Diverging AI rules put cross-border oversight on board agendas

AI regulation is diverging across major markets, shaping product design, vendor selection, data strategy and deployment decisions for healthcare and life sciences organizations. The United States relies on existing federal regulators and state laws, the European Union applies a prescriptive risk-based framework, and the United Kingdom uses sector regulators without standalone AI legislation. China prioritizes national security and social stability through targeted rules and data controls.

Colorado’s replacement AI law and California’s clinical AI requirements take effect on January 1, 2027. Federal efforts to challenge state regulation have not resolved whether those laws will be displaced. The EU postponed duties for standalone high-risk systems until December 2, 2027, while AI embedded in regulated products, including medical devices, follows on August 2, 2028.

Cross-border data restrictions add operational complexity. China imposes security assessments and approvals on certain personal, clinical and genetic data transfers, while a US rule limits bulk transfers of genomic and health data to countries of concern, including China. Separately, the FDA and European Medicines Agency have issued joint principles for AI in drug development.

Boards should establish a regulatory risk appetite, document a baseline governance standard and require each AI approval to identify applicable jurisdictions and deadlines. Choosing separate regional systems increases complexity, while adopting an EU-based global baseline extends compliance costs across markets. China still requires a separate data environment, and responsibility for monitoring regulatory changes should be explicit.