Topic starter
18/08/2026 2:41 pm
TL;DR: AI regulation moved from theory to enforceable accountability in the past year, with state frontier-model laws, narrower deployment rules, and the EU AI Act now creating overlapping obligations for builders and deployers alike, according to BigID. The practical issue is no longer whether AI is regulated, but whether organisations can inventory systems, classify use cases, and prove what data each system touches before deadlines land.
Editorial analysis by NHI Mgmt Group, based on content published by BigID: “The Ultimate Guide to the Global AI Regulatory Landscape: Who’s Affected, What Changed, and How to Prepare”.
By the numbers:
- California, New York, and Illinois together cover roughly 40 percent of the US AI market.
Key questions
Q: What should organisations do first when they start governing AI agent behaviour?
A: Start with the highest-impact workflows that touch customers, spend or sensitive data, then define purpose, allowed data, escalation rules and expiry for each one.
Q: Why do AI regulations create risk for companies that are not model builders?
A: Because many of the new obligations attach to deployment, use case, and data handling, not just model development.
Q: What breaks when organizations do not classify AI use cases by risk tier?
A: Without risk tiers, every AI use case tends to receive the same review, which leaves high-risk workloads under-scrutinized and low-risk uses needlessly burdened.
Practitioner guidance
- Build a complete AI system inventory Catalogue every AI system in use, including purchased tools, internal models, embedded features, and agent-like workflows, then assign an accountable owner for each entry.
- Classify each use case against applicable rules Map systems to frontier-developer, high-risk, or disclosure obligations based on geography, function, and decision impact, not on vendor category.
- Document data lineage for every regulated system Record what data each system touches at training, inference, and output stages so disclosure, audit, and impact assessment evidence can be produced quickly.
Bottom line: AI regulation has moved from draft principles to enforceable accountability, and the main governance burden now sits with inventory, classification, and evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
AI compliance is now an evidence problem, not a policy problem. The article shows that regulators are converging on inventory, classification, disclosure, and auditability rather than abstract principles. That shifts the burden from drafting governance language to proving what systems exist and what they do with data. For practitioners, the decisive question is whether the organisation can produce evidence on demand.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Which governance question matters most when AI vendors provide regulatory evidence?
A: The key question is whether the vendor’s evidence matches the organisation’s own inventory, data flows, and use-case classification. A provider may offer safety documents or audit material, but deployers still need to confirm scope, applicability, and data access. Accountability is shared, but the consuming organisation remains responsible for proving its own control environment.
👉 Read our full editorial: AI regulation is shifting from theory to enforceable accountability