The Blame Instinct: When Nobody Designed Who Decides

Picture a meeting room in Hamburg at Hansa Mutual, the mutual insurance group that runs through this book as an illustration, on a day in the first quarter of 2027, in the scenario that Chapter 18 tells. On the table is the first draft of a post-mortem. The subject is a drill, not an outage: the group's IT-operations agent, software that executes pre-approved operations with write access to production under an identity of its own, is to be stopped on command within five minutes. It takes seventeen. The draft's title names the agent. Its findings say that the agent's credentials, valid for fifteen minutes, outlived the stop, and that the agent is therefore not fit for the autonomy it was given. The recommendation is to tighten the agent.

The second draft, written a week later after the platform team has replayed the logs minute by minute, keeps every one of those facts and reaches a different finding. The fifteen-minute credentials explain part of the delay, as the first draft said. The rest is the route. The canary alert reaches a duty analyst in the security operations centre who does not hold the decision and has no mandate to apply the deny rule, the stop that sits at the policy decision point outside the agent, so the stop waits for someone who does (The Transformed Security Architect, Chapters 10 and 25) (6, Nordqvist, 2026). The record that governs the agent names who owns it; it does not name who is to decide, inside a five-minute budget, that the stop be made. The finding of the second draft is one sentence long: nobody has been named to decide the time to stop.

Both drafts are illustrative: Hansa Mutual is fictional, and so is the drill. The second draft is the harder one to write: it finds nothing wrong with anyone and something missing from the design. On 31 March 2027, in the scenario, the executive board receives the drill as a failure and takes the decision right over every agent with write access to production for itself. The agent's credentials are cut to five minutes. The agent is not changed.

The questions

Question 11 asked: "In the AI Incident Database, which kind of harm is the most frequent among the incidents that have been classified?", with the options "An autonomous system escaping control", "People using AI to defraud, deceive or manipulate other people" and "Physical injury from robots and self-driving vehicles". Chapter 7 is its home and gives the full answer. The figure this chapter needs is that "Malicious actors and misuse" is the largest domain, with 566 of the 1,498 classified incidents, 412 of them fraud, scams and targeted manipulation, while the subdomain closest to the first option holds 3 (35, Responsible AI Collaborative, 2026). The right answer is the second option. The database collects press reports and public submissions of incidents in which an AI system is alleged to have caused or nearly caused harm, catalogued by volunteer editors; its snapshot of 2 November 2026 held 1,786 records (35, Responsible AI Collaborative, 2026) (50, McGregor, 2021).

No survey asked the public to rank the harms in that database, or whom it would blame after an incident, so the perception side is indirect. Pew Research Center asked 5,410 US adults in August 2024 whether the increased use of AI in daily life made them feel more excited than concerned, more concerned than excited or equally both; 51 per cent answered more concerned than excited, against 15 per cent of the 1,013 AI experts asked the same question (32, McClain et al., 2025). In the Ipsos AI Monitor 2025, a vendor survey of 23,216 adults in 30 countries, 53 per cent on the 30-country average agreed that "products and services using artificial intelligence make me nervous" (31, Ipsos, 2025). Both measure a feeling directed at the technology; neither measures who people think answers when it goes wrong. The classified record points elsewhere: most often at a person who used the technology against another person, and next at a system that failed at a task someone had decided to rely on it for. In the second case the question becomes who decided to rely on it and who was to decide when to stop, which is the question of this chapter.

The instinct

The blame instinct is the habit, when something has gone wrong, of looking for an agent to hold responsible, and of stopping when one has been found. Hans Rosling named a blame instinct among his ten, the urge to find a clear, simple reason why something bad has happened (8, Rosling et al., 2018). Its form here is that the agent it finds is the model, the vendor or the agent software, because those acted last, and the search ends before it reaches the question of who decided what they were permitted to do.

The instinct deserves a fair hearing. Where a person acted, blame finds the right agent: the record's largest category is people using AI to defraud, deceive or manipulate other people (35, Responsible AI Collaborative, 2026), and the scammer who used a voice clone to extract a transfer is to blame for the transfer. A law that places duties on named persons depends on there being someone to hold to them.

It misleads here because, where software acts, the thing that acted last is often not the thing that decided. A model that ranked a queue did not decide that the queue be ranked by a model, and an agent that kept executing a playbook after a stop signal was doing what its mandate permitted. This book adopts two conclusions of the series on the point. AI Red Team, Chapter 6, concludes that when an agent may act within a playbook, at the level it calls Level 3 Bounded, human approval moves from the individual action to the playbook and the authority that signed it, which concentrates accountability rather than diluting it (4, Nordqvist, 2026). AI Boss, Chapters 4 and 33, draws the conclusion for decisions about people: every decision with a consequence for a person has a named human decider, and a name is necessary and not sufficient, because a human attached to a system's output can absorb the blame without having had the means to decide, which the volume calls the moral crumple zone. It defines the decider by six capabilities: identifiable, able to decide otherwise, informed, given time, protected, and answerable (7, Nordqvist, 2026).

On this reading the first draft of the Hansa post-mortem is an instinct rather than an error: it found the thing that acted last. The conclusions say to look one step further back, to the decision right: who was named to decide that this unit may act at this level, and who was named to decide that it stop. Where that right was designed, blame has somewhere true to land. Where it was never designed, blame lands on the artefact, the organisation tightens the artefact, and the gap stays. AI Governance, Chapter 13, says the same of stops: some decisions cannot wait for a forum, so the right to stop is named in advance, and a stop path inside the system it is meant to stop fails exactly when needed (2, Nordqvist, 2026). AI Threat, Chapter 30, adds that the right to stop must be cheaper to exercise than the right to continue (5, Nordqvist, 2026). In the opening scene the stop waits for someone who holds the decision, which is what it looks like when that condition does not hold.

Author's note needed: A first-person passage of two or three paragraphs from the author's own practice in which an incident review named a system or a supplier as the cause and the author, or a colleague, asked who had held the decision right and found that nobody had. It belongs here, after the series' conclusions and before the evidence, and should show the author writing or accepting the first draft before seeing the second.

The evidence

The incident record can show whom it names when harm is reported, and how often the name is a category rather than a decision holder. It cannot show how often a decision right had been designed, because no public dataset records that, and I leave the gap visible. This is evidence about how incidents are recorded, not about how people assign blame.

Who the record names

Figure 13.1: When harm is reported, the record more often names a category of people or a kind of technology than an organisation: among the thirty most frequent alleged deployers, named organisations take 37 per cent of mentions and unnamed categories 63 per cent; among the thirty most frequent alleged developers, 31 against 69 per cent, by my classification of the entries. Source: Responsible AI Collaborative, AI Incident Database (retrieved 2026).

Every incident in the database carries editorial attributions of an alleged deployer, an alleged developer and the alleged harmed parties (35, Responsible AI Collaborative, 2026). Figure 13.1 sorts the mentions among the thirty most frequent entries of each kind into named organisations and unnamed categories. Among the top thirty alleged deployers, named organisations take 37 per cent of mentions, 479 of 1,304, and unnamed categories 63 per cent, 825; among the top thirty alleged developers, named organisations take 31 per cent, 691 of 2,209, and unnamed categories 69 per cent, 1,518 (35, Responsible AI Collaborative, 2026). The sorting of each entry is my classification, fifteen of the thirty entries in each list falling in each class, and the shares are my computation. The split is partly an artefact of that labelling: an entry such as "scammers" gathers many actors under one name, where organisations are counted one by one, so the figure shows how the record is labelled, not whom it blames.

Three readings are available, and only one is the instinct's. The record may be honest about what it knows: where a scam was reported, the editors could name the kind of actor and the kind of technology and nothing more. It may name the two parties the AI Act names, the developer and the deployer, and have no field for a third, the person inside the deploying organisation who held the decision right. Or it may reflect the instinct's own view: the technology is to blame, because the technology is what the record names most. The record cannot tell the three apart, and I do not claim that it does. It shows what it has no field for.

The database also classifies each incident by proximate cause and by intent. The proximate-cause field attributes 961 of the 1,498 classified incidents to an AI system and 526 to a human, the remainder to other causes (35, Responsible AI Collaborative, 2026). That field records what acted last, which is the instinct's own question; it does not record who had been named to decide. The intent field finds 741 incidents unintentional and 736 intentional. For the intentional half the instinct is right to look for a person. For the unintentional half the record can say what failed but not who had decided to rely on it or who could have stopped it. The database is candid about its limits: its counts measure press attention and editorial effort as well as harm, and its attributions are editorial allegations, not legal findings (35, Responsible AI Collaborative, 2026) (17, Maslej et al., 2025).

Deployer and developer are usually not the same

Figure 13.2: The ten most-named alleged deployers and the ten most-named alleged developers: the deployer is most often an anonymous category of people and the developer a category of technology, and the two lists are not the same list, so a name for the developer is not a name for the decision to deploy. Source: Responsible AI Collaborative, AI Incident Database (retrieved 2026).

Chapter 7 drew this chart as its Figure 7.2 to show that the use, not the model, sets the risk. Here the two panels of Figure 13.2 show that the record keeps two lists, the party that used the system and the party that built it, and that the names on one are not the names on the other. Among alleged deployers the three most frequent are not organisations: "scammers" appears in 240 incidents, "deepfake creators" in 129 and "synthetic media creators" in 106, before the first named company at 86. Among alleged developers "deepfake technology developers" is attached to 452 incidents and "synthetic audio generation technology developers" to 241, before the first named company at 195 (35, Responsible AI Collaborative, 2026).

The AI Act allocates its duties on the same principle. Regulation (EU) 2024/1689, as amended by the Digital Omnibus, Regulation (EU) 2026/1744, defines in Article 3(3) a provider as a body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name, and in Article 3(4) a deployer as a body using an AI system under its authority; under Article 25(1) a deployer becomes the provider of a high-risk AI system when it puts its own name on one, substantially modifies one, or changes its intended purpose (39, European Union, 2024) (40, European Union, 2026). The duties follow the role, and the role follows what the organisation did, not what the model is.

The deployer's duties come closest to this chapter's question. Article 26(2) requires deployers of high-risk AI systems to "assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support"; Article 26(5) requires them to monitor the system and, where its use may present a risk, to inform the provider and the market surveillance authority and suspend its use (39, European Union, 2024). Under the amended Article 113 those obligations apply to the high-risk systems of Annex III, the uses the Act lists as high-risk, among them recruitment, work allocation and access to public benefits, from 2 December 2027 (40, European Union, 2026). The implication, framed as architecture and not legal advice, is that the law asks for a natural person with authority, a seat in this book's notation, before go-live rather than in the post-mortem. Two things remain outside the article: most marks on any landscape are not high-risk, and a person with authority on paper may still lack the information and the time (7, Nordqvist, 2026). Whether the ordinary marks also get a named holder is a choice each organisation makes, and the pictures that follow show it.

The picture corrected

Contour, the notation of this book, draws above every mark a small grey seat carrying the tier of the person who holds the decision right: T1 the operator or user, T2 the system owner or architect, T3 an executive, T4 the board, the management body or an elected body. Where nobody is named, the tier is T0 and nothing is drawn, so that the absence is visible. The decision-rights view, V4, gives each unit one row: a bar from Level 0 Advisory to the unit's ceiling, thin bars for each class of action, a diamond where a policy point outside the model enforces the ceiling, and the seat at the end of the bar. Figures 13.3 and 13.4 are Hansa Mutual's and Nordvik Region's views at the end of 2027 in the scenario of Chapter 18; both are illustrative and rendered from the landscape models.

Figure 13.3: Every row has a seat at the end of 2027: the board holds T4 over the IT-operations agent, an executive holds T3 over the claims-triage agent, and the ambient AI in licensed software, which had no seat on 1 January, carries T2 and no diamond. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Read Figure 13.3 down the right-hand ends of the bars, where the seats are: seventeen rows, seventeen seats, sorted by level with the units that act most freely at the top. The top row is HM-AMB, the AI features that suppliers have switched on inside licensed software across seven markets. Its bar runs to Level 4 Autonomous, because the vendors chose the level, and it has no diamond, because the group enforces nothing about it. On 1 January 2027 that row has no seat, as the same view at the start of the year, which Chapter 3 showed, draws nothing above the bar. At the end of the year it carries T2, the head of the group AI platform as owner of the register into which the features are entered on 30 September. The seat does not make the ambient AI safe; it makes it somebody's. Four rows down is HM-ITO, the agent of the opening scene, at R3 Hard to reverse, with a filled diamond at the ceiling and a seat that reads 4, because since 31 March the executive board holds the right over every agent with write access to production. On 1 January that seat reads 2. Nothing about the agent's bars moves; what moves is the tier of the person who answers for them. Two rows above, HM-CT, the claims-triage agent, carries a 3 where it carried a 2, after the group reassesses its allocation of claims to handlers as high-risk under Annex III, point 4(b), on 30 April.

Figure 13.4: Thirteen rows and thirteen seats, including a seat on the ambient AI nobody chose, taken by the AI governance lead in June, and a seat on the retired recruitment pilot, whose retirement the HR director decided and reported. Illustrative: rendered from landscape/models/nordvik_region.yaml.

Nordvik Region's view has the same shape with a public authority's contents. NR-AMB, the ambient AI in the Region's licensed software, sits at the top with its bar at Level 4, a hollow diamond for a policy point planned and not yet enforced, and a seat carrying T2: on 30 June the AI governance lead, as owner of the inventory, takes the seat. Below it NR-CS, the citizen-service assistant, answers residents at Level 4 with a filled diamond and the head of communications at T2; it is the one unit on either landscape at Level 4 by the organisation's own decision, and the seat says whose. NR-TL, the recruitment screening pilot, is drawn with a cross, retired on 30 June 2027 when the HR director reports to the regional executive committee and does not resume it; its seat is still there, at T3, because retiring a unit is a decision someone held. NR-BT, the benefits-triage system, sits at Level 0 Advisory and R3 with the Head of Benefits Unit at T2: the system ranks the queue, caseworkers decide every case, and the person who answers for the ranking is named.

Read for the blame instinct, the two views show the finding of the second draft before the incident. A reader who looks at either view on 1 January 2027 sees a row at Level 4 with no seat, and knows what the first draft of the next post-mortem will fail to find.

Designing decision rights before go-live

Before a unit goes live, or is relied on further, four things are written down, and the landscape model holds all four.

1. The tier. Decide at which tier the right sits, T1 to T4, from the reversibility and reach of the unit's actions; AI Governance, Chapter 13, routes each decision to the lowest tier that can take it with evidence (2, Nordqvist, 2026).
2. The holder. Name the person, by role, and check the six capabilities (7, Nordqvist, 2026).
3. The stop path. Name who may stop the unit without asking anyone, name the budget in minutes, keep the switch outside the thing it stops (5, Nordqvist, 2026), and drill it.
4. The record. Write the first three into a dated decision record, so that the holder on the day of the incident can be read from the record of the day before.

The order matters. An organisation that starts from the record writes a name into a field; one that starts from the tier and the stop path discovers, as Hansa Mutual does in the scenario, that the name it had was the wrong one for the budget it needed.

The rule of thumb

Rule of thumb: Look for the seat before you look for the culprit; if nobody was named to decide, that is the finding.

Apply it to every post-mortem, press report of an incident and board paper that explains a failure. Before asking what the model did, the vendor shipped or the agent executed, ask who had been named to decide that the unit may act at that level and who had been named to decide that it stop, and look for the answer in a record dated before the incident. If the answer is a role with the authority, the information and the time, the review can go on to what the artefact did. If the answer is nobody, or a name attached afterwards, the review has found its principal cause.

The rule stops applying where a person acted with intent, the largest category of recorded harm (35, Responsible AI Collaborative, 2026); there the culprit is the right place to look first. Nor does the rule say that a seat is enough. A seat occupied by a person without the means to decide is the moral crumple zone drawn in grey (7, Nordqvist, 2026). The seat tells you whom to ask; the six capabilities, the diamond and the drilled stop path tell you whether the answer will be worth anything.

What to do

For an executive

Ask for the decision-rights view before the risk register, and read it from the seats. Every row without a seat is a unit that is somebody's problem and nobody's decision, and the rows most likely to have none are the ones nobody chose: the AI features that arrived in licensed software, or the model inside a security product. Where a row at Level 3 Bounded or above touches production, money or a person's outcome, ask whether the seat should be yours or the board's, and ask for the drilled time to stop in minutes. When an incident report reaches you with a system in its title, send it back with one question: who had been named to decide, and when.

For an architect

Render the seat from a record, not from a conversation. The landscape model carries decision_tier and decision_holder for each unit and the renderer draws the seat from them; the record behind those fields is what the post-mortem will read. The fragment below is an illustrative decision record for Hansa Mutual's IT-operations agent after the board took the seat: a short dated statement of who decided what, from which the model's fields are copied.

# Decision record for one unit (illustrative; Hansa Mutual, HM-ITO)
unit: HM-ITO
name: IT-operations agent
decided_on: 2027-03-31
decision_tier: T4
decision_holder: Executive board (management body), for every agent with write access to production
operated_under_delegation_by: Head of the group AI platform (system owner)
action_levels:
  restart a service: 3        # Level 3 Bounded, within the playbook
  change configuration: 2     # Level 2 Supervised, approved per action
  delete data: 0              # Level 0 Advisory, a person does it
policy_point: enforced        # outside the model; the agent cannot alter it
stop_path:
  may_stop_without_asking: [SOC duty analyst on call, system owner]   # mandate written into the charter and playbook (illustrative)
  switch_outside_the_agent: true
  budget_minutes: 5
  credential_lifetime_minutes: 5   # was 15 before the first drill
  last_drill: {minutes: 17, result: failed}
  next_drill: quarterly, reported to the board as time to stop
review: on change of level, playbook, identity or holder

Two rules for the file. may_stop_without_asking is a list of roles, not empty and not a committee; if a stop needs a conversation, the budget is a fiction. And a change to decision_holder reopens the review, because the person who answers has changed even if the bars have not.

For a public official

In a public authority the seat is often fixed by law before it is fixed by design: administrative law places the decision with an accountable official, and Article 26(2) asks the deployer of a high-risk system to assign oversight to natural persons with competence, training and authority (39, European Union, 2024). The task is to make the designed seat and the legal seat the same person, and to write both into the tender, the fundamental rights impact assessment and the public register entry, so that a resident, a journalist or an auditor can read who decides. Nordvik Region's benefits-triage system is the illustration: the Head of Benefits Unit holds T2 for a system at Level 0 Advisory and R3 Hard to reverse, and the stop drills are run against a budget and reported. Where a procured system arrives with the supplier in every seat, write the authority's own holders into the contract and require a stop path outside the supplier's system.

Nordvik Region and Hansa Mutual

Both organisations are illustrative, and what follows is the scenario of Chapter 18, not history. In it both put a seat on the AI nobody chose. At the start of the year each landscape has exactly one unit at T0, its ambient AI in licensed software, Mode 0 Ambient AI in the six usage modes that AI Governance, Chapter 2, defines (2, Nordqvist, 2026), at Level 4 Autonomous with no policy point and no evidence. Nordvik Region takes its seat first, on 30 June, when the AI governance lead inventories the supplier-enabled features that touch personal data; the policy point is still only planned, so the row carries a hollow diamond. Hansa Mutual follows on 30 September, when the head of the group AI platform enters the features into the AI system register and the notice clauses go into the group's register of information on suppliers of ICT services, required of financial entities by the Digital Operational Resilience Act (42, European Union, 2022). There is no diamond, because the group enforces nothing about software it licenses. Neither seat changes what the ambient AI can do. Both change who will be asked.

They differ in what a failed stop produces. Hansa Mutual's board takes T4 over every agent with write access to production and requires the time to stop as a reported figure. Nordvik Region's first out-of-hours drill of the benefits-triage system takes 26 minutes against a budget of 15, and its remedy is to give the managed security service provider a break-glass credential for one action, after which the October re-drill comes in at 11; the seat stays with the Head of Benefits Unit, because the right had been designed and the gap was the means to exercise it at night. One organisation finds no seat for the budget and creates one; the other finds the seat and gives it hands.

Summary

The blame instinct looks for an agent when something has gone wrong and stops when it finds one, and in this landscape the agent it finds is the model, the vendor or the agent software, because those acted last. The instinct is right where a person acted with intent, the largest category of recorded harm: 566 of the 1,498 classified incidents in the AI Incident Database fall under malicious actors and misuse, against 3 for an AI pursuing goals of its own. It misleads where the thing that acted last did not decide. The record names "scammers" far more often than any organisation, partly because of how its entries are labelled, and has no field for the person who held the decision right.

The series' conclusions supply what the record cannot: at Level 3 Bounded, approval moves from the action to the playbook, and every consequence decision has a named human decider, a name being necessary and not sufficient. The AI Act asks deployers of high-risk systems, under Article 26(2), to assign oversight to natural persons with authority, a seat before go-live, from 2 December 2027 for Annex III systems. In the scenario the two illustrative organisations end 2027 with no row at T0 after starting the year with one each.

The rule of thumb is to look for the seat before you look for the culprit, and to treat the absence of a name as the finding. It stops where a person acted with intent, and it does not say that a seat is enough. The practice is four lines written before go-live: the tier, the holder, the stop path with its budget, and the record the seat is rendered from. This is the last of the nine instincts; Chapter 14 opens Part III by drawing the one-page landscape from the registers an organisation already keeps.

Sources

1. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Transformed Architecture, Book 6, published at tsa.geon.se. (6, Nordqvist, 2026)
2. Responsible AI Collaborative (2026). AI Incident Database. Database of reported incidents in which AI systems caused or nearly caused harm; the database collections are licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) according to the terms of use and the licence file of the database snapshots; the weekly snapshot of 2 November 2026 is kept as the dataset data/aiid_incidents. (35, Responsible AI Collaborative, 2026)
3. McGregor, S. (2021). Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. Proceedings of the AAAI Conference on Artificial Intelligence, 35(17), 15458–15463. Association for the Advancement of Artificial Intelligence, 18 May 2021. DOI: https://doi.org/10.1609/aaai.v35i17.17817 (accessed 2026-11-07). (50, McGregor, 2021)
4. McClain, C., Kennedy, B., Gottfried, J., Anderson, M. and Pasquini, G. (2025). How the U.S. Public and AI Experts View Artificial Intelligence. Pew Research Center, Washington, D.C., 3 April 2025; American Trends Panel survey of 5,410 US adults (August 2024) and a survey of 1,013 AI experts (14 August to 31 October 2024); the topline values are kept as the dataset data/pew_ai_public_experts_2025. (32, McClain et al., 2025)
5. Ipsos (2025). The Ipsos AI Monitor 2025: A 30-country Ipsos Global Advisor Survey. Ipsos, June 2025; 23,216 adults interviewed online, and in India partly face to face, between 21 March and 4 April 2025 (vendor survey, self-funded by Ipsos); Ipsos's legal mentions deem polls published on its website to be in the public domain, usable with attribution to Ipsos; the values quoted in the book are kept as the dataset data/ipsos_ai_monitor_2025. (31, Ipsos, 2025)
6. Rosling, H., Rosling, O. and Rosling Rönnlund, A. (2018). Factfulness: Ten Reasons We're Wrong About the World – and Why Things Are Better Than You Think. London: Sceptre (Hodder & Stoughton), hardback published 3 April 2018. ISBN 978-1-4736-3746-7. (8, Rosling et al., 2018)
7. Nordqvist, G. (2026). AI Red Team: AI as an Active Part of Cyber Defence in European Enterprises and Public Authorities. The Transformed Architecture, Book 4, published at aired.geon.se. (4, Nordqvist, 2026)
8. Nordqvist, G. (2026). AI Boss: When Artificial Intelligence Manages People in European Enterprises and Public Authorities. The Transformed Architecture, Book 7, published at aiboss.geon.se. (7, Nordqvist, 2026)
9. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (2, Nordqvist, 2026)
10. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Transformed Architecture, Book 5, published at aithreat.geon.se. (5, Nordqvist, 2026)
11. Maslej, N., Fattorini, L., Perrault, R., Gil, Y., Parli, V., Kariuki, N., Capstick, E., Reuel, A., Brynjolfsson, E., Etchemendy, J., Ligett, K., Lyons, T., Manyika, J., Niebles, J. C., Shoham, Y., Wald, R., Walsh, T., Hamrah, A., Santarlasci, L., Betts Lotufo, J., Rome, A., Shi, A. and Oak, S. (2025). The AI Index 2025 Annual Report. AI Index Steering Committee, Institute for Human-Centered AI, Stanford University, Stanford, CA, April 2025; licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0); the report and its public data files are kept as the dataset data/stanford_ai_index_2025. DOI: https://doi.org/10.48550/arXiv.2504.07139. (17, Maslej et al., 2025)
12. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689, 12 July 2024; as amended by Regulation (EU) 2026/1744. (39, European Union, 2024)
13. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744, 24 July 2026; in force from 27 July 2026, the third day after publication. (40, European Union, 2026)
14. European Parliament and Council of the European Union (2022). Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011. Known as DORA. Official Journal of the European Union, L 333, 27 December 2022, p. 1. (42, European Union, 2022)