This article argues that Australia can pursue auditable accountability for public-sector artificial intelligence without enacting a single comprehensive AI statute, provided that existing legal duties, policy frameworks, standards, and procurement mechanisms are organised into an explicit assurance stack. An “AI Act” is used here to mean a unified statute that imposes system-wide ex ante obligations on providers and deployers. Australia currently relies on a more distributed model. The article’s claim is that this model can still be made defensible, but only if abstract norms are translated into evidence disciplines that preserve contestability and reviewability. Using a doctrinal and functional method, the article shows how legality, procedural fairness, record-making, reason-giving, procurement discipline, privacy obligations, and audit practices can be aligned to produce a minimum reviewable trace for AI-influenced public decisions. The original contribution is twofold. First, the article conceptualises Australia’s public-sector AI governance arrangements as an assurance stack whose layers only matter if they generate reviewable artefacts. Second, it proposes a bounded minimum reviewable trace that preserves the system configuration, material inputs and outputs, evaluation basis, reliance statement, and contestability pathway for a particular decision. The article also reframes selective hardening as a practical governance response for higher-risk uses, and presents an Assurance Requirement Level as a qualitative policy heuristic rather than a quantitative model. Concrete illustrations drawn from welfare eligibility and emergency-care triage demonstrate how the trace would work in practice. The article concludes that procurement is the principal operational lever for pushing evidence duties upstream, but that the stack will only succeed if audit offices, tribunals, ombudsmen, and agencies are equipped to interpret and test the artefacts they require.

The European Union has enacted two landmark frameworks that impose partially divergent obligations on financial entities deploying artificial intelligence (AI) in cybersecurity. The AI Act (Regulation (EU) 2024/1689) establishes a risk-based classification system subjecting AI systems to graduated transparency, explainability, and human-oversight duties. The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) requires financial entities to maintain robust Information and Communication Technology (ICT) risk-management capabilities, including rapid, automation-capable threat detection and incident response. This article argues that, for systemically significant financial actors, the combined operation of these two regimes together with the EU Charter of Fundamental Rights produces what it terms a regulatory trilemma: a three-cornered tension between (i) the AI Act’s demand for transparency and human control, (ii) DORA’s expectation of automation-capable operational resilience, and (iii) the Charter’s guarantees of privacy, data protection, and non-discrimination. The article’s contribution is threefold and deliberately modest. First, it brings the AI Act and DORA into a single doctrinal frame and shows that their interaction generates a genuine compliance dilemma rather than a relabelling of familiar bilateral tensions. Second, it situates that dilemma within the wider fragmentation of EU digital regulation, asking why DORA stands somewhat apart from the rights-and-innovation balance that De Gregorio and Dunn identify as the connecting thread of the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the AI Act, and whether the emerging discourse of digital sovereignty supplies a shared horizon. Third, it advances calibrated autonomy as a structured, proportionality-anchored interpretive and normative proposal that conditions the permissible degree of AI autonomy on threat severity, data sensitivity, and decision reversibility. The article closes with reform proposals—joint guidance from the European Supervisory Authorities, a harmonised incident taxonomy from the European Union Agency for Cybersecurity (ENISA), a narrowly defined compliance safe harbour, and sector-specific advisory boards—assessed against questions of competence, legal basis, and feasibility. The analysis is confined to the financial sector governed by DORA; the closing section identifies which arguments travel beyond it.

This article examines the implementation of Anticipatory Artificial Intelligence (AI) Governance within the Provincial Council of Gipuzkoa (Basque Country) through an action research project designed to inform Territorial Digital Inclusion Strategies led by the General Directorate for Human Rights and Democratic Culture (Presidency). Situating the study within debates on anticipatory governance, it addresses the following research question: how can city-regional governments operationalise anticipatory AI governance to advance territorial digital inclusion while safeguarding democratic accountability and human digital rights? Moving beyond industrial and productivity-centred approaches, the study focuses on the ethical, socio-economic, and territorial implications of AI for citizens. The action research follows an eight-step methodological roadmap (2024–2026) driven by a Science-for-Policy approach. Methodologically, the study integrates a multi-actor action research design structured around (i) Knowledge Exchange, (ii) Stakeholder Engagement, and (iii) Open-Science Dissemination. Findings indicate that embedding anticipatory AI governance within territorial digital inclusion strategies enhances policy foresight, strengthens ethical reflexivity in algorithmic decision-making, and consolidates public trust through participatory governance. The analysis also incorporates an emerging legal dimension, informed by the leading author’s selection to recent European Commission initiatives, including the Frontier AI Expert Forum and the AI Act Advisory Forum, enabling preliminary alignment with evolving EU AI regulatory frameworks. The Gipuzkoa case offers a context-sensitive governance framework, highlighting design principles that may inform other territorial administrations under varying institutional and resource conditions. The central empirical contribution of the article is to demonstrate that anticipatory AI governance capacity is unevenly distributed across civil society organisations (CSOs), provincial directorates, and municipalities. These asymmetries affect how AI-related risks, digital inclusion priorities, and governance responsibilities are interpreted and operationalised across territorial governance scales. Consequently, anticipatory AI governance emerges not as a universally replicable institutional model, but as a context-sensitive governance capability conditioned by administrative capacity, territorial coordination, and stakeholder participation.