Which regulatory approach works best for AI governance across multiple regions?

Why a Common Baseline Usually Works Better Than Region-by-Region AI Rules

For multi-region ai governance, the most effective approach is usually a common baseline with controlled local variation. A shared baseline keeps ownership, approvals, documentation and evidence consistent, while local overlays handle jurisdiction-specific legal duties. That reduces the chance that one region ends up with a weaker control model or an incompatible exception process.

The practical advantage is operational coherence. If every region invents its own policy structure, teams struggle to compare risk, audit decisions, or prove that similar systems were treated consistently. A baseline also makes it easier to manage vendor oversight, model change review, incident escalation and recordkeeping across the portfolio.

A useful reference point is the EU AI Act regulatory framework, which illustrates why a single global policy can still need local tailoring for prohibited practices, high-risk systems and deployer obligations. On the governance side, NIST AI Risk Management Framework is a strong way to structure the common baseline around accountable risk ownership, while ISO/IEC 42001:2023 AI Management System Standard helps teams formalise that baseline into a repeatable management system.

How to Handle Regional Variation Without Fragmenting Governance

The key design choice is to separate global control intent from local legal execution. The global layer should define non-negotiable requirements such as ownership, approval thresholds, human oversight, testing, logging, record retention and incident response. Regional teams should then adapt only the legal or procedural details that must differ, such as notice obligations, documentation language, or deployment restrictions.

This works best when the exceptions are explicit and bounded. A regional variation should identify what changes, why it changes, who approves it, and what control outcome remains equivalent. If those items are not documented, the exception quickly becomes a parallel policy that nobody can reconcile with the baseline.

Practitioners often use the AI governance programme itself as the control plane, then map local law into that structure. The EU AI Act provides the clearest example of a region-specific regulatory overlay, while NIST AI 600-1 GenAI Profile is useful where generative AI introduces extra concerns around testing, provenance and disclosure. For operational comparison across regions, SOC 2 Trust Services Criteria (AICPA) can also be helpful when the question is whether evidence, controls and reporting remain consistent across a multi-entity service environment.

What Makes the Baseline Defensible in Practice

A defensible multi-region approach is one that can survive audit, regulator challenge and internal dispute at the same time. That means the organisation should be able to show that the baseline was chosen deliberately, the local deviations were justified, and the final control set still meets the highest applicable obligation in each region. In practice, the hardest part is not policy writing but governance consistency across legal, risk, security and product teams.

When the subject involves AI systems that cross borders, governance should also remain tied to the actual system lifecycle, not just to policy intent. Controls need to follow model selection, training or fine-tuning, deployment, change management, monitoring and retirement. If a region can approve a shortcut at one of those stages without central visibility, the organisation no longer has a shared governance model, only a set of regional practices.

That is why many teams anchor the baseline in an enterprise AI management standard and then use a regional legal register to capture exceptions. Where the organisation needs stronger implementation detail, the EU AI Act regulatory framework is a useful source for jurisdiction-specific obligations, while NIST IR 8596 Cyber AI Profile helps connect AI governance to broader cybersecurity functions such as govern, identify, protect, detect, respond and recover.

Practitioner Guidance

What to prioritise: Set one global governance baseline first, then document regional deltas as exceptions to that baseline rather than as separate policy systems. If a region cannot explain how its variation preserves equivalent oversight, the exception is too loose.

What to verify: Check that each regional variation has a named owner, a legal rationale, an expiry or review point, and a traceable control mapping back to the baseline. If any of those are missing, the variation is already creating governance drift.

Common mistake: Teams often allow local legal teams to write separate AI policies for each market. That creates avoidable inconsistency in evidence, review cadence and accountability, even when the underlying risk is the same.

Practitioner takeaway: The best multi-region approach is not the most permissive one, but the one that preserves one control model everywhere and only varies where law truly forces a different outcome.

Related resources from NHI Mgmt Group

• How should organizations approach the governance of AI agents?
• What makes agentic AI an NHI governance issue?
• Why is NHI governance critical in the age of AI attacks?
• How should security teams make NHI best practices usable across the business?