AI regulation across regions: what should compliance teams watch?

TL;DR: A fragmented 2026 regulatory map, with 117 in-effect measures, 48 passed measures, 154 proposed measures, and 91 policy measures across AI use cases and sectors, is shown in Asenion's Global AI Regulation Tracker. The pattern signals that AI governance now depends on jurisdictional scoping, use-case classification, and continuous policy mapping rather than a single enterprise-wide control set.

Editorial analysis by NHI Mgmt Group, based on content published by Asenion: “Global AI Regulation Tracker”.

By the numbers:

• The tracker counts 117 in-effect measures across its global AI regulation map.
• The tracker lists 154 proposed measures across the global AI regulation map.
• Generative AI has 29 in-effect measures in the tracker, compared with 41 proposed measures.

Key questions

Q: How should organisations govern AI systems under multiple regulatory regimes?

A: They should start with a single governance baseline for identity, access, logging, and approval evidence, then add local regulatory overlays for sector and jurisdiction requirements.

Q: What is the biggest risk when AI rules differ by sector and country?

A: The main risk is false consistency.

Q: What signals show an AI compliance programme is too static?

A: Common signals include the same control set being reused for every model, no distinction between enacted and proposed rules, and no owner for jurisdiction-specific changes.

Practitioner guidance

• Map each AI use case to its governing jurisdiction Maintain a living register that ties every AI system to geography, sector, data type, and legal basis so teams can identify which rules actually apply before deployment.
• Separate policy-stage measures from in-force obligations Tag proposed, passed, and active measures differently in your governance workflow so compliance owners do not treat draft rules as implemented controls or miss enacted obligations.
• Link AI approvals to identity and access records Record which human approver, service account, or delegated workflow authorised each AI use case so evidence can be traced across lifecycle changes and revocations.

Bottom line: AI regulation is becoming fragmented across jurisdictions, sectors, and use cases, which makes static compliance policies unreliable.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →