AI Regulation Is Becoming a Global Operating System
This is a summarised version of my latest whitepaper, AI Global Regulations Atlas: Mapping the Law of Intelligence, which I developed as an executive resource for C-suite leaders, enterprise risk officers, compliance teams, policymakers and organisations deploying artificial intelligence across multiple jurisdictions.
AI regulation has changed dramatically in a very short period of time.
Less than a decade ago, most discussions around AI governance centred on voluntary ethics principles, responsible innovation and broad policy frameworks. Today, organisations are dealing with binding legislation, enforcement timelines, turnover-based penalties and increasingly complex cross-border obligations.
The AI Global Regulations Atlas maps more than 1,170 AI-related regulatory instruments across 109 jurisdictions. Around 670 are already in force, while hundreds more are progressing through legislative pipelines. In the European Union, penalties for certain breaches can reach €35 million or 7% of global annual turnover.
Figure 1. AI regulatory models across 109 jurisdictions. Source: AI Global Regulations Atlas classification, November 2026.
These numbers are important, but they do not fully explain the complexity of the problem.
The global regulatory system is not converging around one model.
Instead, several different approaches are developing at the same time.
The European Union has built a horizontal, risk-based framework through the EU AI Act. The United States remains more fragmented, combining federal sector oversight with rapidly expanding state legislation. China continues to regulate specific applications such as recommendation systems, generative AI and synthetic content. The United Kingdom relies largely on existing regulators, while South Korea and Vietnam have introduced comprehensive AI legislation of their own.
For multinational organisations, the result is a difficult operating environment.
The same AI system can be subject to different definitions, risk categories, documentation requirements and enforcement dates depending on where it is deployed.
A product classified one way in Europe may face a completely different regulatory treatment in the United States or Asia.
This means AI governance can no longer sit at the edge of the organisation.
It has to become part of product architecture, enterprise risk, data governance and strategic planning.
Every organisation should know which AI systems it operates, which jurisdictions those systems touch, what data they process and which decisions they influence.
There also needs to be clear accountability.
Who owns the model?
Who approved its deployment?
Who monitors its performance?
Who maintains the documentation?
Who responds when the law changes?
Get Dinis Guarda’s stories in your inbox
Join Medium for free to get updates from this writer.
And who is responsible when an AI-driven decision causes harm?
These questions become even more important as AI agents gain the ability to act autonomously across business systems.
The transition from AI that recommends to AI that acts fundamentally changes the governance challenge.
If an agent can make purchases, approve transactions, interact with customers or operate across sensitive workflows, then identity, permissions, monitoring and accountability become part of the system itself.
This is why the whitepaper proposes a practical governance roadmap built around a few core actions.
Organisations should maintain a complete inventory of AI systems, classify those systems against the strictest applicable regulatory regimes, assign named executive accountability, control data and bias risks, label outputs where required, align governance processes with standards such as ISO/IEC 42001 and monitor regulatory developments continuously.
Another important point is that AI compliance does not begin and end with AI-specific laws.
Data protection, consumer protection, product liability, copyright, anti-discrimination, cybersecurity and financial regulation already apply to many AI systems.
In fact, many recorded enforcement actions connected to AI have been brought under these existing frameworks rather than dedicated AI legislation.
This is one of the reasons static compliance models are no longer sufficient.
The regulatory environment is changing faster than most enterprise product cycles.
A product roadmap lasting 18 to 24 months can now cross multiple enforcement dates, while a large share of the regulations organisations will eventually need to comply with are already written but have not yet entered into force.
Organisations therefore need a much more dynamic approach.
They need regulatory intelligence that is continuously updated and connected directly to engineering, legal, risk and leadership teams.
That is also why we created the AI Global Regulations Atlas as an interactive resource alongside the whitepaper.
The Atlas maps regulatory models across 109 jurisdictions and allows users to explore upcoming deadlines, compare penalties, review jurisdiction-level frameworks and assess which regulatory instruments may apply to specific markets and AI use cases.
For me, one principle sits at the centre of this entire discussion.
You cannot govern what you cannot identify, classify, monitor and audit.
The next phase of AI will not be shaped only by technological capability.
It will also be shaped by whether organisations can build the governance systems required to deploy AI safely, transparently and responsibly across borders.
AI regulation is becoming part of the operating system of the global AI economy.
The organisations that understand this early will be better positioned to innovate with confidence.
Those that treat governance as something to deal with after deployment may discover that compliance has already become an infrastructure problem rather than a legal one.
Read the full whitepaper: https://businessabc.net/ai-global-regulations-atlas
Explore the interactive AI Global Regulations Atlas: https://businessabc.net/page/ai-global-regulations-atlas
