Multinationals confront fragmented AI rulebooks

Multinational companies are facing an increasingly fragmented AI governance landscape. The EU AI Act remains the most visible risk-based regime, while the United States relies on federal agency rules, state legislation, sector guidance and voluntary frameworks. China, South Korea and Singapore are advancing their own approaches, and standards bodies are adding layers through the NIST AI Risk Management Framework and ISO/IEC 42001.

AI systems now cut across legal and operational categories that companies once managed separately, including privacy, cybersecurity, discrimination, product liability, labour oversight and auditability. Stanford HAI’s 2025 AI Index found that US federal agencies introduced 59 AI-related regulations in 2024, more than double the number in 2023, while legislative references to AI rose by 21.3% across 75 countries compared with the previous year.

Technology providers, consulting firms and governance platforms are responding with tools for inventories, controls, documentation, monitoring and evidence. EC-Council’s Adopt. Defend. Govern. AI Framework is positioned as an operating model that aligns with the EU AI Act, ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM and Agentic AI and MITRE ATLAS, using three pillars, 12 minimum controls and nine governance surfaces.

Boards are being pushed to ask which AI systems are in production, where they operate, who owns decisions, how risks are tested and what evidence supports compliance. The strongest governance models will need to absorb changing rules and turn them into repeatable controls across regions and business units.