AI Regulation Enters Its Implementation Phase

The legislative phase of AI regulation is largely over in the major jurisdictions. What follows is less visible and more consequential: the standards bodies, guidance documents, audit regimes, and first enforcement actions that convert statutory language into operational requirements.

Companies describe the current period as compliance under construction. Obligations around risk assessment, transparency, and incident reporting are in force or imminent, while the technical standards defining adequate compliance are still being drafted, leaving legal teams to build programs against a moving target.

Divergence between jurisdictions is the operational headache. Requirements overlap enough to share infrastructure but differ enough to demand local variation, and multinational deployments increasingly ship with jurisdiction-specific configurations the way privacy compliance taught them to.

The first enforcement actions, whenever they arrive, will do more to shape behavior than any guidance document. Regulators privately acknowledge the same thing companies do: everyone is watching for the initial cases that reveal where the lines actually are.