Democrats won control of both houses of Congress on November 3, and the political landscape for artificial intelligence has changed with them. The new majorities will be able to set legislative agendas, convene investigations, compel testimony and challenge an industry that has enjoyed considerable freedom to develop and deploy increasingly consequential technology.

The immediate response has been a flurry of proposed regulation. Lawmakers are preparing legislation addressing AI company liability, independent testing of advanced models, the cost of data-centre expansion and the responsibilities of companies developing powerful AI systems.

Underneath the political shift sits a more fundamental question: are governments preparing to regulate the risks AI actually creates, or are they responding to the industry’s latest descriptions of what the technology might become?

For years, the public discussion has moved from artificial general intelligence to consciousness, autonomous agents, recursive self-improvement, benchmark performance and increasingly dramatic cybersecurity demonstrations. Each development produces a new wave of predictions, warnings, financing and demands for government intervention. The capabilities underlying some of these developments are substantial. The conclusions drawn from them frequently extend much further than the evidence.

Meanwhile, businesses are deploying AI systems that can access customer records, move information between applications, initiate transactions, modify software and make decisions affecting employees and customers.

The immediate regulatory problem is already here. An AI system does not need to be conscious, independently motivated or capable of recursive self-improvement to cause consequential harm. It needs access to a system, permission to perform an action and sufficient ambiguity about what it is supposed to do.

Macro: The Midterms Change the Regulatory Equation

Democrats’ victories in the House and Senate have created the first substantial opportunity in years for a change in federal AI legislation.

Reuters reported on November 6 that lawmakers, congressional aides and advocates were preparing a wave of proposals to protect consumers from data-centre electricity costs, require independent testing of advanced AI systems and clarify when AI companies can be held liable for harm caused by their products. The proposals depart from the development-oriented approach of the Republican-controlled Congress, which generally prioritized infrastructure, investment and competition with China.

The political opening is significant, although its legislative consequences remain uncertain. President Donald Trump retains the power to veto legislation, and many Senate bills require 60 votes to overcome procedural obstacles. Democrats will gain committee leadership and investigative authority when the new Congress convenes in January, but control of Congress alone does not guarantee a comprehensive AI law.

Hearings, subpoenas and investigations can expose business practices and create pressure for change. They do not necessarily establish new legal obligations governing the design and deployment of AI systems. Some of the most consequential developments may instead come through narrower legislation, state regulation and changes to procurement requirements.

Electricity is already becoming an important part of the political debate. The enormous power requirements of AI infrastructure have raised concerns about household utility bills, grid reliability, water consumption and the allocation of public resources.

The financial implications are considerable. AI developers and infrastructure companies have committed extraordinary sums to computing capacity, much of it based on expectations of continuing growth in model capabilities and commercial demand. Regulation that changes permitting requirements, electricity pricing or the allocation of infrastructure costs could materially affect the economics of those commitments.

Regulating data-centre development and regulating AI behaviour are different problems. The first concerns infrastructure, resources and financial exposure. The second concerns the decisions AI systems are permitted to make and the consequences of those decisions. Both require attention. Neither can substitute for the other.

Policy: Four Regulatory Systems, Four Different Approaches

The United States is entering a period of renewed legislative activity while Canada, Europe and China continue developing very different approaches to AI governance. The differences matter most for businesses operating internationally, particularly those deploying agents across multiple jurisdictions, using foreign cloud infrastructure or handling regulated information.

United States: From Voluntary Commitments to Potential Liability

The emerging American agenda places greater emphasis on the responsibilities of AI developers. Proposals under discussion include independent testing of advanced models, mandatory reporting of certain incidents and clearer legal remedies when AI systems cause harm.

Representative Lori Trahan’s CLAIM Act, released as a discussion draft on October 7, would make developers liable when their AI systems injure a third party through conduct that would be negligence, an intentional tort or a crime if a person did it. Senator Maria Cantwell, the ranking Democrat on the Senate Commerce Committee, outlined a six-principle framework the same day, built on enforceable safety standards, independent audits and incident reporting. Neither is yet law, but both would mark a meaningful change from reliance on voluntary commitments and existing sectoral regulation.

They also raise difficult questions about where responsibility begins and ends. An enterprise AI deployment may involve a model developed by one company, hosted by another, connected to tools by a third and operated by an organization that determines its permissions and objectives.

If an agent transfers money without authorization, which party is responsible? The model developer may have supplied the capability. The cloud provider may have supplied the infrastructure. The enterprise may have supplied the credentials, defined the task and permitted execution. A liability framework that does not distinguish these roles risks assigning responsibility without establishing which organization actually controlled the action.

The same problem applies to independent testing. Testing a model before release can reveal important limitations. But a model that performs safely in one environment may behave differently when connected to additional tools, persistent memory, confidential information and external services. Its operational consequences depend heavily on the system surrounding it.

American lawmakers will therefore need to decide whether regulation should primarily attach to model developers, to organizations deploying AI, or to the specific capabilities and permissions of the complete system. There are arguments for each approach. Effective legislation may need to distinguish among them rather than treating AI as a single product category.

Canada: Financing Sovereignty Without a Comprehensive AI Law

Canada occupies an unusual position. The federal government is committing substantial public resources to domestic AI development while the country still lacks a comprehensive federal AI-specific statute.

Canada: Financing Sovereignty Without a Comprehensive AI Law

Canada occupies an unusual position. Canada has a national AI strategy, AI for All, which Prime Minister Mark Carney launched on June 4, 2026, and the federal government is committing substantial public resources to domestic AI development under it. What the country still lacks is a comprehensive federal AI-specific statute.

The proposed Artificial Intelligence and Data Act, introduced as part of Bill C-27, died when Parliament was prorogued in January 2025. Existing privacy, consumer-protection, human-rights and sector-specific laws continue to apply, but the proposed general framework for high-impact AI systems was never enacted.

Since then, federal policy has placed increasing emphasis on domestic capacity and sovereignty. On October 29, Ottawa announced an equity investment of up to C$1.6 billion in Cohere, and Budget 2026, released November 5, proposes measures to give Canadian AI companies access to 500 megawatts of sovereign AI compute.

These initiatives could strengthen Canada’s domestic industry and reduce some forms of foreign dependence. But domestic ownership, domestic hosting and technological sovereignty are different things. A Canadian data centre can still depend on American chips, foreign software, external cloud management systems and legal arrangements that expose its operations to decisions made outside Canada. A Canadian AI company can keep its headquarters and intellectual property in Canada while depending on foreign infrastructure and commercial partners.

The more important questions concern control. Who can access the systems? Who can change their operating conditions? Who has authority over the data? Can Canadian operators keep functioning if a foreign supplier withdraws support? Can credentials and permissions be independently managed and revoked? And what happens when AI systems operating inside Canadian businesses make consequential decisions?

Canada’s policy discussion has focused heavily on developing and retaining domestic capabilities. The next stage must also address the responsibilities of the organizations deploying those capabilities.

The federal government’s growing financial participation in the industry adds another dimension. When the state becomes both an investor in AI companies and a purchaser of their services, procurement transparency, competitive neutrality and enforceable operational safeguards become particularly important. Sovereignty ultimately depends on the ability to exercise meaningful authority over technology, not simply the location in which it operates.

Since then, federal policy has placed increasing emphasis on domestic capacity and sovereignty. On October 29, Ottawa announced an equity investment of up to C$1.6 billion in Cohere, and Budget 2026, released November 5, proposes measures to give Canadian AI companies access to 500 megawatts of sovereign AI compute.

These initiatives could strengthen Canada’s domestic industry and reduce some forms of foreign dependence. But domestic ownership, domestic hosting and technological sovereignty are different things. A Canadian data centre can still depend on American chips, foreign software, external cloud management systems and legal arrangements that expose its operations to decisions made outside Canada. A Canadian AI company can keep its headquarters and intellectual property in Canada while depending on foreign infrastructure and commercial partners.

Canada’s policy discussion has focused heavily on developing and retaining domestic capabilities. The next stage must also address the responsibilities of the organizations deploying those capabilities. Some of that ambition is reflected here in the new budget, its sizeable bets beginning to firm a vision from a man who has spent a lot of time optimizing institutions, battening down hatches, being the check and voice of reason. A vision big enough for the entire country is needed from a leader who has demonstrated he is entirely capable of it, but some of his dominant banking governance templates and playbooks continue to run. That vision should be facilitated by leadership but prioritized by the people. Thst is why we are all here.

The federal government’s growing financial participation in the industry adds another dimension. When the state becomes both an investor in AI companies and a purchaser of their services, procurement transparency, competitive neutrality and enforceable operational safeguards become particularly important. Sovereignty ultimately depends on the ability to exercise meaningful authority over technology, not simply the location in which it operates.

European Union: The Most Developed Binding Framework

Europe has established a comprehensive regulatory structure through the EU AI Act. The legislation imposes obligations based on the risks associated with AI systems and their intended uses, including requirements for documentation, transparency, human oversight, risk management and the responsibilities of providers and deployers.

The framework is being implemented in stages. General-purpose AI obligations began applying in August 2025, and significant transparency and enforcement provisions took effect in August 2026. Following amendments to the implementation timetable, major high-risk-system requirements are scheduled for December 2027, with additional requirements for AI embedded in regulated products following in August 2028.

For businesses, this creates a more predictable compliance framework than the current American system, although implementing the requirements across different products and jurisdictions remains complicated.

The EU approach also raises an important technical question. AI systems are increasingly dynamic. Their operational capabilities can change when users connect new tools, grant additional permissions, add memory or modify the instructions governing their behaviour. A model that initially summarizes documents may later be permitted to update customer records, initiate payments or communicate with external systems. The underlying model may remain unchanged while the consequences of its actions increase substantially.

The AI Act’s emphasis on risk classification and oversight provides a foundation for addressing such changes. Effective enforcement will depend on whether the framework can account for the actual operating conditions of deployed systems, including changes that occur during execution. Documentation and risk assessments are useful. Their effectiveness depends on whether they reflect the authority a system can exercise at the moment it acts.

China: Administrative Control and Increasing Attention to Agents

China has developed an AI as infrastructure approach, seeding the biggest nexus of applied AI in the world, learning with the technology as it is deployed. Not only has it developed a series of AI-specific rules addressing recommendation algorithms, generative AI services, synthetic content, security and, increasingly, agentic systems, it is applying and creating them. Its approach differs substantially from the European framework. Chinese regulation places considerable emphasis on service providers, registration and administrative supervision, information controls and national security. It also seeks to encourage domestic AI development and reduce dependence on foreign technology.

In May 2026, the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology jointly issued guidelines specifically addressing AI agents, including their use in industrial, scientific and public-service applications. The guidelines emphasize controllability, security, technical standards and oversight of higher-risk deployments. China has also introduced rules governing anthropomorphic AI interaction services, including applications designed to provide emotional companionship and sustained human-like interaction.

China is moving beyond regulation of generated content toward the operational characteristics of AI systems. There is an important difference, however, between establishing government control over technology and establishing meaningful safeguards for the people and organizations affected by it. China’s rules reflect a broader political and administrative system with different objectives concerning expression, information access and state authority.

For international businesses, the practical consequences include compliance obligations, restrictions on technology transfers and uncertainty about which underlying models, data and infrastructure can be operated independently outside China. Proposed Chinese export controls on advanced AI technology further complicate the picture. Foreign customers may be able to access Chinese models through cloud services while facing restrictions on acquiring the technology required to operate those models independently. Access to an AI service does not establish control over the underlying technology.

Micro: Ambiguity, Flaws and Delegation: the ghosts in the machines

Much of the current regulatory debate assumes that the central problem is the capability of increasingly powerful AI models. But capability alone does not determine the consequences of a live AI deployment. The same model can be used to summarize an internal document, generate software code, recommend a financial transaction or execute that transaction. The differences arise from the surrounding environment, the permissions granted to the system and the decisions it is authorized to make.

Our sister company Pattern Pulse AI’s research paper Latitude of Resolution: Where Agentic Failure Originates and How to Test It examines this through the problem of unresolved ambiguity. The paper proposes that operational autonomy can be understood through the number of materially different resolutions an AI system can reach without receiving a new authority signal.

An instruction may leave important constraints unstated. The environment may differ from the system’s understanding of it. Information or authority may change during execution. When an AI system resolves these ambiguities and acts, it can produce an outcome its human operator never intended. The behaviour does not require independent motivation or consciousness. It requires an underdetermined instruction, an available course of action and permission to execute it.

The research distinguishes between semantic governance, which determines which interpretations are valid, and infrastructure enforcement, which determines which actions remain executable.

Applied to proposed regulation, the gaps are concrete. A system may recognize that an instruction is ambiguous but proceed anyway. It may identify a restriction but fail to retrieve the most recent version. It may receive a revocation signal after initiating an action, or continue executing through another connected agent.

A requirement for human oversight is therefore insufficient unless the human can meaningfully observe, interrupt and control the relevant actions. An audit trail provides limited protection if it records an unauthorized transaction only after the transaction has been completed.

The regulatory challenge is to establish which actions require authorization, how that authorization is represented, how changes are communicated and how permissions can be withdrawn before consequential effects occur. These are engineering and governance questions that can be tested.

The research framework remains provisional and further validation. Its immediate contribution is to separate measurable operating conditions from speculative descriptions of machine behaviour, which becomes more pressing as the industry deploys agents capable of operating across multiple applications and systems.

Agents: The Harness Is Becoming the Control Architecture

The enterprise AI industry is beginning to address some of these problems through the architecture surrounding models.

At its TechXchange conference in late October, IBM made IBM Agent Identity generally available. Working with HashiCorp Vault and watsonx Orchestrate, it gives each agent an authoritative record of its owner, lifecycle status and granted authority, issues short-lived scoped credentials and lets access be revoked in real time when an agent acts outside its permissions.

On November 3, CrowdStrike introduced an AI Kill Switch in Falcon Guardian, a human-triggered, logged control intended to stop rogue agents, prevent them from relaunching and cut off their network access. At launch, termination works at CrowdStrike’s AI gateway; termination on the endpoint where an agent runs is still planned.

Both products recognize that an AI model’s behaviour cannot be governed exclusively through its instructions. A system that can access business applications needs credentials. It needs permissions. It needs an identifiable owner and mechanisms for determining whether an action is authorized. And it needs a reliable way to stop.

A conventional software process can often be terminated directly. An AI agent may operate across multiple tools, external services, persistent memory systems and collaborating agents. Stopping one process may not terminate an action already submitted to another system. Revoking a credential may prevent future access while leaving previously initiated transactions unresolved. The effectiveness of a kill switch depends on the architecture of the entire deployment, and CrowdStrike’s staged rollout, gateway first and endpoint later, illustrates the point.

Systems that monitor AI behaviour and systems that enforce operational boundaries do different jobs. An AI model may estimate that another model is behaving inappropriately. That assessment can help identify a problem, but it remains probabilistic. A separate authorization service can enforce a rule that prevents a particular action from executing without valid permission. The latter provides a more direct form of control, although its reliability still depends on implementation, coverage and the ability to handle changing conditions.

For businesses, the emerging question is whether agent governance can be made as concrete as established identity and access management. Who owns the agent? Which systems can it access? Which actions require renewed authorization? What happens when an instruction conflicts with an existing policy? Can the organization terminate execution across every connected service?

These are practical procurement questions today. They are also plausible foundations for enforceable regulation. They are also clearly issues that companies are taking very seriously as we saw at ServiceNow’s Toronto stop on its global tour. The company had a slew of product services and brands dedicated to addressing concerns about enterprise stability with some of the headlines related to agent autonomy and pattern cracking (that, while inflationary in their application of tomorrow’s possibilities to tools that won’t exist until tomorrow, are real … patterns govern nearly every aspect of our existence so machines that can communicate and be productive using them are extremely high potential. Applying this capability involves rebuilding from the ground up how corporations really function. They could become minutely data driven. There are enormous possibilities, most buried in a tide of misunderstanding, terrible communication, pre-Mobwyball sense making analysis, godlike power and extreme positions.

Scuttlebutt: Nvidia’s Week From Hell

If Washington needed an illustration of how complicated AI industry accountability has become, Nvidia has provided one. The company now faces a convergence of national-security questions, corporate-governance scrutiny, shareholder litigation, antitrust investigation and renewed political pressure over the export of advanced chips to China.

On November 8, Nvidia’s board announced an independent investigation following reporting that CEO Jensen Huang had been the target of a foreign intelligence effort. The board said it had no reason to believe that national security or Nvidia’s secrets had been compromised. Independent directors and outside counsel will oversee the review.

The same day, Huang told employees he had been unfaithful to his wife, without naming the woman. The New York Times and the Financial Times have reported that the relationship was with Alice Huang, a former executive at Singapore-based Nvidia customer Megaspeed whom U.S. intelligence believes was passing information to Beijing. The intelligence assessment remains classified and has not been tested in public. There is no public evidence that Huang knowingly shared sensitive information, and Nvidia has said his dealings with Megaspeed were routine.

On November 9, Nvidia and Huang were named in a proposed shareholder class action alleging that the company misled investors by describing those dealings as normal without disclosing the relationship. The lawsuit raises securities-disclosure questions separate from the underlying national-security allegations. Nvidia’s shares closed down 4.3% on Monday, erasing approximately $190 billion in market value.

House Democratic leader Hakeem Jeffries, expected to become Speaker in January, called on Monday for a full briefing and urged the House to keep restrictions on advanced AI chip sales to China in the annual defense bill. Those restrictions sit inside a larger congressional debate over semiconductor security, supply-chain oversight and the ability of American authorities to track advanced computing hardware deployed abroad.

Nvidia’s problems extend well beyond the investigation involving its CEO. The Department of Justice has also been examining the company’s competitive practices, including its pending $12.93 billion acquisition of Hugging Face. The acquisition would give Nvidia control of one of the industry’s most important platforms for distributing AI models, datasets and related development resources.

That raises a different set of questions from those associated with Nvidia’s dominance in accelerator hardware. Nvidia already occupies a central position in the supply of advanced GPUs and the software ecosystem supporting them. Its investments, acquisitions and commercial relationships increasingly extend into networking, infrastructure management, model distribution and other parts of the AI value chain. Investigators have reportedly examined whether the company uses its position in one market to influence customers’ purchases in others. Those inquiries do not establish that Nvidia has violated antitrust law.

They do show how difficult it has become to separate competition, national security and industrial policy in artificial intelligence. The company at the centre of the infrastructure boom is simultaneously a strategic American asset, a supplier to global technology companies, a major investor across the AI ecosystem and a target of regulatory scrutiny.

That creates a complicated problem for Washington. Restrictions on Nvidia’s international sales may advance national-security objectives while affecting its commercial interests and the global distribution of computing capacity. Antitrust enforcement may seek to preserve competition while policymakers simultaneously encourage the development of domestic AI champions. Corporate investigations can establish whether particular disclosures were appropriate, but they cannot resolve the broader question of how much economic and technological power should be concentrated in one company.

The public discussion is already gravitating toward Huang’s personal life. The intelligence allegations require proper investigation, and any legal conclusions must depend on evidence. But the structural issues are considerably larger. Nvidia’s position in the AI economy makes decisions about its products, customers, acquisitions and international operations consequential far beyond its own shareholders.

The company’s week of disclosures and investigations is a case study in the overlapping responsibilities that emerge when a single business becomes central to an industry’s infrastructure. It is also a reminder that accountability for AI cannot be reduced to the conduct of a handful of prominent executives. It also forces us to ask the question why why now why this it’s been in the public domain for a very long time which government is using him? Is the answer both? What is the most telling to me about this entire incident is how quickly one can go from the most powerful self person on the planet to shark in a world where state actors and megalopolis are barely distinguishable from each other, which is one of the states of fascism… I’m just saying.

What to Watch: Will 2027 Produce Rules That Actually Work?

The next several months will determine whether the American political shift produces substantial changes in AI regulation. Congressional hearings and investigations are likely to begin before comprehensive legislation can be enacted, and House Republican committee chairs have already asked Huang for a closed-door briefing later this month. The first bills will show whether lawmakers intend to regulate model development, commercial deployment, infrastructure, liability or some combination of those activities.

For businesses, the answer determines who carries the obligations. A requirement for independent model evaluations creates obligations for developers. Rules governing automated decisions may create obligations for deployers. Restrictions on data-centre construction affect infrastructure operators. Liability legislation could redistribute financial risk across the entire supply chain. Companies will need to understand which activities are covered and which parties are responsible.

Canada faces a related challenge as it expands public investment in domestic AI capability without a comprehensive AI-specific federal law. Europe will continue implementing its binding framework, with particular attention to how high-risk-system obligations apply in complex enterprise environments. China will continue refining administrative controls over AI services, agents and technology exports while supporting domestic industry.

Across all four jurisdictions, the same practical question remains unresolved: can an AI system act beyond the authority it has legitimately been given, and can that authority be independently verified, constrained and withdrawn?

Governments do not need to resolve whether artificial intelligence is conscious, whether AGI is imminent or whether a model can recursively improve itself before addressing that question. They need to establish responsibilities for the systems businesses are already deploying.

The American midterms have created a new opportunity to do so. Whether the next Congress uses it to develop enforceable rules for real-world AI deployment, or concentrates on frontier-model claims, executive investigations and the industry’s most dramatic scenarios, will shape the next phase of AI governance.

The technology is already consequential enough to require accountability. The question is whether regulation will finally catch up with what AI systems are permitted to do.

• Reuters via The Star: Democrats planning flood of AI bills
• Reuters via Investing.com: Nvidia, Huang sued
• Yahoo Finance: Nvidia live updates
• CNBC: Huang faces Congress scrutiny
• MLex: Trahan CLAIM Act draft
• Senate Commerce: Cantwell framework
• Gowling WLG: Budget 2026 AI measures
• IBM TechXchange 2026 newsroom
• Xenospectrum: CrowdStrike AI Kill Switch
• AI Weekly: DOJ probe of Hugging Face deal