The expectation a few years ago was that AI would be governed by something coherent and international. What is emerging instead is a patchwork, and the differences between jurisdictions are substantive rather than cosmetic.
The main approaches
Risk-tiered regulation, where obligations depend on what the system is used for rather than how it is built. That is the European model and it has become the reference point elsewhere.
Sector-specific rules, where existing regulators extend their authority to AI within their domain – medical devices, financial services, employment. That approach is common where comprehensive legislation has stalled.
And light-touch frameworks emphasising voluntary commitments, favoured where the priority is not slowing domestic industry.
Why fragmentation is costly
A product deployed across borders faces different definitions of the same terms, different documentation requirements, and different thresholds for what counts as high risk.
The practical response is to build to the strictest applicable standard, which is why one jurisdiction’s rules end up shaping products everywhere. That has happened before with privacy law.
The unsettled questions
Liability, principally. When an AI system contributes to harm, responsibility could sit with the developer, the deployer, or the user, and no jurisdiction has answered this cleanly.
Training data is the other. Whether using copyrighted material to train is permitted is being litigated in several places, with inconsistent early results.
What to do if you deploy
Know what you use and for what. Almost every framework starts with an inventory obligation, and almost nobody has one.
Document decisions as you make them. Reconstructing why a system was configured a certain way, two years later, for a regulator, is far harder than writing it down at the time.