Global AI regulation tracker shows uneven rules across AI use cases

At a glance

What this is: Asenion's Global AI Regulation Tracker maps AI laws and policy measures worldwide and shows a regulatory landscape that is broad, fast-moving, and uneven across sectors and jurisdictions.

Why it matters: For IAM, NHI, and AI governance teams, the tracker highlights that compliance requirements for AI systems cannot be treated as a single policy problem because obligations vary by use case, geography, and regulated activity.

By the numbers:

• The tracker counts 117 in-effect measures across its global AI regulation map.
• The tracker lists 154 proposed measures across the global AI regulation map.
• Generative AI has 29 in-effect measures in the tracker, compared with 41 proposed measures.
• Government and military AI has 6 in-effect measures, 7 passed measures, 18 proposed measures, and 3 policy measures.

Context

AI regulation is no longer a single-policy question. Organisations now have to track where rules apply, which use case they govern, and whether the obligation is already in force or still moving through the legislative process. That creates a governance problem that spans AI risk management, privacy, and operational control.

For identity and security teams, the practical issue is that AI programmes increasingly touch human identity, data handling, and delegated system behaviour at the same time. When regulation varies by sector and geography, lifecycle governance, control mapping, and accountability need to be maintained at the use-case level, not just at the platform level.

Key questions

Q: How should organisations govern AI systems under multiple regulatory regimes?

A: They should start with a single governance baseline for identity, access, logging, and approval evidence, then add local regulatory overlays for sector and jurisdiction requirements. That avoids building separate control models for every market and makes audits easier to defend. The goal is consistency in the identity layer, with flexibility only where law truly differs.

Q: What is the biggest risk when AI rules differ by sector and country?

A: The main risk is false consistency. Teams assume one policy covers all deployments, then miss sector-specific obligations or apply controls that do not fit the use case. That creates gaps in disclosure, approval, retention, and oversight. A governance model that classifies each deployment by jurisdiction and use case is more reliable than a single enterprise-wide AI rulebook.

Q: What signals show an AI compliance programme is too static?

A: Common signals include the same control set being reused for every model, no distinction between enacted and proposed rules, and no owner for jurisdiction-specific changes. If the organisation cannot answer which AI systems are live in which regions, the programme is already lagging the regulatory environment. Continuous mapping is the practical test of maturity.

Q: How should IAM teams support AI regulatory compliance?

A: IAM teams should ensure AI approvals, delegated actions, and service identities are captured in the same governance records as the regulated use case. That makes it possible to prove who authorised access, which non-human identity acted, and when that authority was withdrawn. Without identity traceability, AI compliance records are incomplete.

Technical breakdown

How AI regulation tracking becomes a governance control problem

A regulation tracker is not just a news index. It is a governance mechanism that maps laws, policies, and draft measures to jurisdictions and AI use cases so teams can see where obligations already apply and where new requirements are emerging. The technical challenge is classification. If an AI system spans consumer disclosure, employment decisions, or government use, different regimes may apply to different parts of the same workflow. That makes policy interpretation, scoping, and ownership part of the control surface rather than an afterthought.

Practical implication: maintain a use-case inventory that ties each AI system to jurisdiction, data category, and accountable owner.

Why sector-specific AI rules complicate enterprise policy

The tracker shows that AI regulation is fragmented across general AI rules and sector-specific measures. That matters because a single enterprise policy cannot safely assume one compliance path for all deployments. A chatbot, an automated decision engine, and a government-facing model may all require different notices, safeguards, approvals, or restrictions. In practice, this pushes organisations toward control families that can be reused, but only after they are mapped to each applicable sector rule set and deployment context.

Practical implication: build a control-mapping layer that translates enterprise AI policy into sector-specific obligations before deployment.

Where identity governance intersects with AI regulation

AI regulation often reaches the same governance questions that IAM and NHI teams already manage: who approved access, which identities can act on behalf of a system, and which data flows are permitted. When AI systems trigger data use, user-facing decisions, or delegated actions, the identity of the human approver and the non-human actor both matter. This is where governance breaks down if teams treat AI compliance as a legal review instead of a control lifecycle problem.

Practical implication: align AI oversight with access governance so approvals, delegated rights, and revocation can be evidenced end to end.

NHI Mgmt Group analysis

AI regulation is becoming a control-mapping exercise, not a policy-reading exercise. The tracker shows that obligations are spread across enacted, passed, proposed, and policy-stage measures, which means teams need a live governance model rather than a static compliance register. That shift matters because AI programmes fail when legal review is detached from operational ownership. The practitioner conclusion is that AI governance now needs continuous classification, not annual review cycles.

Use-case scoping is the real regulatory boundary. The same organisation can face different requirements for generative AI, employment use, public-sector use, or health-related use, even where the underlying model stack is shared. That creates a named governance problem: use-case regulatory fragmentation, where one platform is governed by multiple rule sets at once. Teams should treat this as a control design issue, not a documentation problem. The practitioner conclusion is to map each use case to its applicable regime before the model reaches production.

Identity governance is now part of AI compliance. AI systems make decisions, move data, and sometimes act through delegated or automated workflows, so accountability is not limited to the model owner. Human approvers, system accounts, and delegated agents all sit inside the compliance chain when the system affects regulated outcomes. The practitioner conclusion is to connect AI governance with IAM and lifecycle controls so that responsibility can be traced across the full decision path.

Jurisdictional variability will force governance teams to be more operationally precise. The tracker demonstrates that regulations are not converging into one simple global model. That means compliance teams must distinguish between policy intent, enacted law, and local sector obligations, then translate those into repeatable controls. The practitioner conclusion is to avoid one-size-fits-all AI policy language and instead maintain a jurisdiction-by-use-case control matrix.

What this signals

Use-case regulatory fragmentation: organisations now need a control layer that distinguishes between active law, approved measures, and policy-stage rules across different AI deployments. The practical challenge is not only knowing that AI is regulated, but knowing which version of the rule applies to each use case before it reaches production.

AI governance will increasingly converge with IAM, data governance, and lifecycle evidence because the compliance question is no longer only what the model does. It is who authorised it, where it is used, what data it touches, and how quickly the organisation can prove that those conditions still hold.

For practitioners

• Map each AI use case to its governing jurisdiction Maintain a living register that ties every AI system to geography, sector, data type, and legal basis so teams can identify which rules actually apply before deployment.
• Separate policy-stage measures from in-force obligations Tag proposed, passed, and active measures differently in your governance workflow so compliance owners do not treat draft rules as implemented controls or miss enacted obligations.
• Link AI approvals to identity and access records Record which human approver, service account, or delegated workflow authorised each AI use case so evidence can be traced across lifecycle changes and revocations.
• Build sector-specific control overlays Translate one enterprise AI policy into different control overlays for health, employment, public-sector, and consumer use cases rather than reusing the same checklist everywhere.

Key takeaways

• AI regulation is becoming fragmented across jurisdictions, sectors, and use cases, which makes static compliance policies unreliable.
• The tracker shows a large volume of proposed and in-force AI measures, so governance teams need live scoping and ownership models.
• AI compliance is now tied to identity, access, and lifecycle evidence because delegated actions and approvals sit inside the regulatory chain.

Key terms

• AI regulation: AI regulation is the set of laws, standards, and policy obligations that shape how artificial intelligence can be built, deployed, and monitored. In practice it governs data use, transparency, accountability, and safety controls, often through sector rules or risk-based requirements rather than one universal law.
• Use-Case Scoping: Use-case scoping is the process of defining exactly what an AI agent is authorised to do, which systems it may touch, and which data it may use. Clear scoping limits overreach, supports least privilege, and gives compliance teams evidence that deployment stayed within an approved purpose.
• Jurisdictional Policy Mapping: Jurisdictional policy mapping is the process of aligning onboarding, monitoring, retention, and escalation rules to the laws and expectations of each market a payments business serves. It is essential in APAC because a single control design rarely satisfies every country equally.
• AI Compliance: AI compliance is the state of meeting external legal, contractual, or regulatory requirements that apply to an AI deployment. It depends on evidence, policies, and operational controls already being in place, which is why compliance is usually the outcome of governance rather than its replacement.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It is designed for practitioners who need to connect identity controls to broader security and compliance programmes.