The AI safety winter is thawing

Why should I read this?

For the past few years, much of the focus around AI has been on developing more capable systems and adopting them quickly, while safety has received less attention. This period has sometimes been described as an “AI safety winter”. That winter appears to be thawing, helped by a series of developments over the summer and, more recently, by incidents involving AI agents acting outside expected controls such as the incident in which OpenAI agents escaped a test environment and hacked into Hugging Face. Governments and regulators in the EU, UK and US are each placing greater emphasis on AI safety, although their approaches differ.

The summer brought a run of signals. In June, G7 leaders meeting in France highlighted the need for safer AI systems for children and young people. In July, the UN’s Independent International Scientific Panel on AI published its preliminary report, warning that current safeguards were failing to keep pace with the growth of AI’s capabilities. Days later, the first UN Global Dialogue on AI Governance in Geneva brought together representatives from more than 100 countries. On August 2, 2026, most of the EU AI Act began to apply, including the transparency rules (with the AI-content marking requirement deferred to December 2, 2026, for existing systems) and enforcement of the rules on general-purpose AI models, prohibited practices and AI literacy. In September, Parliament’s Joint Committee on Human Rights called for a risk-based UK AI Bill, with lighter requirements for low-risk systems and a statutory AI oversight body.

This sits alongside growing public concern about AI. In our view, that concern is a call for more openness and accountability, not a rejection of the technology. The message for businesses is that governance should match the level of risk involved, rather than imposing the same heavy controls on every use of AI. A relatively low-risk use of AI might require lighter safeguards, while a system making or influencing important decisions would need closer attention. Agile and proportionate governance is not about slowing down AI innovation; it is about putting in place the guardrails that allow organizations to accelerate.

Responsibility does not stop with governments and the companies developing AI. Businesses also decide how these systems are used in practice, including how much they are allowed to do. Those decisions are an important part of managing AI risk.

What should I do?

The starting point remains getting a clear picture of where AI is actually being used across your business. Keep an AI asset inventory, recording AI systems and use cases, with a risk assessment for each on the register. This is important because not every use of AI carries the same level of risk - without an inventory, it is difficult to know where stronger controls are needed. That exercise should also look beyond officially approved tools. Employees may already be using AI that your business does not know about, so records such as software and network logs can help uncover this "shadow AI". Those tools can then either be brought within your organization’s governance framework or banned from use. Discovery alone will rarely keep pace, however, which is why embedding policy in technical controls (see below) matters.

The next step is to make sure that what happens in practice matches what the AI policy says on paper. Many organizations are seeing a growing gap between the two as adoption accelerates. This is particularly important for regulated businesses: an AI policy is a matter of record, and auditors, regulators (or litigants) may test it against how AI is actually being used. Policies should therefore be reviewed regularly (and also when there is a significant new tool, use case or legal requirement). We are also seeing a move toward the codification of AI policy, where written rules are translated into technical controls, such as approved tool lists and access restrictions. That makes compliance part of the way the technology works, rather than something that depends on employees remembering a policy and helps prevent shadow AI from re-emerging.

Plan for when things go wrong (or nearly do). Many organizations have now experienced an AI-related incident or near miss, which makes the need for agile and proportionate governance real rather than theoretical. That means deciding what counts as an AI incident or near miss, who needs to know about it and how lessons will be captured. We see regulators taking action in this space. For example, the UK is considering how serious AI incidents and near misses can be identified and reported. 

Finally, this needs senior oversight. Boards should understand how AI is being used, the main risks and whether the controls described in policies and public statements are actually working in practice. In particular, make sure that what you say publicly about your approach to AI matches what you actually do.

What else do I need to know?

There is no single approach to AI oversight. Jurisdictions such as the EU, UK and US are taking different routes, but each is having to work out how existing rules and new safeguards should respond as AI models become more capable and new concerns emerge.

In the US, the Administration has favored industry commitments over new federal rules. Under a voluntary accord announced on September 29, 2026 (the White House Accord on Super Intelligence), signatories committed in principle to four layers of internal controls including an internal assurance team, an independent external auditor or evaluator and an independent board committee.

In the EU, attention has turned to how existing rules apply as new AI risks emerge - the European Commission convened a special meeting of its AI Scientific Panel on October 9, 2026, which has been investigating recent loss-of-control incidents, while EU financial supervisors have called for strong governance and risk management around frontier AI risks.

In the UK, the government announced measures on October 12, 2026 to prepare for incidents involving AI agents, with the AI Minister warning that “if you cannot adequately control the risks, do not release the system”. The House of Commons Business, Innovation, Science and Trade committee has since taken evidence in its inquiry into AI adoption, safety and governance, while Parliament’s Joint Committee on Human Rights has called for a risk-based AI Bill and a statutory oversight body.

The thaw is not uniform, however. In the EU, the AI Omnibus, which came into force on July 27, 2026, deferred most high-risk obligations under the AI Act to December 2, 2027 (for Annex III systems) and August 2, 2028 (for Annex I systems), while US federal policy continues to favor industry self-regulation. In other words, the thaw is being driven as much by events in practice as by new legislation, which makes governance within organizations all the more important.

But these developments matter to more than the companies building AI models. Businesses using those models are likely to see some of the same expectations appear in contracts and procurement processes. They may increasingly need to show that they understand how the AI they use has been tested, what checks they have put around it and what happens if something goes wrong.

As problems and near misses with AI become more common, the focus shifts from what might go wrong to what businesses do when it does. The challenge is getting the balance right (too many restrictions may result in employees turning to unapproved tools; too few may leave businesses exposed when something goes wrong). Get it right, and agile, proportionate governance becomes what allows organizations to scale AI with confidence, rather than a brake on innovation.