Weekly AI Governance Brief: 5–11 October 2026
Bringing you the latest developments in the AI Governance world.
EU proposes reform of the European standardisation framework
On 6 October, the European Commission adopted a proposal for a new European Standardisation Regulation, COM(2026) 780 final, intended to replace Regulation (EU) No 1025/2012.
The proposal seeks to modernise the procedures through which European standards are developed and used to support regulatory compliance.
Among its objectives are accelerating standards development, improving participation by smaller businesses and ensuring that the standardisation system can respond more effectively to the Union's regulatory priorities.
The proposed framework addresses procedural deadlines and the accessibility of standards referenced in EU legislation. It also introduces additional mechanisms for developing technical specifications where established standardisation processes are unable to deliver the required results.
The proposal will now be considered by the European Parliament and Council under the ordinary legislative procedure. It does not immediately amend the existing requirements applicable to organisations relying on harmonised standards.
Why this matters
European standardisation is an important component of the EU's regulatory compliance infrastructure.
Under the AI Act, harmonised standards can provide a means of demonstrating conformity with applicable requirements. The processes through which those standards are developed therefore have practical significance for providers preparing compliance documentation and conformity assessments.
The Commission's proposal addresses the institutional mechanisms supporting that system rather than changing the AI Act's substantive obligations.
Its relevance lies in the proposed changes to how technical standards are developed, made accessible and incorporated into the wider EU regulatory framework.
EU Scientific Panel examines frontier-AI safety incidents
On 9 October, the European Commission convened an extraordinary meeting of the Scientific Panel on Artificial Intelligence to examine safety and security concerns associated with frontier AI systems.
The Commission confirmed that the panel had investigated recent incidents involving reported losses of control over advanced AI systems.
Working with the EU AI Office, the panel had developed questions for the companies responsible for the models involved. The Commission also announced that the panel would present recommendations addressing frontier-AI safety and security risks during the meeting.
The Scientific Panel consists of 60 independent experts appointed to support implementation and enforcement of the AI Act.
Its responsibilities include advising the AI Office and national authorities on systemic risks, model classification, evaluation methodologies and cross-border market surveillance.
The announcement did not establish that the Commission had reached formal findings of non-compliance or imposed new requirements on the companies concerned.
Why this matters
The meeting provides an example of the AI Act's scientific advisory mechanisms being used in response to emerging risks associated with advanced AI models.
The involvement of independent technical experts is significant because assessing frontier-model risks may require evidence and evaluation methods that differ from conventional regulatory investigations.
The development also illustrates the relationship between scientific assessment and regulatory supervision.
Technical findings can inform the AI Office's understanding of systemic risks without automatically constituting an enforcement decision.
The distinction between advisory activity and formal enforcement remains important. At this stage, the confirmed development concerns expert assessment and the preparation of questions for model providers.
UK regulator establishes clearer expectations for foundation-model data protection
On 8 October, the UK's Information Commissioner's Office published the findings of its supervisory engagement with major foundation-model developers.
The regulator reported that ten developers operating in the UK had made, or committed to making, improvements to their data-protection practices.
These improvements concerned transparency, mechanisms for exercising individual rights and assessments of safeguards.
The accompanying report provides detailed regulatory positions on the processing of personal data during foundation-model development.
It addresses the lawful bases available for model training, including the application of legitimate interests where personal data is obtained through web scraping.
The report also examines the circumstances in which trained models themselves may contain personal data and the implications for individuals seeking to exercise their rights.
A further area of concern involves special-category personal data. The ICO identifies significant challenges where training datasets contain sensitive information and developers cannot readily establish an applicable condition for processing under Article 9 of the UK GDPR.
Alongside the report, the regulator opened a six-week call for evidence on agentic AI.
The consultation seeks information about how organisations manage data-protection risks when AI systems operate with greater autonomy, including through tool use and interactions with external services.
Why this matters
The publication provides concrete supervisory expectations for organisations developing foundation models using personal data.
Its treatment of transparency and data-subject rights is particularly relevant where training datasets contain information collected from third-party sources.
The regulator also makes clear that technical difficulties associated with identifying personal data within trained models do not automatically remove organisations' data-protection responsibilities.
The agentic-AI consultation extends these questions beyond model development.
As AI systems increasingly perform tasks and interact with external environments, organisations must consider how existing data-protection principles apply to autonomous processing activities.
The consultation is intended to inform future regulatory guidance rather than establish new binding requirements immediately.
Norway announces plans to restrict AI-enabled smart glasses
On 5 October, Norway's Ministry of Digitalisation and Public Governance announced plans to introduce a temporary prohibition on AI-enabled smart glasses in selected locations.
The government identified concerns about individuals being photographed, filmed or recorded without their knowledge.
The proposed restrictions could apply to environments where privacy expectations are particularly significant, including healthcare facilities and locations with changing rooms.
The government also identified schools and other environments frequently used by children as potential areas for restrictions.
The proposed measure would not amount to a general prohibition on AI glasses.
The government intends to determine the precise scope of the technology covered and consider exceptions for particular users and socially beneficial applications.
Alongside the temporary measure, it announced plans to establish an expert group to examine longer-term regulation of wearable technologies.
No binding prohibition was introduced through the announcement. A legislative proposal remains to be submitted to Norway's parliament.
Why this matters
The initiative reflects a regulatory approach based on the context in which AI-enabled technology is used.
Rather than concentrating exclusively on the capabilities of a particular model, the proposed restrictions address the circumstances in which recording and AI functionality may interfere with privacy.
The approach is relevant to developers and organisations deploying wearable AI systems because it identifies physical environments as a potential basis for restricting use.
The final legal scope remains undetermined, including which devices and locations would be covered.
UK government accepts healthcare AI regulatory recommendations
On 6 October, the UK government published its formal response to the National Commission into the Regulation of AI in Healthcare.
The government accepted all 44 recommendations contained in the Commission's September report.
The response establishes a programme for developing a more proportionate regulatory framework that assesses AI-enabled medical devices throughout their operational lifecycle.
A central element is the move toward continuing evaluation and post-market surveillance, rather than relying predominantly on assessments conducted before deployment.
The Medicines and Healthcare products Regulatory Agency also opened applications for the third phase of its AI Airlock regulatory sandbox.
This phase will focus on post-market surveillance and lifecycle regulation, using practical testing to inform future regulatory guidance.
The government committed to publishing draft guidance by December 2026 concerning changes to AI-enabled medical devices as they adapt over time.
It also plans to consult on qualification and classification of AI-enabled medical devices and publish a broader implementation roadmap by spring 2027.
The response does not itself introduce a completed new regulatory framework. It establishes the government's position on the recommendations and identifies initial implementation priorities.
Why this matters
The response represents a substantive procedural advancement from independent regulatory recommendations to formal government commitments.
For developers of AI-enabled medical devices, the emphasis on lifecycle regulation is relevant to how system changes and performance after deployment may be assessed.
The third phase of AI Airlock also provides a structured regulatory environment for examining these questions using actual technologies.
The development distinguishes the government's intended regulatory direction from obligations already in force, while identifying specific areas in which further guidance is being prepared.
Looking ahead
The developments of 5–11 October illustrate several approaches to AI governance operating simultaneously.
Within the European Union, the Commission is addressing the technical infrastructure supporting regulatory conformity while activating scientific advisory mechanisms in response to frontier-model safety concerns.
In the United Kingdom, supervisory work is providing more detailed interpretations of existing data-protection requirements, while healthcare regulation is moving toward continuing assessment of deployed AI systems.
Norway's proposed restrictions on smart glasses introduce a different dimension, focusing on the physical environments in which AI-enabled technologies may be used.
Across these developments, governance attention extends beyond initial model development to the institutional processes through which AI systems are assessed and supervised.
The reporting period therefore reflects continuing efforts to translate broad regulatory frameworks into more specific oversight mechanisms and operational expectations.
Sources
European Commission proposal for a new European Standardisation Regulation, COM(2026) 780 final: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026PC0780
European Commission announcement concerning the Scientific Panel's extraordinary meeting on frontier-AI safety: https://digital-strategy.ec.europa.eu/de/news/commission-holds-special-meeting-scientific-panel-frontier-ai-safety-and-risks
UK Information Commissioner's Office report on foundation-model development and data protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/
UK Information Commissioner's Office call for evidence on agentic AI: https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/
Norwegian government's announcement concerning proposed restrictions on AI-enabled smart glasses: https://www.regjeringen.no/no/aktuelt/vil-innfore-midlertidig-forbud-mot-ki-briller/id3175516/
UK Government response to the National Commission's recommendations on healthcare AI regulation: https://www.gov.uk/government/publications/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare