The New Rules of AI: What Emerging Regulations Mean for Your Organization

Key Takeaways

• AI regulation is increasingly complex. Organizations may face different requirements depending on where they operate, how they use AI, and what data or business activities are involved.
• AI compliance extends beyond AI-specific regulations. Existing privacy, cybersecurity, intellectual property and other regulatory requirements may also affect how organizations deploy and govern AI.
• Organizations should not wait for AI regulations to settle. Building an adaptable AI governance and risk management framework now can help organizations respond as requirements evolve.
• Visibility is foundational to AI governance. Leaders need to understand which AI tools and use cases exist across the organization, what information they access, and who is responsible for managing associated risks.

Artificial intelligence (AI) is moving faster than the rules designed to govern it. Organizations are adopting new AI tools, embedding them into their processes, and experimenting with new use cases. Meanwhile, governments and regulators around the world are still determining how those activities should be regulated.

For business leaders, that creates a difficult question: How do you prepare for AI regulations when the regulatory environment itself is still changing?

The answer is not to wait.

The emerging regulatory landscape already provides organizations with important signals about where expectations are heading. Rather than trying to anticipate every new AI law, organizations should focus on establishing an AI governance and risk framework that can adapt as requirements evolve.

There Is No Single Rulebook for AI

One of the biggest challenges with AI compliance is fragmentation.

Jurisdictions around the world are taking different approaches to AI regulations. Even the definition of what constitutes an AI system can vary from one jurisdiction to another. Regulatory requirements also take different forms, including legislation, executive action, existing regulatory authority, and voluntary frameworks.

That matters because organizations often use technology within unclear regulatory boundaries. An AI tool may involve employees and customers in different locations, process personal or proprietary information, and support activities subject to industry-specific requirements.

AI regulations can also overlap with laws organizations already must follow. These areas can include data protection, intellectual property, securities, antitrust, and financial regulation. As a result, AI use may create compliance considerations even without a standalone AI law.

In other words, an organization does not necessarily have to be subject to an “AI law” for its use of AI to create compliance risk.

The EU and US Illustrate Two Different Regulatory Paths

The contrast between the European Union and the United States demonstrates why a flexible governance structure is becoming increasingly important.

The EU has established the EU AI Act, a comprehensive framework for regulating AI systems across EU Member States. The framework takes a cross-sector approach and establishes regulatory and enforcement responsibilities at both the European and Member State levels.

The United States presents a different picture. AI oversight includes existing federal laws and regulatory authority as well as activity at the state level. For organizations operating across jurisdictions, the compliance question cannot simply be, “Are we following the AI law?”

Leaders need to understand which rules apply to which AI use cases and where their organization may be exposed.

AI Compliance Starts With Visibility

That brings AI regulation back to a familiar cybersecurity principle: You cannot effectively govern what you do not know you have.

AI tools can enter an organization through many channels. Employees may adopt applications independently, individual business units may purchase their own platforms, and existing vendors may add AI capabilities to products already in use.

That can create gaps between an organization’s formal AI strategy and how the technology is actually being used.

An effective governance program therefore starts with visibility. Organizations should understand what AI systems are in use, the business purposes they serve, what information they access or process, and who is responsible for them.

This is particularly important as organizations confront the broader problem of shadow AI, or AI technology being used without appropriate organizational oversight. As we discuss in our related guidance on hidden vendor risk, technology that has not been properly identified and evaluated can create blind spots for risk and compliance teams.

Don’t Wait for the Rules to Stop Moving

It can be tempting to delay major governance decisions while AI regulations continue to develop. In practice, the uncertainty is a reason to strengthen governance now.

Regulators themselves face a difficult balance. Rules need enough flexibility to accommodate technological change, but flexibility can also make future compliance obligations less certain.

Organizations cannot eliminate that uncertainty. They can put themselves in a better position to respond to it.

The goal should be to build AI governance around durable risk management principles instead of a single regulation. Leaders should consider five priorities:

1. Know where AI is being used. Maintain visibility into the AI systems, vendors, and use cases operating across the organization.
2. Evaluate risk based on use. An employee using AI to brainstorm ideas presents a different risk profile than an AI system influencing a consequential business decision or processing sensitive information. Governance should reflect those differences.
3. Establish accountability. Define who can approve AI use and when cybersecurity, privacy, compliance, legal, and stakeholders should be involved.
4. Document important decisions. Maintain appropriate records of AI use cases, risk assessments, approvals, ethical evaluations, and controls so that governance does not exist only as an informal process.
5. Review the program as conditions change. AI governance should not be a project organizations complete once. New technologies, use cases, and regulatory requirements make periodic reassessment essential.

These practices complement the broader cybersecurity disciplines organizations should already be building. Our Cybersecurity Resource Hub provides additional guidance on cybersecurity risk, governance, and preparedness.

Build for Change

The new rules of AI are still being written, and different industries and jurisdictions may continue taking different approaches. That does not mean organizations lack a path forward.

Establishing AI governance practices today will enable your organization to maximize benefits while thoughtfully managing risk. A strong approach includes establishing visibility, accountability, and controls needed to understand how AI is being used today and adapt as the regulatory environment changes tomorrow.

AI regulation will continue to move, but organizations do not have to stand still.