Most executives understand AI is regulated. Few understand what regulation actually requires of them.
The gap between what leaders believe about AI compliance and what regulations actually demand is where liability lives. These are the five misconceptions showing up most consistently in conversations with GCs, CCOs, and CROs.
Misconception 1: “We Don’t Operate in the EU So the EU AI Act Doesn’t Apply to Us”
This is the most common and most expensive misconception.
The EU AI Act applies based on where AI impacts occur, not where companies are located. If your AI makes decisions affecting EU customers, employees, or users, you’re subject to the Act regardless of whether you have EU offices, employees, or revenue.
A US company with European customers using AI for pricing, customer service, or account decisions faces EU AI Act obligations. The regulation follows impact, not incorporation address. The same extraterritorial logic that made GDPR apply to US companies applies here.
Misconception 2: “Human Review Means We’re Not Liable for AI Decisions”
Executives believe adding human review to AI decision processes eliminates liability. It doesn’t.
Regulators evaluate whether human review is meaningful, not whether it exists. A human clicking approve on 500 AI recommendations per day without genuinely evaluating them isn’t oversight – it’s liability theater that creates the appearance of control without the substance.
NYC Local Law 144 and EU AI Act both explicitly address this. If AI influences decisions, human review doesn’t eliminate compliance obligations. It only satisfies those obligations if humans genuinely understand what the AI did and can override it based on independent judgment.
Misconception 3: “We Tested the AI Before Deployment So We’re Covered”
Testing AI at deployment proves it worked correctly on one day. It says nothing about whether it’s working correctly now.
AI systems change over time through model updates, shifting input data, and changing deployment contexts. Bias testing conducted eighteen months ago doesn’t protect against discrimination happening today. Performance validation from deployment doesn’t catch model drift that developed over subsequent months.
Regulators ask when AI was last tested, not whether it was tested before launch. Companies that can only point to pre-deployment testing are demonstrating they stopped monitoring after the easy part.
Misconception 4: “Our Vendor Is Responsible for Their AI’s Compliance”
Companies deploying AI are responsible for its compliance regardless of who built it.
Vendor contracts universally disclaim liability for AI accuracy, fairness, and regulatory compliance. Terms of service provide AI “as is” with no warranties about fitness for any particular purpose. Indemnification covers IP infringement, not discrimination lawsuits or regulatory fines.
When your AI discriminates, regulators come to you. When your AI hallucinates, clients sue you. When your AI violates privacy laws, enforcement targets you. The vendor relationship doesn’t transfer liability – it just means you have to pursue the vendor separately while simultaneously defending yourself.
Misconception 5: “AI Regulation Is Still Too Early-Stage to Require Action Now”
This misconception is costing companies the most.
The EU AI Act is in force. State employment AI laws are being enforced. EEOC guidance on AI hiring tools is active. CFPB has taken positions on AI in lending. Courts are sanctioning lawyers for AI hallucinations. Regulators are investigating AI discrimination claims.
Companies waiting for regulatory clarity before building governance programs are building programs under enforcement pressure rather than on their own timeline. The cost of reactive compliance is substantially higher than proactive compliance because reactive programs get built in crisis conditions with less time, more scrutiny, and higher stakes.
The executives who told their boards they were waiting for clearer rules are now explaining why they’re behind competitors who started building programs two years ago.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor