, in force since 1 September 2023, applies directly to AI-based data processing. Among other things, it requires people to be informed when a decision concerning them is taken on a solely automated basis and produces legal effects or significantly affects them. In the financial sector, FINMA published its expectations on governance and risk management for AI in December 2024 for the institutions it supervises.

Third misreading: treating the Council of Europe Convention as a distant text. The European Union ratified it on 15 May 2026. It is not yet in force, as that requires five ratifications including three Council of Europe member States, but it already sets the direction Swiss law will take.

For a Swiss company active in Europe, the conclusion is pragmatic: the AI Act will, in practice, be its most demanding benchmark. It makes sense to build governance at that level, and to treat Swiss law as a local variation.

Europe, the United States, China: diverging logics

Beyond Europe, the regulatory map is fragmenting.

In the United States, fragmentation dominates. There is still no federal AI law. An executive order of 11 December 2025 organises challenges to state laws, while states legislate and then backtrack: in May 2026, Colorado repealed the AI law it had passed in 2024, before it even took effect.

In China, regulation advances in layers, and it is changing scale. Under the authority of the Cyberspace Administration of China, texts follow one another: generative AI since 2023, mandatory labelling of AI-generated content since September 2025, guidance on AI agents in May 2026, and rules on AI "companions" since 15 July 2026, which notably prohibit offering virtual intimate relationships to minors. In May 2026, the State Council's legislative plan included, for the first time, the acceleration of comprehensive legislation on AI.

Above all, China is no longer content to regulate at home. On 16 July 2026, 29 countries, including Russia, Brazil and Indonesia, signed in Shanghai the agreement establishing the World Artificial Intelligence Cooperation Organization. Oriented towards the Global South, it sets up a second pole of global AI governance. For a Swiss company present in these markets, these are no longer simply different rules: they are competing benchmarks.

The rest of Asia is following suit: South Korea, Taiwan and Vietnam now apply their own AI laws.

In Europe, a single risk-based regulation, now recalibrated to reflect the reality of standards and implementation capacity.

For a group operating across these blocs, waiting for global harmonisation is not a strategy. The only sustainable approach is to build a common governance baseline, demanding enough to satisfy the strictest jurisdiction, and then to manage local variations as adaptations, not as competing strategies.

While the law waits for its standards

The European postponement is a reminder of an often underestimated reality: those who write the technical standards write part of the rules. European harmonised standards are developed in standardisation committees where major industrial players are present and active. The day they are published, they will define in practice what "compliant" means.

In the meantime, two frameworks already provide a solid backbone:

  • ISO/IEC 42001:2023, the international standard for AI management systems. It is certifiable and built on the model of the ISO management standards organisations already know, in quality or information security.
  • The NIST AI Risk Management Framework, published in 2023 by the US National Institute of Standards and Technology. It structures risk management around four functions: govern, map, measure, manage.

Neither framework, on its own, provides a presumption of conformity with the AI Act. But an organisation that relies on one of them will already have done most of the groundwork: inventory, roles, risk assessment, documentation, monitoring. That is precisely what regulators, European and Swiss alike, will ask of it.

Five decisions to make now

Compliance is built by teams. But five decisions can only be taken at the level of executive management and the board.

1. Decide what we need to know. Where are we actually using AI? The inventory must include systems embedded in purchased software and those employees use outside any official framework. Without an inventory, no other decision is possible.

2. Decide what risk we accept. Which uses are we prepared to own? Those touching recruitment, credit, access to essential services or critical infrastructure are the natural candidates for high-risk status. They call for an explicit decision, not tolerance by default.

3. Decide our responsibility. Are we a provider, deployer, importer or distributor under the AI Act? The obligations differ, and a substantial modification of a purchased system can turn a company from deployer into provider.

4. Decide who is accountable for AI. Who really carries responsibility at executive level? It takes a named owner on the executive committee, and a regular oversight point at board level. As long as AI governance remains spread across IT, legal and the business, nobody carries it.

5. Decide which framework to use. What common baseline do we adopt? ISO/IEC 42001 or the NIST AI RMF, applied across all jurisdictions. This choice is what avoids rebuilding governance with every new text.

This is precisely where Decision Architecture™ begins: not adding a layer of process to governance, but making explicit which decisions need to be made, by whom, against which criteria and based on which signals.

The real question

The question "are we compliant?" has an expiry date: that of the next text. The question that matters for a board is different: does our way of deciding on AI hold up when the rules change?

The European Omnibus has just shown that even lawmakers adjust their timetable. Switzerland is preparing its response. The United States and China are moving according to other logics. In this shifting landscape, the advantage does not go to the organisation that knows the texts best, but to the one that has structured its decisions to absorb their changes.

It is a question of discernment before it is a question of compliance.

Sources

Texts and official sources

Analyses

Share this article

LinkedInXEmail

Related topics

AI GovernanceDigital SovereigntyTech Geopolitics

Receive the journal

One analysis, when it matters.

Receive a monthly selection of strategic analyses for leaders.

Keep exploring AI Governance

  1. 01Decision Note · 2 min · October 13, 2026AI budget 2027: three questions before you sign
  2. 02Executive Brief · 7 min · October 6, 2026What your cloud provider knows about your dependency
  3. 03Executive Brief · 9 min · September 29, 20266G: the 2030 standard is already being written, between Geneva and Shanghai

Move from reading to your own decision.

Apply the three movements of Decision Architecture™ to a real situation.

Clarify my decision