Topic starter
23/10/2026 12:46 am
TL;DR: AI regulation is fragmenting across jurisdictions, sectors and use cases, with 117 in-effect measures, 48 passed measures, 154 proposed measures and 91 policy measures, Asenion reports. Governance now needs live scoping and ownership models to keep controls aligned with each deployment.
Editorial analysis by NHI Mgmt Group, based on content published by Asenion: “Global AI Regulation Tracker”.
By the numbers:
- The tracker counts 117 in-effect measures across its global AI regulation map.
- The tracker lists 154 proposed measures across the global AI regulation map.
- Generative AI has 29 in-effect measures in the tracker, compared with 41 proposed measures.
Key questions
Q: What is the biggest risk when AI rules differ by sector and country?
A: The main risk is false consistency.
Q: What signals show an AI compliance programme is too static?
A: Common signals include the same control set being reused for every model, no distinction between enacted and proposed rules, and no owner for jurisdiction-specific changes.
Q: How should organisations govern AI systems under multiple regulatory regimes?
A: They should start with a single governance baseline for identity, access, logging, and approval evidence, then add local regulatory overlays for sector and jurisdiction requirements.
Practitioner guidance
- Map each AI use case to its governing jurisdiction Maintain a living register that ties every AI system to geography, sector, data type, and legal basis so teams can identify which rules actually apply before deployment.
- Separate policy-stage measures from in-force obligations Tag proposed, passed, and active measures differently in your governance workflow so compliance owners do not treat draft rules as implemented controls or miss enacted obligations.
- Link AI approvals to identity and access records Record which human approver, service account, or delegated workflow authorised each AI use case so evidence can be traced across lifecycle changes and revocations.
Bottom line: AI regulation is becoming fragmented across jurisdictions, sectors, and use cases, which makes static compliance policies unreliable.
Glossary terms: AI regulation, Use-Case Scoping, Jurisdictional Policy Mapping, AI Compliance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
AI regulation is becoming a control-mapping exercise, not a policy-reading exercise. The tracker shows that obligations are spread across enacted, passed, proposed, and policy-stage measures, which means teams need a live governance model rather than a static compliance register. That shift matters because AI programmes fail when legal review is detached from operational ownership. The practitioner conclusion is that AI governance now needs continuous classification, not annual review cycles.
A question worth separating out:
Q: How should IAM teams support AI regulatory compliance?
A: IAM teams should ensure AI approvals, delegated actions, and service identities are captured in the same governance records as the regulated use case. That makes it possible to prove who authorised access, which non-human identity acted, and when that authority was withdrawn. Without identity traceability, AI compliance records are incomplete.
👉 Read our full editorial: Global AI regulation tracker shows uneven rules across AI use cases
This post was modified 6 days ago by NHI Mgmt Group