November 2026
Sources re-checked 4 November 2026 · Edited by Khaled Jabr
Four things from the last few weeks that change what a leader should ask about AI at work. Each one links to its source.
- DeadlineDeadline: 2 December 2026
2 December: the EU grace period for marking AI-generated content ends
Under the EU AI Act, providers of generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to make their outputs (audio, image, video, text) machine-readable as AI-generated. The duty to tell people they are dealing with an AI has applied since 2 August 2026. The CSA note cites fines of up to €15 million or 3% of worldwide turnover under Article 99.
What you can do: If you build or resell a generative AI feature, ask your vendor in writing how its outputs are marked, and keep the answer. If you only use such tools, ask what they promise before 2 December.
General information, not legal advice. It matters if your AI is offered in the EU or its output is used there.
Sources: Cloud Security Alliance research note, 21 Sept 2026 · Orrick, July 2026
- ConsultationCloses: 20 November 2026
The UK data regulator asks for evidence on AI agents until 20 November
The UK Information Commissioner’s Office opened a call for evidence on how data protection law applies to agentic AI. Law firm Pinsent Masons lists six themes: data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawful processing. It also asks about measures such as agent identities, permissions and guardrails, audit logging and meaningful human oversight. It is not formal guidance; the input will inform future guidance and a statutory code of practice.
What you can do: These are the questions in the Agent Register: who is the agent, what can it reach, what does it log, who can stop it. If you operate in the UK, consider responding; if not, use them to test your own register.
We read a law-firm summary of the call, not the ICO page itself.
Sources: Pinsent Masons, 9 Oct 2026 · Ashford Partners, 25 Oct 2026
- New dataReleased: October 2026
IBM survey: 8 in 10 executives say an AI incident reached the board
Censuswide surveyed 3,221 senior executives at companies with 1,000 or more employees in the UK, France, Germany, Italy, Spain, the Netherlands, Saudi Arabia and the UAE (14–24 September 2026). 80% say an AI-related incident reached the board or C-suite; of those, 40% changed their governance policy or framework afterwards. 35% run agentic AI in production and 37% say their governance is designed to scale with agents. 21% continuously monitor third-party AI risk.
What you can do: Ask your own board two questions: when did an AI incident last reach us, and what changed afterwards? The One-Page Board AI Report has a line for exactly that.
A survey commissioned by IBM, which sells AI governance products. The sample covers large companies in eight countries, not all companies.
- GuidancePublished: 15 October 2026
Financial regulators’ group finalises 12 sound practices for AI
The Financial Stability Board finalised “Sound Practices for Responsible Adoption of AI”: twelve practices grouped into governance (1–4), lifecycle risk management (5–10) and cyber, ICT and third-party risk (11–12). A law-firm summary describes it as a practical toolkit institutions can adapt to their own context and risk profile.
What you can do: In financial services, use it as a checklist for your next AI review. In other sectors, the three-part structure (governance, lifecycle, third parties) is a useful outline for your own.
We read a law-firm summary, not the full FSB document, so we do not describe individual practices here.
Sources: A&O Shearman, 15 Oct 2026
One question for your next leadership meeting
Pick one AI agent in your company. Can its owner show you, in under a minute, what it can reach, who can stop it, and where its actions are logged?