AI regulation is developing rapidly worldwide, with fundamentally different approaches: European Union — the EU AI Act (2024) is the world’s first comprehensive AI law. Risk-based approach with binding requirements and penalties. United States — sector-specific approach with no comprehensive federal AI law. Executive orders, NIST frameworks, and state-level legislation (California, Colorado). China — has enacted specific regulations for algorithmic recommendations (2022), deepfakes (2023), and generative AI (2023). Focuses on content control and social stability. United Kingdom — “pro-innovation” approach with sector-specific regulation rather than a single AI law. Regulators (FCA, Ofcom, CMA) apply existing frameworks. Canada — proposed AIDA (Artificial Intelligence and Data Act) as part of Bill C-27. Japan — light-touch, voluntary guidelines favoring innovation.

The EU AI Act classifies AI systems into four risk tiers: Unacceptable risk (banned) — social scoring, manipulative AI targeting vulnerabilities, real-time biometric identification for law enforcement, emotion recognition in workplaces/schools, untargeted biometric data scraping. Prohibitions effective Feb 2025. High risk — AI in critical areas: medical devices, employment screening, credit scoring, education, law enforcement, migration. Must comply with data governance, documentation, transparency, human oversight, accuracy requirements. Conformity assessment required. Limited risk — transparency obligations only. Must disclose AI interaction (chatbots), label AI-generated content (deepfakes), label emotion recognition systems. Minimal risk — no requirements. Most AI systems fall here (spam filters, recommendation engines, video games).

The NIST AI RMF (version 1.0, January 2023) is a voluntary framework for managing AI risks. It’s organized around four core functions: Govern — establish policies, roles, and a culture of responsible AI. Define risk tolerances and accountability structures. Map — identify and understand AI risks in context. Categorize AI systems, identify stakeholders, and assess potential impacts. Measure — analyze and quantify AI risks. Use metrics, benchmarks, and testing to evaluate trustworthiness characteristics (fairness, privacy, security, transparency). Manage — prioritize and respond to AI risks. Implement mitigations, monitor effectiveness, and communicate residual risks. While voluntary, NIST AI RMF is widely adopted by US companies and referenced by federal agencies. It complements the EU AI Act rather than competing with it.

ISO/IEC 42001:2023 is the first international standard for AI management systems. It provides a framework for organizations to establish, implement, maintain, and improve their AI management. Key features: Certifiable — unlike NIST AI RMF, organizations can get ISO 42001 certification from accredited bodies. This provides third-party validation. Management system approach — follows the familiar ISO structure (like ISO 27001 for information security). Plan-Do-Check-Act cycle. Risk-based — requires AI risk assessment and treatment. Lifecycle coverage — covers the entire AI lifecycle from design to decommissioning. Complementary — designed to work alongside ISO 27001 (security), ISO 27701 (privacy), and sector-specific regulations. Organizations can build a single program that satisfies ISO 42001, NIST AI RMF, and EU AI Act requirements simultaneously.

Effective corporate AI governance requires organizational structure, not just policies: AI Ethics Board — cross-functional body (engineering, legal, product, ethics, domain experts) that reviews high-risk AI projects. Should have real authority, not just advisory power. Responsible AI Lead — a dedicated role (or team) responsible for AI governance. Reports to C-suite. AI Risk Assessment — every AI project goes through a risk assessment before development. Categorize by risk level (mirroring EU AI Act tiers). Model Registry — centralized inventory of all AI models in production. Track purpose, data, performance, and risk level. Incident Response — documented process for AI failures, bias incidents, and safety issues. Training — all employees working with AI receive ethics and governance training. Lessons from failed ethics boards: Google dissolved its AI ethics board in one week (2019). Microsoft disbanded its ethics team (2023). Ethics boards fail when they lack authority or executive support.

AI auditing evaluates whether AI systems meet legal, ethical, and technical requirements: Algorithmic Impact Assessment (AIA) — evaluates the potential impact of an AI system on individuals and society before deployment. Required by Canada’s proposed AIDA and recommended by the EU AI Act for high-risk systems. Data Protection Impact Assessment (DPIA) — required by GDPR for high-risk data processing. Evaluates privacy risks and mitigations. Bias Audit — systematic testing for discriminatory outcomes across protected groups. NYC Local Law 144 (2023) requires annual bias audits for automated employment decision tools. Conformity Assessment — EU AI Act requires high-risk AI systems to undergo conformity assessment (self-assessment or third-party) before market entry. Third-party Audit — independent evaluation by external auditors. Provides credibility but the AI auditing profession is still maturing.

The EU AI Act entered into force on August 1, 2024, with a phased implementation: Feb 2, 2025 — Prohibited AI practices take effect. Social scoring, manipulative AI, and other banned uses become illegal. Aug 2, 2025 — GPAI (General-Purpose AI) rules take effect. Foundation model providers must comply with transparency, documentation, and systemic risk requirements. Aug 2, 2026 — High-risk AI system requirements take effect. Full compliance required for AI in healthcare, employment, credit scoring, etc. Aug 2, 2027 — Remaining provisions take effect, including requirements for high-risk AI systems that are safety components of products. The EU has launched support mechanisms: the AI Pact (voluntary early compliance), the AI Act Service Desk (guidance), and published guidelines on prohibited practices.

Building an AI governance program from scratch: Step 1: Inventory — catalog all AI systems in your organization. You can’t govern what you can’t see. Step 2: Classify — categorize each system by risk level (using EU AI Act tiers as a framework). Step 3: Gap analysis — compare current practices against requirements (EU AI Act, NIST AI RMF, ISO 42001). Step 4: Governance structure — establish an AI ethics board, appoint a Responsible AI lead, define roles and responsibilities. Step 5: Policies — create AI-specific policies for development, deployment, monitoring, and incident response. Step 6: Technical controls — implement bias testing, explainability tools, monitoring, guardrails. Step 7: Training — educate all AI practitioners on ethics and governance. Step 8: Audit — conduct regular internal audits and consider ISO 42001 certification.