AI governance has to move on from "just" compliance to supporting businesses in driving innovation and making better decisions about 𝘄𝗵𝗶𝗰𝗵 𝗔𝗜 𝘁𝗼 𝗮𝗱𝗼𝗽𝘁 𝘁𝗼 𝗺𝗮𝘅𝗶𝗺𝗶𝘇𝗲 𝗥𝗢𝗜. This is where AI risk quantification comes in: it can help you decide whether the risk adjusted ROI - accounting for the risk exposure from adopting the AI system - is actually positive. We explain in this brief video.

🇪🇺 The EU published its official icons for labelling AI-generated content on 10 June. Three of them, chosen by how much the AI made: Fully AI-Generated, Partially AI-Modified, and a Basic marker, free to download in SVG and PNG. They serve Article 50(4), the deployer duty to disclose deepfakes and AI-generated public-interest text, which applies from 2 August 2026. The catch most coverage blurs: the icons are optional, the obligation is mandatory, and an icon does not make you compliant by itself. Full guide: modulos.ai/blog/eu-ai-conten… #EUAIAct #AITransparency

🇪🇺 The European Parliament adopted the EU AI Act digital omnibus on 16 June 2026, and the relief coverage is missing two things. The registration obligation for self-assessed non-high-risk systems survived: the Commission wanted it deleted, Parliament kept it. And the content-labelling deadline got tighter than the Commission asked for, landing on 2 December 2026 instead of February 2027, the same day the new nudifier and CSAM ban takes effect. High-risk dates: 2 December 2027 and 2 August 2028. Plan against them as binding. Full breakdown: modulos.ai/blog/eu-ai-act-om… #EUAIAct #AIGovernance

🇺🇸 Colorado's new SB 189 replaces the unenforced 2024 AI Act with a narrower framework that the Attorney General will actually enforce from 1 January 2027. The novel piece sits in Section 6-1-1707: developer-deployer fault allocation. Full analysis: modulos.ai/blog/colorado-sb-… #ColoradoAIAct #SB189

🇪🇺 EU AI Act Annex III: What the Draft Guidelines Just Changed The European Commission published its draft guidelines on Annex III high-risk AI classification under the EU AI Act on 19 May, and the early commentary is missing the most important shift in the document. At first glance, the story is contraction. Critical infrastructure narrowed, law enforcement evidence handling shrank, judicial administration tools were carved out, and election logistics were trimmed. The headline writes itself, but it only lands on the narrow vertical markets that most enterprises were never in. The deeper story is a rotation. Coverage moved toward the categories where enterprise AI actually lives: → Employment AI now reaches freelancers, platform workers, virtual workplaces, and onboarding → Insurance AI now covers long-term care, personal pension, credit life, and public health insurance with AI risk assessment, without the fraud-detection exception that credit scoring keeps → Education AI has had its Article 6(3) filter functionally closed for any system that evaluates a learner's trajectory → Article 6(1) product safety: manufacturers in machinery, medical devices, automotive, marine, aviation, or rail can no longer self-declare their way out of high-risk classification via Module A If your AI inventory touches any of those four areas, and most large enterprises will touch at least one, the post-Omnibus deadlines (2 December 2027 and 2 August 2028) still apply, and the 18-to-24-month governance build still has to start now. Waiting for the final guideline text leaves you twelve months behind procurement counterparts asking for compliance evidence in late 2026. Build compliance against the operative text of the EU AI Act. The guidelines tell you where enforcement attention will land first; the operative text sets the ceiling of obligations. Full breakdown: modulos.ai/blog/eu-ai-act-an… #EUAIAct #AIGovernance #AICompliance #AnnexIII

🚨🇪🇺Yesterday we ran a webinar on the EU AI Omnibus: what it actually changes, what it doesn't, and why the timeline is razor-thin. Hours later, the European Parliament struck its deal. It turns out our panelists had already called the key moves live on air. ▶️Dr. Laura Caroli — a former AI Act negotiator — walked through the package deal mechanics before they were public. ▶️Peter Hense flagged a drafting risk in Article 111 that most commentary hasn't even noticed yet. ▶️And Patrick Sullivan made the case that "wait and see" is the highest-risk compliance strategy you can pick right now. The real question organizations face isn't whether the deadlines shift, because they likely will. Rather, it's whether you're building governance infrastructure that can absorb whatever comes out of trilogue, or whether you're gaming version numbers and hoping for the best. If you want the real version of this debate, not the press release version, this is worth your time. 🎥 youtube.com/watch?v=6nreDGgj…

🦞 🚨 First AI Governance Assessment of Clawdbot Reveals Major Gaps This week 152,000 AI agents joined a social network where humans can only observe. They debated philosophy, found and reported bugs, and created their own religion called Crustafarianism. We deployed @openclaw (the viral agent formerly known as Clawdbot) on isolated infrastructure and ran it through full governance assessments against the EU AI Act, ISO 42001, NIST AI RMF, and OWASP Top 10 for LLMs. Credit where it is due: OpenClaw is well-engineered. Comprehensive logging with redaction for sensitive data, automated tests, formal verification work, and solid security documentation. But the governance controls that frameworks like ISO 42001 treat as foundational are absent. No documented risk assessment. No impact assessment. No data provenance inventory. No third-party management policies. For a system that connects to WhatsApp, Slack, Discord, and can make voice calls on behalf of users. The deeper problem is that our governance frameworks assume you know what AI systems you have, you control their capabilities, they operate in isolation, and humans meaningfully oversee their actions. Agent social networks break all four assumptions. Good engineering is necessary but not sufficient. Enterprises need governance scaffolding before deploying these agents in production. We will continue to explore and post further updates when warranted. Full assessment and recommendations on our blog @moltbook @MattPRD @clawk_ai @clawdbotatg @clawdei_ai @Aether_Atman modulos.ai/blog/first-ai-gov…

🇪🇺EU AI Act Summary 2026: What Enterprise Teams Need to Do Now modulos.ai/blog/eu-ai-act-su…

🇻🇳⚖️ 𝗩𝗶𝗲𝘁𝗻𝗮𝗺 𝗷𝘂𝘀𝘁 𝗽𝗮𝘀𝘀𝗲𝗱 𝗦𝗼𝘂𝘁𝗵𝗲𝗮𝘀𝘁 𝗔𝘀𝗶𝗮'𝘀 𝗳𝗶𝗿𝘀𝘁 𝗰𝗼𝗺𝗽𝗿𝗲𝗵𝗲𝗻𝘀𝗶𝘃𝗲 𝗔𝗜 𝗹𝗮𝘄, 𝗮𝗻𝗱 𝗶𝘁 𝘁𝗮𝗸𝗲𝘀 𝗲𝗳𝗳𝗲𝗰𝘁 𝗶𝗻 𝗳𝗶𝘃𝗲 𝘄𝗲𝗲𝗸𝘀 Law 134/2025 was adopted on December 10, 2025 and becomes effective on March 1, 2026. If you're selling AI products or services to Vietnamese customers, you need to understand what this law says, and what makes this different from the European approach. 𝗧𝗵𝗲 𝘀𝗰𝗼𝗽𝗲 𝗮𝗻𝗱 𝗿𝗼𝗹𝗲-𝗯𝗮𝘀𝗲𝗱 𝗼𝗯𝗹𝗶𝗴𝗮𝘁𝗶𝗼𝗻𝘀 The law applies to Vietnamese organizations and to foreign organizations involved in AI activities in Vietnam. It assigns obligations based on your role - developer, provider, or deployer - and you can occupy multiple roles simultaneously with stacking compliance requirements. 𝗔 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝘁 𝗸𝗶𝗻𝗱 𝗼𝗳 𝗿𝗶𝘀𝗸 𝗺𝗼𝗱𝗲𝗹 Vietnam uses three tiers: high, medium, and low risk. But unlike the EU AI Act's fixed annexes that list specific high-risk use cases, Vietnam delegated that decision to the Prime Minister, who will issue a list determining what counts as high-risk. That list doesn't exist yet. This gives regulators flexibility to adapt, but it creates real volatility risk for businesses trying to plan their compliance posture. 𝗖𝗼𝗿𝗲 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 𝗶𝗻𝗰𝗹𝘂𝗱𝗲: → Self-classification before deployment, with documentation for medium and high-risk systems → Portal notification to the Ministry of Science and Technology for medium and high-risk systems → Conformity assessment for high-risk systems, either self-assessed or third-party certified → Mandatory transparency so users know when they're interacting with AI → Labeling requirements for AI-generated content, with deepfakes clearly marked → Local presence in Vietnam for foreign providers of high-risk systems 𝗧𝗵𝗲 𝗽𝗼𝗿𝘁𝗮𝗹 𝗶𝗺𝗽𝗼𝘀𝗲𝘀 𝘁𝗼𝗽 𝗱𝗼𝘄𝗻 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 Vietnam is building centralized regulatory infrastructure through an AI Single-Window Portal that receives notifications, incident reports, and periodic filings. During inspections, companies must provide technical dossiers, trace logs, and training data. This means active, ongoing engagement with the state - not documentation sitting in a folder waiting for an audit that may never come. 𝗧𝗵𝗲 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗴𝗮𝗽 The law takes effect in five weeks, but the implementing decrees haven't been issued yet. There's no high-risk list, no detailed conformity procedures, no portal workflows, and no technical specifications for content labeling. 𝗪𝗵𝗮𝘁 𝘆𝗼𝘂 𝘀𝗵𝗼𝘂𝗹𝗱 𝗱𝗼 𝗻𝗼𝘄 If you already have EU AI Act compliance or ISO 42001 certification, you have a meaningful head start since much of the underlying discipline transfers. But Vietnam adds specific requirements around portal engagement, list-driven classification, and inspection-ready evidence at the training data level. 𝘛𝘩𝘦 𝘨𝘭𝘰𝘣𝘢𝘭 𝘈𝘐 𝘳𝘦𝘨𝘶𝘭𝘢𝘵𝘰𝘳𝘺 𝘱𝘢𝘵𝘤𝘩𝘸𝘰𝘳𝘬 𝘬𝘦𝘦𝘱𝘴 𝘦𝘹𝘱𝘢𝘯𝘥𝘪𝘯𝘨...

🇺🇸⚖️ 𝗧𝗵𝗲 𝗧𝗲𝘅𝗮𝘀 𝗔𝗜 𝗟𝗮𝘄 𝗶𝘀 𝗻𝗼𝘄 𝗶𝗻 𝗘𝗳𝗳𝗲𝗰𝘁 The Texas Responsible AI Governance Act (TRAIGA) took effect January 1, 2026. Here's what you need to know: 𝗪𝗵𝗼'𝘀 𝗶𝗻 𝘀𝗰𝗼𝗽𝗲? If you sell products or services to Texas residents, you're covered. Classic extraterritorial reach, same playbook as GDPR and CCPA. 𝗪𝗵𝗮𝘁'𝘀 𝗽𝗿𝗼𝗵𝗶𝗯𝗶𝘁𝗲𝗱? → AI designed to incite self-harm or violence → Government social scoring → Government biometric surveillance without consent → Intentional discrimination (but disparate impact alone isn't enough) 𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗲𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁 𝘄𝗼𝗿𝗸? Attorney General only, no private lawsuits. There is a 60-day cure period before any action so you have an opportunity to remediate. Penalties range from $10K for fixable violations to $200K for serious ones. 𝗛𝗲𝗿𝗲'𝘀 𝘄𝗵𝗮𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀 𝗺𝗼𝘀𝘁: Texas wrote an explicit safe harbor into the law. If you "substantially comply" with NIST AI RMF, ISO 42001, or any other recognized AI risk framework, you have a defense. Translation: If you're already doing EU AI Act compliance or have ISO 42001, you're largely covered. Texas compliance becomes a rounding error. 𝗪𝗵𝗮𝘁 𝘀𝗵𝗼𝘂𝗹𝗱 𝘆𝗼𝘂 𝗱𝗼? Do you already have an AI governance program with the EU AI Act, ISO 42001 or NIST AI RMF as the focus? You should keep going. Starting from zero? Pick one (or more) and start ASAP. 𝘛𝘩𝘦 𝘜𝘚 𝘱𝘢𝘵𝘤𝘩𝘸𝘰𝘳𝘬 𝘪𝘴 𝘧𝘰𝘳𝘮𝘪𝘯𝘨. 𝘊𝘰𝘭𝘰𝘳𝘢𝘥𝘰, 𝘛𝘦𝘹𝘢𝘴, 𝘸𝘩𝘰'𝘴 𝘯𝘦𝘹𝘵?

Introducing our Free Starter Plan! Experience how the Modulos AI Governance Platform simplifies compliance with EU AI Act, ISO 42001 & more. Start your AI governance journey today: modulos.ai/pricing/ #AIGovernance #ResponsibleAI #AgenticAI #Agents

The #EUAIAct is now in force! Is your company prepared? Our latest post outlines the first essential steps. The Modulos AI Governance platform can help streamline your compliance journey. Request your demo today! modulos.ai/get-demo/ #aigovernance #airegulations #aicompliance

Are you prepared to comply with the #EUAIAct? Understanding the Act is crucial for your organization's compliance. Our EU AI Act Guide provides valuable insights and practical steps to help your organization meet legal obligations on time.