When GDPR came into effect, many non-European companies chose to adopt their standards globally. It was easier to work with one consistent set of privacy requirements than manage different rules across markets. In that sense, GDPR actually simplified a complex compliance problem for multinational businesses.

AI regulation doesn’t appear to be following the same path.

Parts of the EU AI Act are being enforced, with more requirements coming into effect over the next few years. In the U.S., there’s no single federal AI law that brings all companies under one rulebook, and states are continuing to develop their own requirements. Other countries are taking their own approaches.

For a global company, this means tracking different rules across markets it operates in, and that’s only going to get more complicated. Gartner expects fragmented AI regulation to increase fourfold by 2030 and cover 75% of the world’s economies.

With so many different rules emerging, companies can’t afford to wait for everything to settle. A more useful approach is to look at where these regulations are already starting to converge and build a common governance framework around those requirements.

Different regulations, common expectations

Look past the differences in individual regulations, and you’ll find a lot of common ground in what regulators expect companies to have in place.