Notifications
Clear all
Topic starter
18/08/2026 2:41 pm
TL;DR: AI regulation moved from theory to enforceable accountability in the past year, with state frontier-model laws, narrower deployment rules, and the EU AI Act now creating overlapping obligations for builders and deployers alike, according to BigID. The practical issue is no longer whether AI is regulated, but whether organisations can inventory systems, classify use cases, and prove what data each system touches before deadlines land.
NHIMG editorial — based on content published by BigID: a guide to what changed in AI regulation and who it applies to
By the numbers:
- Together, California, New York, and Illinois cover roughly 40 percent of the US AI market.
- California, New York, and Illinois all define their frontier transparency laws around a $500 million revenue threshold.
Questions worth separating out
Q: How should organisations prepare AI systems for overlapping state and EU regulations?
A: Start with one authoritative inventory of AI systems, use cases, and data dependencies, then map each item to the laws that actually apply.
Q: Why do AI laws now overlap with identity and access governance?
A: Because many regulated AI systems do more than generate output.
Q: What do organisations get wrong about AI readiness?
A: Many organisations treat AI readiness as a deployment problem when it is also a people and control problem.
Practitioner guidance
- Inventory every AI system and decision path Build a single inventory of models, features, vendors, and internal agents, then map which ones influence hiring, credit, education, safety, or other consequential decisions.
- Document data lineage for regulated use cases For each in-scope AI workflow, record what data enters the system, what data it produces, where it is stored, and who can modify the pipeline.
- Align AI governance with IAM and access control Treat AI access as a governed identity problem when systems read personal data, trigger actions, or operate inside business workflows.
What's in the full article
BigID's full article covers the operational detail this post intentionally leaves for the source:
- Jurisdiction-by-jurisdiction applicability matrix for frontier developers, deployers, and generative AI vendors
- Date-specific compliance milestones for the US state laws and the EU AI Act timeline
- Practical guidance on what evidence companies should retain for safety frameworks, audits, and disclosure obligations
- Scenario-by-scenario interpretation of how the rules affect companies that only use AI, rather than build it
👉 Read BigID's analysis of current AI regulation and compliance obligations →
AI regulation is shifting fast: what practitioners need to prepare for?
Explore further
18/08/2026 3:25 pm
Compliance fragmentation is now an operational control problem, not a legal footnote. The article shows that state frontier laws, deployment-specific rules, and EU transparency obligations are stacking without converging into one clean model. That means organisations need governance that can survive different scope tests, different effective dates, and different evidence expectations. The practitioner lesson is to build one inventory and one control map that can satisfy multiple regimes rather than treating each law as a separate project.
A question worth separating out:
Q: Who is accountable when an AI system makes a harmful decision?
A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.
👉 Read our full editorial: AI regulation is shifting from theory to enforceable accountability
