I’ve been watching regulatory cycles for close to 30 years.
Telecom. Fintech. Cloud. Data privacy. Every single time, companies assumed their domestic compliance program covered their international exposure. Every single time, they discovered it didn’t.
AI is following the same pattern, moving faster than any regulatory cycle I’ve seen before.
The Compliance Landscape Companies Are Dealing With
The EU AI Act is the most comprehensive AI regulation in effect, but it’s one layer of a much more complicated picture.
The EU AI Act applies based on where AI decisions affect people, not where companies are located. A US company using AI to make decisions about EU customers, employees, or users is subject to the Act regardless of whether they have EU offices or revenue. This extraterritorial reach surprises companies that assumed EU regulation only applied to EU companies.
US state laws add their own requirements. California, Colorado, Texas, and Illinois have all enacted or proposed AI-specific legislation with requirements that differ from each other and from the federal approach. A company operating nationally faces a patchwork of state requirements with different definitions, thresholds, and enforcement mechanisms.
The APAC region is moving as well. Singapore’s Model AI Governance Framework, Japan’s AI governance guidelines, and Australia’s AI ethics framework all create expectations for companies operating in those markets, even without the enforcement mechanisms that EU law carries.
None of these frameworks were designed to work together. Some requirements overlap. Others conflict directly. A company trying to comply with all of them simultaneously faces genuine tensions between what different jurisdictions require.
Where the Real Conflicts Show Up
The conflicts between regulatory frameworks aren’t theoretical. They show up in specific operational decisions.
Data requirements are a common friction point. The EU AI Act requires transparency about training data and ongoing monitoring of AI performance. Some US approaches take a less prescriptive view of what data practices AI governance requires. Companies operating in both jurisdictions have to satisfy both sets of requirements with the same AI system.
Human oversight requirements differ across frameworks. EU AI Act sets specific standards for meaningful human oversight of high-risk AI systems. US state employment AI laws have their own human review requirements. Building oversight processes that satisfy all applicable requirements without creating separate systems for each jurisdiction is a design challenge most companies haven’t solved.
Risk classification varies by framework. An AI system that qualifies as high-risk under EU AI Act may be classified differently under other frameworks. The obligations that flow from risk classification differ accordingly, creating situations where the same system has different compliance requirements depending on which framework applies.
Why “Comply With the Strictest Standard” Doesn’t Actually Work
The instinct when facing multiple conflicting regulations is to identify the strictest requirement and comply with that, assuming it covers everything else.
This approach fails in practice because different frameworks aren’t just different levels of the same requirements. They’re different frameworks entirely, measuring different things, requiring different documentation, and using different definitions.
Complying with EU AI Act requirements doesn’t automatically satisfy US state employment AI law requirements because they’re measuring different things. A company that builds its governance around EU AI Act compliance will still have gaps under state laws that require different bias testing methodologies, different human oversight documentation, or different adverse action notice procedures.
The right approach is building a governance framework that identifies which requirements apply to each AI system based on where it operates and who it affects, then addresses each set of requirements specifically while looking for efficiencies where frameworks overlap.
The Documentation Challenge
Cross-border compliance creates a documentation challenge most companies underestimate.
Different jurisdictions require different documentation. EU AI Act requires technical documentation in a specific format. US state laws require different records of bias testing and human oversight. Regulatory investigations in different countries will ask for different evidence of compliance.
Companies that build documentation systems designed for one regulatory environment find themselves scrambling to produce different documentation formats when regulators in other jurisdictions investigate.
Building documentation practices that satisfy multiple frameworks simultaneously from the start is significantly less expensive than retrofitting documentation after a regulatory inquiry reveals the gaps.
What Companies Should Be Doing
The starting point is mapping which AI systems are subject to which regulatory frameworks based on where they operate and who they affect. This mapping often reveals that more AI systems have cross-border exposure than companies realized, particularly for companies using AI in customer-facing applications, employment decisions, or financial services.
Once the mapping exists, the gap assessment identifies where current governance practices fall short of applicable requirements in each jurisdiction. Companies typically discover that their governance programs were built with one regulatory framework in mind and have meaningful gaps under others.
Remediation prioritizes closing the highest-risk gaps first, particularly in jurisdictions with active enforcement and near-term compliance deadlines. EU AI Act enforcement timelines make EU compliance a priority for most multinational companies.
The goal isn’t a separate governance program for each jurisdiction. It’s a flexible program that addresses the specific requirements of each applicable framework without requiring entirely different processes everywhere the company operates.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor