AI regulation is no longer a future issue. It is now a governance issue.
That is becoming clear in both the US and globally.
In the United States, the most important trend is not a single federal AI law. It is the rapid rise of state-level legislation. Businesses are facing an expanding mix of rules and proposals dealing with hiring tools, algorithmic bias, automated decision-making, deepfakes, privacy, transparency, and consumer protection.
Globally, the trend is more structured. Regulatory models are increasingly moving toward risk-based governance. Instead of regulating “AI” in the abstract, lawmakers are focusing on where AI is used, what rights it affects, and how serious the consequences could be.
That shift is important because it changes the questions legal and business teams need to ask.
The question is no longer: “Do we use AI?”
The better questions are:
- Where is AI being used?
- What decisions does it influence?
- Is it affecting hiring, promotion, pricing, access, safety, or rights?
- Who is accountable for the outcome?
- What evidence do we have that risks were assessed?
A few clear trends are emerging.
1. AI regulation is becoming use-case driven. Hiring tools, employment decisions, biometric systems, customer-facing AI, and deepfakes are getting more attention than low-risk internal tools.
2. Documentation is becoming essential. It is not enough to say a tool is “responsible” or “tested.” Regulators increasingly expect evidence.
3. Human oversight is becoming a standard expectation. Across jurisdictions, the message is consistent: if AI affects people in meaningful ways, there needs to be real accountability.
4. AI law is merging with other areas of law. Privacy, cybersecurity, employment, consumer protection, and sector-specific regulation are all shaping AI risk.
5. Governance matters more than slogans. The organisations best positioned for the next wave of regulation will not be the ones talking most about AI innovation. They will be the ones with the clearest internal controls.
For in-house teams, that means AI governance should now include:
- a use-case inventory,
- risk tiering,
- legal review of high-impact tools,
- vendor diligence,
- human oversight checkpoints,
- and a clear record of approvals and decisions.
The age of AI experimentation is still here.
But it is now being overtaken by the age of AI accountability.
And the companies that recognise that early will have a real advantage.