ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsTopic · 欧盟AI法案部署者责任3 min read·2026-10-19

Diginomica analyst Derek: enterprise AI contracts cannot transfer AI liability; governance gap constrains deployment

A survey of the Diginomica network found that 65% of CIOs allocated the largest share of new technology investment to AI, yet only 3% were very confident their governance matched their deployed AI tools. Analyst Derek argues from this data that contracts cannot protect buyers—enterprises must manage AI risk internally. The EU AI Act defines the organization using a system as a 'deployer,' placing compliance obligations on the enterprise itself.

ImportanceMaterialEvidenceE3 inspectableWrite-upStandard

2026-10-19 19:45 GMT+8

Diginomica analyst Derek recently drew on numerous in-depth interviews to make a judgment with direct implications for AI industry investment: enterprise buyers cannot transfer AI liability to vendors through contracts. He cites survey data from the Diginomica network earlier this year—65% of CIOs said AI was getting the largest share of their new technology investment, yet just 3% were very confident their governance was fit for the AI tools they were deploying, and 12% admitted they were deploying faster than they could govern.

Derek's core argument does not deny the value of contracts but identifies their structural limits in allocating AI liability. He states: 'It comes down to you as a buyer to understand the risk you're willing to accept and think about how you can internally manage against it—rather than thinking your contract is going to protect you.' Another practical constraint is the insurance market: there are currently almost no mature AI liability insurance products available for enterprise purchase.

Derek further notes that if you're in Europe, this theme is also reflected in the EU AI Act. The Act defines the organization using an AI system as a 'deployer,' imposing compliance obligations on deployers. For an enterprise buying AI software to use in its own business, the 'deployer' is often the enterprise itself—not the vendor. Derek summarizes: 'A lot of the responsibility for this stuff lies not in the contract, but within an organization itself.'

Sign in / Sign up
ReadingResearchRadarInvestment framework

The article's author, Jon Reed, adds when quoting Derek: 'To achieve the gains of contextual AI, embedded in mission critical processes, requires a sophisticated architecture and constantly tuned guardrails—few enterprises can do that in the short term.' This means that after procuring AI services, customers still bear compliance and risk management costs themselves, which may affect the pace of deployment.

Derek's reasoning logic is this: the vast gap between investment willingness (65%) and governance capability (3%) means that even with well-drafted contract terms, buyers still face liability exposure that cannot be outsourced. The absence of insurance options further narrows the avenues for risk transfer. The result is that the pace of AI deployment depends on the development of internal governance capacity, not on vendor contractual promises.

Boundaries to note: the survey's sample size, definitions, and statistical methodology are not disclosed in the material this article relies on; the representativeness of the 65% and 3% figures requires reader judgment. Additionally, the governance gap is dynamic—enterprises may gradually close it through hiring, training, and process building; it does not constitute a permanent barrier. Derek's argument describes the current state, not an unchangeable structure.

The implication for AI industry investment: when assessing the revenue durability of enterprise AI companies, one should examine whether their customers possess internal governance capacity to absorb AI liability. If customers' governance development lags behind their deployment speed, then even if initial contracts are signed smoothly, subsequent expansion and renewals may be suppressed. This analytical perspective does not deny the technical value of AI companies but adds a condition requiring verification to the assumption that 'enterprise AI spending will continue to grow at high rates.'

Sources

  • 原始出处diginomica.com↗
Topic

欧盟AI法案部署者责任

欧盟《人工智能法案》（Regulation (EU) 2024/1689）确立了“部署者”这一关键法律角色，规定使用AI系统的组织需独立承担合规义务，而非仅依赖供应商。【背景】法案将责任链条延伸至最终用户：自2025年2月起，所有部署者须确…

5 steps1 piecesUpdated 2026-10-20 05:48

How it got here

  1. 2024-08-01欧盟《人工智能法案》正式生效，确立分层监管框架。
  2. 2025-02-02第4条AI素养义务与第5条禁止性实践开始适用，覆盖所有部署者。
  3. 2025-08-02通用人工智能模型（GPAI）相关透明度与治理义务生效。

What is still unsettled

  • 在数字综合包（Digital Omnibus）提议下，部分高风险义务的生效时间是否会有进一步调整？
  • 成员国法院如何具体界定“实质性修改”以触发部署者向提供者的身份转换？
  • 保险市场是否会推出针对AI部署者特定合规风险的标准化产品？
Read the full topic →
Continue researching →