The European Union has enacted two landmark frameworks that impose partially divergent obligations on financial entities deploying artificial intelligence (AI) in cybersecurity. The AI Act (Regulation (EU) 2024/1689) establishes a risk-based classification system subjecting AI systems to graduated transparency, explainability, and human-oversight duties. The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) requires financial entities to maintain robust Information and Communication Technology (ICT) risk-management capabilities, including rapid, automation-capable threat detection and incident response. This article argues that, for systemically significant financial actors, the combined operation of these two regimes together with the EU Charter of Fundamental Rights produces what it terms a regulatory trilemma: a three-cornered tension between (i) the AI Act’s demand for transparency and human control, (ii) DORA’s expectation of automation-capable operational resilience, and (iii) the Charter’s guarantees of privacy, data protection, and non-discrimination. The article’s contribution is threefold and deliberately modest. First, it brings the AI Act and DORA into a single doctrinal frame and shows that their interaction generates a genuine compliance dilemma rather than a relabelling of familiar bilateral tensions. Second, it situates that dilemma within the wider fragmentation of EU digital regulation, asking why DORA stands somewhat apart from the rights-and-innovation balance that De Gregorio and Dunn identify as the connecting thread of the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and the AI Act, and whether the emerging discourse of digital sovereignty supplies a shared horizon. Third, it advances calibrated autonomy as a structured, proportionality-anchored interpretive and normative proposal that conditions the permissible degree of AI autonomy on threat severity, data sensitivity, and decision reversibility. The article closes with reform proposals—joint guidance from the European Supervisory Authorities, a harmonised incident taxonomy from the European Union Agency for Cybersecurity (ENISA), a narrowly defined compliance safe harbour, and sector-specific advisory boards—assessed against questions of competence, legal basis, and feasibility. The analysis is confined to the financial sector governed by DORA; the closing section identifies which arguments travel beyond it.

This article examines the implementation of Anticipatory Artificial Intelligence (AI) Governance within the Provincial Council of Gipuzkoa (Basque Country) through an action research project designed to inform Territorial Digital Inclusion Strategies led by the General Directorate for Human Rights and Democratic Culture (Presidency). Situating the study within debates on anticipatory governance, it addresses the following research question: how can city-regional governments operationalise anticipatory AI governance to advance territorial digital inclusion while safeguarding democratic accountability and human digital rights? Moving beyond industrial and productivity-centred approaches, the study focuses on the ethical, socio-economic, and territorial implications of AI for citizens. The action research follows an eight-step methodological roadmap (2024–2026) driven by a Science-for-Policy approach. Methodologically, the study integrates a multi-actor action research design structured around (i) Knowledge Exchange, (ii) Stakeholder Engagement, and (iii) Open-Science Dissemination. Findings indicate that embedding anticipatory AI governance within territorial digital inclusion strategies enhances policy foresight, strengthens ethical reflexivity in algorithmic decision-making, and consolidates public trust through participatory governance. The analysis also incorporates an emerging legal dimension, informed by the leading author’s selection to recent European Commission initiatives, including the Frontier AI Expert Forum and the AI Act Advisory Forum, enabling preliminary alignment with evolving EU AI regulatory frameworks. The Gipuzkoa case offers a context-sensitive governance framework, highlighting design principles that may inform other territorial administrations under varying institutional and resource conditions. The central empirical contribution of the article is to demonstrate that anticipatory AI governance capacity is unevenly distributed across civil society organisations (CSOs), provincial directorates, and municipalities. These asymmetries affect how AI-related risks, digital inclusion priorities, and governance responsibilities are interpreted and operationalised across territorial governance scales. Consequently, anticipatory AI governance emerges not as a universally replicable institutional model, but as a context-sensitive governance capability conditioned by administrative capacity, territorial coordination, and stakeholder participation.

Contemporary AI governance typically treats ethics and law as complementary normative domains with different levels of enforcement. This paper argues that this distinction alone is insufficient given the evolving role of AI systems as artificial moral agents. Conceptualizing ethics and law as functionally distinct yet interdependent domains, the authors argue that the notion of functional agency to describe how AI systems generate normatively relevant outcomes through decision substitution, the embedding of societal norms in the design of AI systems, and behavioural steering. Drawing on case studies of recommender systems, large language models, autonomous driving, and care robotics, the paper demonstrates the systematic displacement of micro-level ethical reasoning by standardized, societal logics that tend to prioritize macro-level considerations such as beneficence over individual autonomy. This shift poses a structural challenge to human rights, which explicitly protect individual moral deliberation. The paper therefore calls for a paradigm shift in AI governance from embedding societal norms in AI systems to governing the construction of normativity itself grounded with an emphasis on the protection of individual ethical reasoning and stronger acknowledgement of moral pluralism.