AI regulation is arriving from every direction. Here is what to do this year, whatever the final rules say

For organisations deploying AI, the regulatory picture can look like chaos: the European Union phasing in a comprehensive AI Act, individual US states passing their own laws, sector regulators in healthcare and finance issuing guidance, and standards bodies publishing management-system frameworks. Timelines shift, scopes differ and the details are genuinely unsettled. The strategic reality underneath is simpler than it looks.

The convergence nobody is advertising

Read the EU AI Act's obligations for high-risk systems, Colorado's law on algorithmic discrimination, NIST's AI Risk Management Framework, ISO/IEC 42001 and the guidance from US banking and health regulators side by side, and the same requirements appear in different language. Know what AI you use and for what. Assess its risks and impacts, particularly on people. Keep humans in oversight. Document how it works and how it was tested. Be transparent with those affected. Manage your suppliers. Monitor it after deployment.

The high-cost mistake

The expensive error is to deploy AI across the business now and attempt to govern it later. Inventories are reconstructed under pressure, impact assessments are written after the impact, and systems that cannot be explained have to be withdrawn. The organisations that will be most exposed are not those that moved slowly; they are those that moved quickly without an inventory.

Regulation will not punish you for using AI. It will punish you for not being able to say how.

What to do this year

• Inventory. Know every AI system in use — including the ones staff adopted without asking — what it does, what data it touches and who owns it.
• Classify. Identify the uses that affect people's access to credit, care, employment, housing, education or public services. These are where every regulator is looking first.
• Assess. Conduct impact and risk assessments for those uses, with the documentation to show for it.
• Govern. Adopt a policy, assign accountability and set up oversight — ideally aligned to NIST AI RMF or ISO/IEC 42001 so the structure maps to future requirements.
• Prepare suppliers. Your vendors' AI is your exposure. Contract and assess accordingly.

Sector specifics

Healthcare organisations should expect transparency expectations for AI in clinical tools and continued FDA attention to software that informs care. Financial institutions already have model-risk management; it now needs to cover AI explicitly, including fair-lending outcomes. Employers using AI in hiring face specific state and city rules. Public bodies face transparency and procurement expectations. In each case, the common core above is the starting point and the sector rules are the refinement.

We help organisations build AI governance that is proportionate — rigorous enough to satisfy regulators and customers, light enough to let the business keep innovating. If you have AI in production and no inventory, that is the place to start, and it is a shorter conversation than most leaders expect.

Rakesh BabujiCo-Founder & CEO, Digiward Solutions · Author of The Collaborative Dawn · 25+ years in technology, security and risk across North America, Africa and Asia.

This article is general information for business readers, not legal, regulatory, medical or professional advice. Regulations change; confirm requirements for your situation with qualified counsel or your regulator. Imagery is original AI-generated artwork created with Canva. Frameworks and standards named are trademarks of their respective owners.