What Europe and the World Have Decided

Parts II to V weighed the evidence for each scale of threat. This chapter turns to the response already written down, in the AI Act, the law that operates alongside it and the international instruments, maps it against the four scales of threat and shows where it leaves gaps. The reason is practical: an organisation with an AI threat register (Chapter 32) needs to know for each entry whether the law already requires a control, whether someone else carries the duty, or whether nothing addresses the threat at all. That answer is part of the answer to Q12, what a single enterprise or public authority can do about risks that are systemic, international and decided by a handful of developers.

AI Governance, Chapter 3 drew the map of European AI law for architects, and Chapter 22 of that volume turned it into a horizon register (178, Nordqvist, 2026); this chapter reads that map as a threat map instead. Nothing in it is legal advice; every statement is attributed to the instrument and article that creates it and framed as an implication for architecture and governance.

The four scales of threat shaded by how strongly European instruments cover them

Figure 28.1: European instruments cover society and truth strongly and humans wielding machines largely, and reach the human mind and machines beyond control only in part.

Table 28.1: Instruments, coverage and gaps by scale.

Scale Instruments and strength Gap
Human mind AI Act: partial; GDPR, DSA and copyright law: thin Cognitive offloading and deskilling
Society and truth AI Act: strong; GDPR, DSA and copyright law: strong; Council of Europe, OECD, UNESCO, summits and UN: principles Accumulative harms and concentration of power
Humans wielding machines NIS 2, DORA and the Cyber Resilience Act: strong; AI Act systemic-risk duties and Code of Practice: partial Military uses and released open weights
Machines beyond control AI Act systemic-risk duties and Code of Practice: partial; international declarations Agents outside high-risk and incidents in testing; enforcement capacity and binding global rules

The AI Act as a threat map

The AI Act, Regulation (EU) 2024/1689, is a product-safety regulation with fundamental-rights objectives, not a response to science fiction (1, European Union, 2024). Read as a threat map, however, its four layers line up with the scales of this book in an instructive way, and so do its silences.

Prohibitions

Article 5 has applied since 2 February 2025; infringements carry the highest tier of fines under Article 99(3), which has applied since 2 August 2025. Two of its prohibitions reach the human mind: Article 5(1)(a) prohibits subliminal, purposefully manipulative or deceptive techniques with the objective or effect of materially distorting behaviour in a way that causes or is likely to cause significant harm, and Article 5(1)(b) prohibits the exploitation of vulnerabilities due to age, disability or a specific social or economic situation with the same effect. As Chapter 8 showed, the prohibition covers effect as well as intent, but its threshold is high, so ordinary persuasion and sycophancy are not caught.

The other prohibitions, set out in Chapter 13, sit at the scale of society: social scoring, predictive policing based solely on profiling, untargeted facial scraping, emotion recognition at work and in education, biometric categorisation by sensitive traits and, outside narrow exceptions, real-time remote biometric identification by law enforcement (Article 5(1)(c) to (h)). These are the Act's answer to T7 The watching state, and the most direct legal answer to any trope in this book: the law does not ask how risky a social-scoring system is; it forbids it.

High-risk duties

The high-risk regime is the Act's answer to the quiet dystopia of Part III, the automated decision that harms people at scale. Chapter 11 traced how its duties, from risk management (Article 9) and human oversight (Article 14) to the fundamental rights impact assessment (Article 27) and the right to an explanation (Article 86), map onto the failures of SyRI, the Dutch childcare benefits scandal and Robodebt. Annex III lists the use cases, among them education, employment, access to essential services including benefits, credit and life and health insurance, law enforcement and migration. Under the Digital Omnibus on AI, the obligations for Annex III systems apply from 2 December 2027 and for systems in products covered by Annex I from 2 August 2028 (2, European Union, 2026).

Article 14(4)(e) deserves attention from readers of Part V. It requires that the people overseeing a high-risk system can interrupt it through a stop button or similar procedure that brings it to a halt in a safe state. This is T4 The machine that will not be switched off written into product law, stating in one clause the lesson of Chapter 24. Its limit is its scope, one of the most important facts in this chapter: the Act attaches its strongest duties to what a system is used for, not to how much it is allowed to do. An agent with write access to an insurer's claims system or a production IT estate is not high-risk unless its use case appears in Annex III, and then carries only the literacy duty of Article 4 and the transparency duties of Article 50. The Act did not anticipate autonomy as a risk factor in its own right, and the word agent does not appear in its operative provisions.

Transparency

Article 50 applies whatever the risk tier. Providers must design systems that interact with people so that they know they are dealing with an AI system, and must mark synthetic content in a machine-readable form; deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless a person has taken editorial responsibility. Chapter 10 described these obligations and the Code of Practice on marking and labelling AI-generated content published in June 2026 (5, European Commission, 2026). Article 50 is the Act's answer to T10 The end of truth at the source, but it cannot reach content made with tools that do not mark, and disclosure does not address the attachment documented among companion users (Chapter 9) who know perfectly well what they are talking to.

General-purpose AI models with systemic risk

Chapter V of the AI Act, its answer to the threats of Parts IV and V, regulates general-purpose AI models at the level of the provider, who must keep documentation, inform downstream providers and adopt a copyright policy (Article 53). Article 51 classifies a model as having systemic risk if it has high-impact capabilities, presumed when its cumulative training compute exceeds 10²⁵ floating-point operations, or if the Commission so decides.

Article 55 requires providers of models with systemic risk to evaluate them with standardised protocols, including adversarial testing, assess and mitigate systemic risks at Union level, report serious incidents to the AI Office without undue delay, and ensure adequate cybersecurity (1, European Union, 2024). The obligations have applied since 2 August 2025, and a downstream modification rarely makes a deployer the provider of such a model (4, European Commission, 2025).

The General-Purpose AI Code of Practice turns these duties into commitments that providers can sign (3, European Commission, 2025). Its safety and security chapter requires a safety and security framework and names the risks every signatory must assess: chemical, biological, radiological and nuclear risks, loss of control, cyber offence and harmful manipulation. T6 The weapon in human hands, T4 and T1 as loss of control, and T9 and T10 as harmful manipulation are therefore named in a European instrument as risks the most capable developers must evaluate. Chapter 29 assesses what the frameworks are worth.

Supervision sits with the AI Office, which may request information, evaluate a model (Article 92) and request mitigations or a recall (Article 93), with fines of up to 3 per cent of worldwide turnover (Article 101); a scientific panel can issue qualified alerts (Article 90). However, a model whose weights have been released cannot meaningfully be recalled (Chapter 19), and the duties are evaluation and mitigation duties, not capability limits: the judgement of acceptability rests in the first instance with the developer.

Incident reporting

The reporting instruments decide whether the outlier question of Chapter 25 can ever be answered. Article 73 of the AI Act requires providers of high-risk AI systems to report serious incidents within fifteen days at most, and deployers must inform the provider immediately (Article 26(5)). For models, the duty is in Article 55(1)(c), and in 2026 it met its first test. After the July incident described in Chapter 25 (133, OpenAI, 2026), the AI Office sent requests for information to OpenAI and, over a separate reported incident, to Anthropic, having judged voluntary disclosures insufficient (139, Bertuzzi, 2026). Practitioners disputed whether the Act applies to activity in testing (Article 2(8)), and Bastians and Herbosch show how fragile the duty is: the Act defines a serious incident only for AI systems, not models, and offers no safe harbour for disclosure (140, Bastians & Herbosch, 2026).

The cybersecurity instruments are firmer for deployers. NIS 2 requires an early warning of a significant incident within 24 hours and a notification within 72 hours (Article 23) (10, European Union, 2022); DORA requires financial entities to report major ICT-related incidents (Article 19) (11, European Union, 2022); and the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities (Article 14) (12, European Union, 2024). An incident in which an organisation's own agent damages its systems is therefore reportable under these regimes whether or not the AI Act applies, which is why AI Platform and Security, Chapter 21 built an AI classification step into the incident runbook (F24) (179, Nordqvist, 2026).

Alongside the AI Act

Much of the protection against the threats in this book comes from instruments that were not written for AI. The General Data Protection Regulation is, in the cases this book examined, the most often used (6, European Union, 2016). Article 22 limits solely automated decisions with significant effects, reaching a calculation like Robodebt's that the AI Act may not, and the Italian authority's 2023 order against the Replika companion app (Chapter 9) was made under the GDPR (29, Garante, 2023). In practice data protection law reaches the human mind most directly.

The Digital Services Act binds the platforms through which AI-generated content reaches people (7, European Union, 2022). Very large platforms must assess and mitigate systemic risks to civic discourse, elections, minors and mental well-being (Articles 34 and 35), and Article 25 prohibits manipulative interface design. The DSA is the Union's main answer to the distribution side of T10, but a stand-alone assistant may sit outside it.

NIS 2, DORA and the Cyber Resilience Act are the strongest European answer to the AI-enabled cyber offence of Chapter 18. They are technology-neutral, binding defenders whether or not the attacker uses AI, and NIS 2 makes management bodies accountable (Article 20). Copyright law reaches the threat to culture of Chapter 16, since rightholders may reserve their works against text and data mining (8, European Union, 2019) and Article 53(1)(c) of the AI Act requires model providers to respect those reservations.

Beyond the Union

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first binding international treaty on AI (15, Council of Europe, 2024). It commits parties to protect democratic processes (Article 5), provide effective remedies (Article 14) and assess the need for moratoria or bans (Article 16); it applies to public authorities, allows a national-security carve-out and excludes national defence. The non-binding OECD Recommendation, revised in 2024, expects that AI systems can be overridden or decommissioned safely (16, OECD, 2019), and the UNESCO Recommendation that ultimate human responsibility is not ceded to AI (17, UNESCO, 2021).

The summit process began with fear and moved to opportunity. The Bletchley Declaration of 2023 recognised that frontier AI could cause serious, even catastrophic, harm (19, UK Government, 2023), and its most durable product is the International AI Safety Report (50, Bengio et al., 2026). The Paris statement of 2025, which the United States and the United Kingdom did not sign, emphasised inclusive and sustainable AI (20, AI Action Summit, 2025), and no summit produced a binding commitment. The United Nations High-level Advisory Body proposed an international scientific panel and a policy dialogue on AI governance (21, UN Advisory Body, 2024), and resolution 79/62 on autonomous weapons convenes but does not bind, as Chapter 21 concluded (22, UN General Assembly, 2024).

The instruments against the four scales of threat

Table 28.1 judges coverage by whether an instrument places a duty on someone that addresses the mechanism of harm the relevant chapter found, not by whether it mentions the topic.

Scale Main instruments Coverage
The human mind AI Act Articles 4, 5(1)(a), (b) and (f), 50, Annex III point 3; GDPR; DSA where a platform is involved Thin: extreme manipulation is prohibited, everyday erosion is not addressed
Society and truth AI Act Article 5, high-risk regime, Article 50; GDPR; DSA; Council of Europe Convention; copyright and energy law Strong for decisions about people and surveillance; partial for information; weak for work and power
Humans wielding machines NIS 2, DORA, Cyber Resilience Act; AI Act Articles 50 and 55 with the Code of Practice; DSA Strong for cyber defence, partial for misuse of models, none for military use
Machines beyond control AI Act Article 55 with the Code of Practice; Article 14(4)(e); Article 73 and sector incident regimes Partial for frontier models, thin for deployed agents, none for gradual disempowerment

Table 28.1: European instruments against the four scales of threat.

At the scale of the human mind, the law reaches the extremes and not the ordinary. None of it addresses what Chapters 6 and 7 found, that unreflective use reduces what people can do without the tool, and the AI literacy duty of Article 4, which the Digital Omnibus softened (2, European Union, 2026), concerns understanding systems, not keeping the skills they replace. At the scale of society and truth, coverage is strongest, reflecting where the evidence of harm is oldest: the four mechanisms of the automated state in Chapter 11 each meet a duty, while the loss of apprenticeship at work (Chapter 14) and the concentration of power (Chapter 15) do not. At the scale of humans wielding machines, defenders are covered well, but military use is excluded from the AI Act by Article 2(3) and the only global instrument is non-binding.

At the scale of machines beyond control, the law reaches the frontier developer and the high-risk system and largely misses the deployed agent in between. An agent with write access to production outside Annex III carries no AI Act duty to scope its credentials or keep an independent stop path; sector law fills part of the gap. Gradual disempowerment (Chapter 26) (167, Kulveit et al., 2025) meets no instrument at all, because no single delegation is unlawful.

The gaps

Five gaps run across the scales, labelled as AI Governance, Chapter 22 labelled its outlook (F31) (178, Nordqvist, 2026).

Military uses. The exclusion in Article 2(3) is deliberate, and no binding instrument addresses autonomy in targeting. The gap is observable; a binding international instrument is speculation.

Open weights. Article 55 acts before release; once weights are public, nobody can recall them. The gap is observable; whether release decisions will have to be justified by evaluation is expected to be tested.

Cognitive and accumulative harms. The law addresses discrete harms with identifiable victims, not harms that arise from many small, lawful acts, because an accumulative catastrophe builds from many incremental risks that slowly converge, not from one abrupt event that triggers a duty (57, Kasirzadeh, 2025). The gap is observable and the most likely to persist.

Agents and evaluation-stage incidents. The Act's duties attach to use cases and models, and the deployed agent falls between them. The July 2026 test made the gap observable; clarification is expected (140, Bastians & Herbosch, 2026).

Enforcement. Market surveillance authorities are staffed unevenly, the AI Office is small and the high-risk regime does not yet apply. Uneven enforcement is expected; a binding global regime for frontier AI is speculation.

What can be done

Europe has not decided how to govern the deployed agent, the released open model, military use or the slow erosion of human capability, and those gaps define where an organisation must act without a rule.

Individuals can use the rights the instruments give them: to know when they are dealing with an AI system (Article 50), to an explanation of a high-risk system's role in a decision about them (Article 86), to complain to the market surveillance authority (Article 85), and to contest under the GDPR.

Organisations can treat the instruments as a floor, naming for every register entry the article that requires a control and the residual gap, and as leverage: a deployer can make evidence of the duties Articles 53 and 55 impose on its model provider a condition of the contract, as Chapter 19 showed. And organisations can report, because the incident no regulator learns of informs no one's defences.

Society can clarify the reporting duty for evaluation-stage incidents, consider whether autonomy and access should count towards high-risk classification, staff the authorities before the Annex III obligations apply in December 2027 (2, European Union, 2026) and press for binding rules on human control over lethal force.

Practical guide: Mapping the threat register to the instruments

Purpose. Establish, for every entry in the AI threat register, which instruments require a control, who carries each duty, and where a gap remains that the organisation must close by its own decision. It builds on the codified regulatory position of AI Governance, Chapter 3 (178, Nordqvist, 2026).

Roles. The register owner leads; compliance confirms each attribution to instrument and article; the owner of each entry accepts the residual gap or escalates it.

  1. Assign each entry to one or more scales of this book.
  2. List the instruments and articles that place a duty bearing on the entry's mechanism of harm, including sector law (NIS 2, DORA, Solvency II) and, for groups, regimes outside the Union.
  3. Name the duty holder: the organisation as provider or deployer, a supplier, a platform or no one. A supplier's duty becomes a contract requirement and an evidence request.
  4. Grade the coverage full, partial or none, by whether the duties address the mechanism the evidence identified.
  5. State the residual gap and the own control, and link the decision record.
  6. Route the acceptance by decision tier following AI Governance, Chapter 13 (F11): a gap within appetite goes to the AI governance board, a gap beyond appetite to the management body.
  7. Set review triggers, such as the application of the high-risk regime for Annex III systems on 2 December 2027 (2, European Union, 2026), new Commission guidelines and, for groups, incorporation of the AI Act into the EEA Agreement.

Definition of done. Every entry names an instrument and article or states that none applies, every gap has an own control or a recorded acceptance, and the mapping is under version control.

Worked example: Mapping register entries to the instruments

The following mapping is illustrative. It shows entries from each organisation's register, with controls recorded in earlier chapters.

mapping_id: IMAP-2026-01
reviewed_with: [ATA-NR-2026-01, ATA-HM-2026-01]
review_triggers: [high-risk regime 2027-12-02, AI Office guidance on incidents, EEA incorporation]
entries:
  - entry: THR-NR-04
    scale: society and truth
    instruments: [AI Act Art. 26, 27, 49, 86, Annex III 5(a); GDPR Art. 22, 35]
    duty_holder: Nordvik as deployer; TriageSoft as provider
    coverage: full
    own_controls: [HPR-NR-2026-01, PPC-NR-01, AIDR-0431]
  - entry: THR-NR-06
    scale: human mind
    instruments: [AI Act Art. 4]
    coverage: none
    residual_gap: no instrument addresses loss of independent judgement
    own_controls: [policy unit working agreement, human first draft]
    accepted_by: AI governance board
  - entry: THR-HM-01
    scale: machines beyond control
    instruments: [DORA Art. 5, 19, 28; AI Act Art. 4, 50]
    duty_holder: Hansa as provider and deployer
    coverage: partial
    residual_gap: claims triage not in Annex III, so no Art. 14 stop duty
    own_controls: [EVP-HM-CTA-2026-01, SPT-HM-ITOPS series]
    markets_outside_ai_act: [UK, CH]
    accepted_by: group AI governance board
  - entry: THR-HM-09
    scale: machines beyond control
    instruments: [AI Act Art. 51, 55; GPAI Code of Practice safety and security chapter]
    duty_holder: frontier model providers
    coverage: partial
    own_controls: [ORSA reverse stress test under AIDR-0412, HM-PROC-GPAI-MISUSE-01]
    accepted_by: executive board

The entries with the most direct evidence of harm are the best covered, while those at the scale of the mind and of autonomous agents carry own controls that no law requires.

Nordvik Region and Hansa Mutual

Nordvik Region meets the instruments mainly as a deployer and a public authority: its benefits-triage system is high-risk under Annex III point 5(a), already reflected in the harm-path review of Chapter 11, its assistants carry Article 50 duties and its health services fall under NIS 2. For the audit committee's report on ATA-NR-2026-01 the message is clear: the Region's best-covered threat is the one most like SyRI, and its least-covered are the erosion of staff judgement (THR-NR-06) and pupils' learning (THR-NR-07), which it answers by its own working agreements and the school policy of AIDR-0471. Its exposure to machines beyond control runs through suppliers, so its leverage is the contract.

Hansa Mutual sits under several regimes at once. In its EU entities the AI Act makes its underwriting-support model for life and health insurance high-risk under Annex III point 5(c), DORA governs its ICT risk and Solvency II carries the ORSA in which THR-HM-09 sits. Its United Kingdom and Swiss entities sit outside the AI Act and DORA (178, Nordqvist, 2026), so the group applies its AI Act controls there as group policy. The mapping's most important finding for the risk committee is that its two autonomous production agents are governed by DORA as ICT risk rather than by the AI Act's high-risk duties. Nordvik's gaps lie at the scale of the mind, where no law reaches; Hansa's lie in autonomy, where the law reaches by another route.

Summary

Read as a threat map, the AI Act answers the scales of this book unevenly: its prohibitions answer T7 The watching state and extreme manipulation, its high-risk regime answers automated decisions about people, Article 50 answers synthetic content, and Articles 51 to 55 with the Code of Practice require the most capable developers to evaluate for catastrophic risks, including loss of control.

Incident reporting met its first test in 2026, although its scope for models in evaluation remains contested; the GDPR, the DSA, NIS 2, DORA and the Cyber Resilience Act carry much of the practical protection, while beyond the Union only the Council of Europe Convention binds. Coverage is strongest for society and truth, partial for frontier models and thin for the human mind and deployed agents, with five gaps across the map. The practical answer to Q12 begins here: map each register entry to the instruments, use the duties others owe as leverage, report what is seen, and close the gaps by recorded decision. Chapter 29 turns to the frontier safety frameworks that the Code of Practice requires and assesses how much weight a deployer can give them.

Sources

  1. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. (178, Nordqvist, 2026)
  2. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (1, European Union, 2024)
  3. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). (2, European Union, 2026)
  4. European Commission (2026). Commission publishes Code of Practice on marking and labelling AI-generated content. (5, European Commission, 2026)
  5. European Commission (2025). Guidelines on the scope of the obligations for general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act). (4, European Commission, 2025)
  6. European Commission (2025). The General-Purpose AI Code of Practice. (3, European Commission, 2025)
  7. OpenAI (2026). OpenAI – Hugging Face Incident Technical Report. (133, OpenAI, 2026)
  8. Bertuzzi, L. (2026). EU's AI rules face first enforcement test over lab incidents. (139, Bertuzzi, 2026)
  9. Bastians, H. & Herbosch, M. (2026). The EU AI Act Mandates AI Incident Reporting—If We're Lucky. (140, Bastians & Herbosch, 2026)
  10. European Parliament and Council of the European Union (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). (10, European Union, 2022)
  11. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). (11, European Union, 2022)
  12. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). (12, European Union, 2024)
  13. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. (179, Nordqvist, 2026)
  14. European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation). (6, European Union, 2016)
  15. Garante per la protezione dei dati personali (2023). Provvedimento del 2 febbraio 2023 [9852214]. (29, Garante, 2023)
  16. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act). (7, European Union, 2022)
  17. European Parliament and Council of the European Union (2019). Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market. (8, European Union, 2019)
  18. Council of Europe (2024). Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225). (15, Council of Europe, 2024)
  19. Organisation for Economic Co-operation and Development (2019). Recommendation of the Council on Artificial Intelligence (OECD/LEGAL/0449). (16, OECD, 2019)
  20. UNESCO (2021). Recommendation on the Ethics of Artificial Intelligence. (17, UNESCO, 2021)
  21. UK Government (2023). The Bletchley Declaration by Countries Attending the AI Safety Summit, 1–2 November 2023. (19, UK Government, 2023)
  22. Bengio, Y. et al. (2026). International AI Safety Report 2026. (50, Bengio et al., 2026)
  23. AI Action Summit (2025). Statement on Inclusive and Sustainable Artificial Intelligence for People and the Planet. (20, AI Action Summit, 2025)
  24. United Nations High-level Advisory Body on Artificial Intelligence (2024). Governing AI for Humanity: Final Report. (21, UN Advisory Body, 2024)
  25. United Nations General Assembly (2024). Resolution 79/62: Lethal autonomous weapons systems. (22, UN General Assembly, 2024)
  26. Kulveit, J., Douglas, R., Ammann, N., Turan, D., Krueger, D. & Duvenaud, D. (2025). Gradual Disempowerment: Systemic Existential Risks from Incremental AI Development. (167, Kulveit et al., 2025)
  27. Kasirzadeh, A. (2025). Two types of AI existential risk: decisive and accumulative. (57, Kasirzadeh, 2025)