The Policy Landscape Reshaping the Market

The AI industry is building at a pace that regulators have never faced before. The EU AI Act — the world’s first comprehensive AI legislation — took four years to draft. In those four years, GPT-3, GPT-4, ChatGPT, open-source parity, and the agentic revolution all happened. Regulation is chasing a target that moves at 1,000x per cycle.

This chapter examines three fundamentally different approaches to AI governance and their strategic implications for enterprises operating across jurisdictions. The EU has chosen prescriptive, risk-based regulation — classifying AI systems by risk tier and imposing compliance obligations that scale with potential harm. The United States has opted for sectoral regulation — relying on existing agencies (FDA, SEC, FINRA, EEOC) to apply domain-specific rules to AI within their mandates, with no overarching federal AI law. China has pursued state-guided governance — requiring algorithm registration, content watermarking, and alignment with “socialist core values,” while simultaneously funding massive AI development through state-owned enterprises.

For enterprise strategists, the regulatory landscape creates three distinct pressures. First, compliance costs that vary by jurisdiction and risk tier — early estimates suggest €5–15M for large enterprises to achieve EU AI Act compliance, with ongoing costs of €1–3M annually. Second, adoption timeline impacts — heavily regulated sectors (healthcare, financial services, employment) will see slower agentic AI deployment than lightly regulated sectors (marketing, internal operations). Third, competitive dynamics — regulation can function as either a moat (protecting incumbents who can afford compliance) or a barrier (excluding startups who cannot). Understanding which effect dominates in each sector is critical to strategic positioning.

The GPAI Challenge: Open Source Under Pressure

The EU AI Act’s General-Purpose AI (GPAI) provisions create a new compliance category that directly affects the open-source ecosystem analysed in Chapter 15. GPAI model providers must publish detailed model documentation including training methodologies, evaluation results, and known limitations. Models classified as posing “systemic risk” — generally those trained with more than 10^25 FLOPs — face additional obligations including adversarial testing, incident reporting, and cybersecurity measures.

The open-source exemption remains contested. The Act provides a partial exemption for open-source models released under permissive licences, but this exemption does not apply to GPAI models with systemic risk. This means Meta’s Llama, DeepSeek, and Alibaba’s Qwen — all open-weight models that may exceed the FLOP threshold — could face the same obligations as closed models from OpenAI and Anthropic. The strategic implication: the EU’s regulatory framework may inadvertently slow the open-source commoditization dynamic that Chapter 15 identified as a fundamental market force.

The State-Level Patchwork

In the absence of comprehensive federal legislation, US states have become the primary AI regulatory laboratory. Over 40 states introduced AI-related bills in 2024–2025. The most significant:

• Colorado AI Act (signed May 2024, effective Feb 2026): First comprehensive US state AI law. Requires developers and deployers of “high-risk” AI systems to implement risk management, conduct impact assessments, and provide consumer disclosure. Focuses on AI decisions that materially affect access to education, employment, financial services, healthcare, housing, and insurance.
• NYC Local Law 144: Requires annual bias audits for automated employment decision tools. Sets precedent for hiring AI regulation.
• California: Multiple bills targeting deepfakes, AI transparency, and automated decision-making. SB 1047 (vetoed in 2024) would have imposed safety requirements on large AI models; similar proposals continue.
• Illinois, Texas, Virginia: Various bills addressing AI in employment, insurance underwriting, and consumer protection.

For enterprises operating nationally, the state patchwork creates compliance complexity comparable to data privacy before GDPR. A single AI system used for hiring across 50 states may need to comply with different audit requirements, disclosure obligations, and appeal mechanisms in each jurisdiction. This fragmentation is a structural advantage for large enterprises with legal teams and a significant barrier for startups deploying AI nationally.

China’s regulatory approach creates a unique dynamic: the state simultaneously funds massive AI development (through entities like the National Integrated Circuit Industry Investment Fund) and constrains its deployment through content and values requirements. The practical effect is a two-tier system. For enterprise and industrial applications — manufacturing optimisation, logistics, scientific computing — regulation is permissive. For consumer-facing applications involving content generation, recommendation, or social interaction, regulation is prescriptive and politically constrained.

This bifurcation explains why Chinese AI companies like DeepSeek (Chapter 15) have focused their open-source releases on base models and infrastructure rather than consumer-facing products. The base models can be deployed globally without triggering Chinese content regulations, while domestic deployments must go through CAC security assessments. For multinational enterprises, the implication is clear: AI systems deployed in China must be architected for Chinese data sovereignty requirements from the ground up, not retrofitted from Western deployments.

The Safety Framework Landscape

Alongside binding regulation, voluntary frameworks and international standards are emerging as the de facto compliance baseline for enterprises that operate globally:

• NIST AI Risk Management Framework (AI RMF 1.0): The most widely adopted voluntary framework. Organised around four functions: Govern, Map, Measure, Manage. Used by US federal agencies and increasingly by private sector as compliance benchmark.
• ISO/IEC 42001: First international standard for AI management systems. Published December 2023. Provides certification path for enterprises demonstrating responsible AI practices.
• Frontier Model Forum: Industry consortium (OpenAI, Anthropic, Google, Microsoft) committing to safety testing, red-teaming, and responsible deployment practices.
• UK Bletchley Declaration: 28 countries committed to AI safety cooperation. UK AI Safety Institute established as testing body. Pro-innovation approach: no binding legislation, focus on frontier model evaluation.

What Comes Next

Regulation is one dimension of the external forces shaping AI adoption. The other is geopolitics. Chapter 25 examines how the US-China technology competition, export controls, sovereign AI initiatives, and supply chain dependencies are fragmenting the global AI stack into competing ecosystems — creating strategic choices that enterprises cannot avoid.