The Global AI Regulatory Landscape: What GRC Teams Need to Know

Here's a practical overview of where things stand.

The EU AI Act is the most comprehensive AI regulation in the world. Officially implemented in August 2024, with rules taking effect through August 2026, it classifies AI systems into four risk tiers: unacceptable (banned), high-risk (strict requirements), limited risk (transparency requirements), and minimal risk (largely unrestricted). High-risk AI, used in hiring, law enforcement, credit decisions, and other consequential domains — must meet requirements for data quality, human oversight, and transparency. Non-compliance can result in fines of up to 7% of global annual revenue. For any organization with operations or customers in the EU, this is not optional.

In the United States, the approach has been more fragmented. There is no comprehensive federal AI law as of this writing, though executive guidance, agency enforcement actions, and proposed legislation are all in play. States are filling the gap: Colorado's AI Act, for instance, requires developers and deployers of high-risk AI to use reasonable care to prevent algorithmic discrimination. Other states are developing similar legislation. For U.S.-based GRC teams, monitoring state-level developments is now essential.

The UK is evolving from a principles-based, non-legislative approach toward something more structured, including potential legislation targeting high-risk AI systems. The approach will remain distinct from the EU's more prescriptive framework.

Singapore takes a voluntary, risk-based approach, with the Model AI Governance Framework providing practical guidance for organizations operating in the region. Sector-specific guidance from the Monetary Authority of Singapore and the Ministry of Health add additional detail.

South Korea's AI Basic Act, effective January 2026, focuses on "high-impact" AI systems and requires risk assessments, risk management plans, and user notification when AI-generated content could be confused with authentic material.

Japan's AI Promotion Act emphasizes innovation and voluntary compliance over strict regulation, with governance handled by a high-level AI strategy body.

China has enacted a series of targeted regulations covering recommendation algorithms, deepfakes, and generative AI services, with mandatory labeling of AI-generated content expanding in 2025.

Internationally, the G7's Hiroshima AI Process, the OECD AI Principles, and the UN's AI Advisory Body are all working toward more harmonized global governance, with limited success so far, given the divergent national interests at play.

For GRC teams, the practical implication is this: compliance with AI regulation is not a one-time exercise. The landscape is changing rapidly, across multiple jurisdictions simultaneously, often in conflicting directions. Organizations need ongoing regulatory monitoring capability, clear ownership of AI compliance, and the flexibility to adapt policies and controls as requirements evolve.

Treat AI regulation the way you treat data privacy regulation: as a permanent, high-priority compliance domain that requires dedicated attention.