AI regulation turns governance into a product requirement

AI regulation is moving from planning exercise to operational constraint as companies prepare for EU AI Act full applicability on August 2, 2026. The law entered force on August 1, 2024, and groups systems into unacceptable, high, limited, and minimal risk categories, with obligations ranging from bans to conformity assessments, human oversight, documentation, transparency measures, or voluntary codes.

The United States remains fragmented, with no comprehensive federal AI law. In March 2026, the White House released a National Policy Framework recommending congressional preemption of state laws to reduce regulatory fragmentation, while Microsoft, Google, and OpenAI have publicly urged federal clarity. Companies selling across US states and Europe must still classify systems by use case, since the same model can carry different duties depending on whether it screens job applicants or supports internal productivity analysis.

Governance is framed as an enterprise system involving accountability chains, documented decisions, audit trails, product teams, engineering, finance, and legal functions. Japan enacted the AI Promotion Act in May 2025, adding another APAC compliance touchpoint. Recommended steps include inventorying AI systems that touch customer data or automated decisions, mapping them to EU AI Act risk categories, and treating governance design and IP strategy as connected workstreams.