The EU AI Act, which entered into force on August 1, 2024, reaches its most consequential milestone on August 2, 2026, when the majority of its obligations become fully applicable.

High-risk AI systems—covering use cases such as creditworthiness assessments, employment decisions, biometric identification, critical infrastructure, law enforcement, and essential public services—will be subject to extensive compliance requirements. These include formal risk management processes, technical documentation, transparency measures, human oversight, and accuracy benchmarks.

Key obligations for high-risk systems include:

The European Commission is expected to issue detailed implementation guidance by February 2, 2026, clarifying practical expectations for Article 6 compliance, including post-market monitoring obligations.

Executive takeaway: Organizations with EU exposure should begin readiness assessments immediately, particularly for AI systems already in production that may require architectural or governance modifications.

Separately, prohibited AI practices became enforceable on February 2, 2025, including social scoring, emotion recognition in workplace and educational contexts, and the untargeted scraping of facial images for recognition databases.

Canada – Artificial Intelligence and Data Act (AIDA)
Canada’s Artificial Intelligence and Data Act (AIDA), introduced under Bill C-27 in June 2022, failed in committee in 2025. As a result, Canada currently lacks dedicated federal AI legislation—despite more than $4.4 billion invested in national AI research infrastructure since 2017.

This pause represents a notable setback for a country that pioneered the world’s first national AI strategy.

The current Canadian landscape includes:

Forward outlook: New proposals are expected in 2026, likely adopting risk-based frameworks aligned with international standards.

In the interim, organizations operating in Canada should align internal controls with the NIST AI Risk Management Framework and EU AI Act principles. This approach provides defensive positioning against future Canadian requirements and reduces rework once legislation emerges.

United States – Regulatory Fragmentation
The United States has not enacted comprehensive federal AI legislation. Instead, governance continues through a decentralized model spanning federal guidance, agency enforcement, and state-level laws.

Federal layer

State layer

Compliance implication: Organizations must map obligations across agencies, states, and sectors. The NIST AI RMF has become the most practical unifying framework for multi-state operations and should be treated as required knowledge for compliance and risk teams.

Adopted by the Council of Europe and signed on September 5, 2024, the Framework Convention on Artificial Intelligence establishes binding governance principles grounded in human rights, democracy, and the rule of law.

Although not directly enforceable on corporations, the Convention—endorsed by more than 50 countries—signals accelerating convergence around transparency, accountability, risk assessment, and non-discrimination.

Strategic implication: Multinational organizations should treat the Convention as a preview of future regulatory harmonization pressures and reflect its principles in long-term compliance roadmaps.

Shadow AI—the unauthorized use of AI tools outside formal governance channels—has emerged as a critical enterprise risk. Recent security research indicates that 53% of shadow AI usage involves OpenAI services, impacting more than 10,000 enterprise users and concentrating risk around a single unmonitored platform.

Organizations should treat shadow AI as an enterprise-level governance issue rather than an IT nuisance. Effective mitigation requires coordinated technical and policy controls:

Overview
Regology is an AI-driven regulatory intelligence platform founded in 2017, designed to automate compliance monitoring across global jurisdictions.

Core capabilities

Relevance to AI governance
As AI regulations proliferate across jurisdictions with divergent timelines, Regology reduces manual monitoring effort and enables proactive compliance task assignment. Its AI engine aligns regulatory requirements with specific business operations, providing tailored, actionable guidance.

Best fit
Organizations operating across multiple jurisdictions or within highly regulated sectors where regulatory velocity creates operational risk.

Global regulators have converged on risk-based models that scale obligations according to potential societal impact. AI systems affecting employment, credit, healthcare, or law enforcement face significantly higher governance expectations than low-risk applications such as content recommendation or inventory optimization.

Implementation imperative
Organizations must establish internal AI risk classification methodologies that:

This approach enables efficient resource allocation, focusing intensive controls where regulatory and ethical exposure is greatest.

A centralized AI risk registry forms the backbone of scalable governance.

Core implementation steps

AI governance has transitioned from strategic consideration to operational necessity. With the EU AI Act entering primary enforcement in August 2026, organizations face immediate compliance deadlines for high-risk systems. Even in jurisdictions without comprehensive AI laws, enforcement through existing statutes and state-level regulations creates tangible legal exposure.

Organizations that invest now in structured, risk-based governance—AI inventories, classification frameworks, technical documentation, monitoring, and executive oversight—will gain regulatory resilience, stakeholder trust, and competitive advantage. The cost of proactive governance remains materially lower than reactive remediation under regulatory scrutiny.

Recommended immediate actions

— Editor, The AI Governance Brief