An Un-United Nations of AI

For organizations that use artificial intelligence across borders, the biggest challenge is not the technology. It is the Tower of Babel of regulations.

In Brief

The Problem. Washington, the states, Brussels, London, and Beijing regulate artificial intelligence (AI) on different philosophies and different calendars. For a healthcare or life sciences organization that operates in several jurisdictions, the divergence shapes product design, vendor selection, data strategy, and where AI is deployed first.

Why It Persists. The rules are still moving. The European Union postponed its high-risk obligations, Colorado rewrote its law, California added clinical AI laws, and federal preemption of state law is unresolved. Many boards wait for the rules to settle and leave the tracking to counsel.

What Boards Should Do. Set a regulatory risk appetite for AI, as the board sets a financial one. Choose and record a baseline standard, require each AI approval to list the jurisdictions and dates that apply, and name the person who monitors change and reports it.

For the chief executive of a multinational organization, the world of AI governance is beginning to look uncomfortably like the world of electrical plugs. There is a bewildering array of standards, and each is incompatible with the next. As regulators from Brussels to Beijing work to tame AI, they are creating a patchwork of rules that is complex and often contradictory. Managing that patchwork is becoming one of the larger challenges for corporate boards, with consequences for everything from product design to data strategy and global talent.

My argument is that boards should stop treating this divergence as a legal matter to be tracked by counsel and start treating it as a strategic choice the board itself must make and record. As of October 2026, three main philosophies, and one outlier, are clear.

The United States: Market-Led, With Pressure on the States

The first philosophy is America's market-led approach. Rather than passing a sweeping AI-specific statute, the country relies on a decentralized model in which existing regulators apply their current powers to AI. The Federal Trade Commission (FTC) can pursue a company for unfair or deceptive practices. In December 2023, it barred the retailer Rite Aid from using facial recognition for five years. The FTC alleged that the company deployed the technology without reasonable safeguards and that false matches led to customers being wrongly accused of theft; Rite Aid denied wrongdoing (Kelley, 2023). The Securities and Exchange Commission (SEC) can pursue misleading claims about AI capabilities. In March 2024, it settled charges against two investment advisers over false statements about their use of AI (U.S. Securities and Exchange Commission, 2024).

Federal policy itself has reversed course. Executive Order 14110 of October 30, 2023, was revoked by Executive Order 14179 on January 23, 2025 (Exec. Order No. 14179, 2025). The National Institute of Standards and Technology (NIST) AI Risk Management Framework, released on January 26, 2023, remains intended for voluntary use (National Institute of Standards and Technology, n.d.). The emphasis is on fostering innovation, with intervention when harm occurs.

The states have filled the space, and the result is a legal patchwork in which an AI tool acceptable in one state may violate the law of another. Colorado repealed and replaced its 2024 AI Act with Senate Bill 26-189, signed on May 14, 2026, and effective January 1, 2027. Health care services remain a covered domain. Entities covered by the Health Insurance Portability and Accountability Act (HIPAA) are exempt from many duties but must give patients a general notice (Darch et al., 2026). California's Assembly Bill 1979 requires facilities to ensure that a licensed provider uses independent judgment when AI informs care. Its Senate Bill 503 requires developers and deployers of clinical decision support to identify tools that could produce biased results, and requires deployers to monitor them. Both take effect on January 1, 2027 (Montano & Tran, 2026).

Washington now pushes in the other direction. The executive order of December 11, 2025, directed the Department of Justice (DOJ) to form an AI Litigation Task Force to challenge state AI laws. It also directed the Department of Commerce to identify state laws it considers "onerous" (Bridges et al., 2025). On April 24, 2026, the DOJ moved to join a suit by xAI challenging the original Colorado Act (Cooper et al., 2026). Whether federal action will displace state law remains unresolved. The American model offers flexibility, but it also leaves boards to comply with state law as written while its future is contested.

The European Union: A Prescriptive, Risk-Based Law

The second, and most influential, philosophy comes from the European Union. The European Commission describes the AI Act as the first comprehensive legal framework on AI anywhere. It sorts AI systems by risk. Practices of unacceptable risk, such as social scoring, have been banned since February 2, 2025. High-risk uses, such as software that sorts job applications or scores creditworthiness, must meet requirements before they reach the market. The requirements include risk assessment and mitigation, high-quality data sets, logging, detailed documentation, human oversight, and accuracy and cybersecurity (European Commission, n.d.).

In 2026, the EU postponed the high-risk duties. Under the Digital Omnibus on AI, Regulation (EU) 2026/1744, standalone high-risk systems face them from December 2, 2027. AI embedded in regulated products, including medical devices, follows on August 2, 2028 (Addleshaw Goddard, 2026; Hunton Andrews Kurth, 2026). The postponement gives manufacturers time, not relief.

Because the EU market is large, its rules tend to travel. This pattern is often called the "Brussels effect." A global pharmaceutical manufacturer, for instance, may find it more efficient to develop its AI for drug discovery to the EU's standard and make that standard its global policy, rather than maintain separate versions by region. In that way, European standards reach companies in America and Asia.

The United Kingdom: A Middle Course

The third approach is the United Kingdom's, which tries to chart a middle course between America's light touch and the EU's heavier hand. The country still has no standalone AI legislation. Instead, its existing regulators apply five cross-sector principles from the government's April 2023 white paper: safety, security, and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. A private member's bill introduced in the House of Lords on March 4, 2025, lacks government support (Herbert Smith Freehills Kramer, 2026).

For medical technology, the regulator is learning by testing. The Medicines and Healthcare products Regulatory Agency (MHRA) runs a regulatory sandbox, the AI Airlock. Its second phase tested seven AI technologies from April 2025 to March 2026, and the government has committed 1.2 million pounds a year for 2026 to 2029 to fund a third phase (Bowden, 2026). The goal is flexibility without the EU's administrative burden. The risk is that risk-averse investors may read that flexibility as uncertainty, and the public may read it as an insufficient guarantee of safety.

China: The Outlier

The outlier is China. Its approach is centralized and state-led, and its primary concerns are national security and social stability. It regulates through targeted measures rather than one law. Rules on algorithmic recommendation took effect on March 1, 2022, rules on "deep synthesis" (including deepfakes) on January 10, 2023, and interim measures on generative AI on August 15, 2023. They require providers to uphold "core socialist values," and providers whose services can shape public opinion must complete security assessments and file their algorithms with the regulator (Ferguson et al., 2023). Since September 1, 2025, AI-generated content must carry visible labels and embedded metadata (Sun, 2025).

For life sciences, the harder questions concern data. Data generated in China may not be free to leave. Exporting personal information of one million or more people, or sensitive personal information of 10,000 or more, requires a security assessment by the Cyberspace Administration of China. Clinical and genetic data are generally treated as sensitive. Exporting human genetic resource materials requires prior approval, and foreign parties must work through a Chinese partner. A draft published by the National Health Commission on May 8, 2026, would narrow some of these rules, but it is not yet in force. The United States now restricts the flow in the other direction as well. A DOJ rule effective April 8, 2025, limits bulk transfers of genomic and health data to countries of concern, including China. Counsel now advise keeping high-volume data in the country and analyzing it there (Liao et al., 2026).

The map keeps widening. South Korea's AI Basic Act took effect on January 22, 2026. It names healthcare among the sectors where AI is "high-impact," requires explanation, human oversight, and advance notice to users, and can reach foreign providers whose systems affect Korean users (Cooley, 2026).

Where the Regulators Converge: Medical Products

On one question, the largest regulators are moving together. The Food and Drug Administration (FDA) issued draft guidance in January 2025 on using AI to support regulatory decisions for drugs and biological products. It proposes a risk-based framework for establishing a model's credibility for its context of use, and it remains a draft (U.S. Food and Drug Administration, 2025). On January 14, 2026, the FDA and the European Medicines Agency jointly issued ten guiding principles for AI in drug development (Al-Faruque, 2026). Boards overseeing submissions that rely on AI-generated evidence should ask how management applies both documents now.

What Divergence Costs the Board

Global divergence carries real operational cost. It requires lawyers and data specialists to map which rules apply to which system in which place. A system developed in America might not be lawful in Europe as built. A feature might have to be geofenced, available to American patients but blocked for German ones. The divergence forces a strategic choice.

One option is to build different AI systems for different markets, which is expensive and inefficient. The other is to adopt a single global standard, most often the EU's, as the internal baseline. That baseline gives a consistent framework and covers most developed markets. It also means carrying the EU's compliance costs everywhere. Neither option solves the China problem, which requires its own data environment.

The Strongest Objection: Wait for the Rules to Settle

A reasonable director might argue that the board should wait. The EU has just postponed its high-risk dates. Colorado rewrote its law before it took effect. Federal preemption could displace state law altogether. On this view, a board that builds to today's rules will pay twice.

The argument underestimates how many dates are already fixed. The Colorado and California laws take effect on January 1, 2027. South Korea's law is in force. China's data rules apply today, and so does the DOJ rule on bulk health data. Preemption is a possibility, not a holding. Waiting is itself a choice about regulatory risk, and it is usually an unrecorded one. A board can avoid paying twice by choosing a baseline that meets the strictest likely standard for its highest-risk uses, and by revisiting that choice on a schedule rather than when a deadline arrives.

A Regulatory Risk Appetite

To manage divergence, boards need a multi-jurisdictional view of AI risk. They should set a regulatory risk appetite for AI, just as they set a financial one. It should state where the organization will deploy first, which standard it treats as its baseline, which markets it will enter only with separate systems, and who monitors change.

I would add one discipline. Each AI approval should list the jurisdictions where the system will operate and the dates that apply in each. A calendar on paper is easier to oversee than a set of moving rules held in someone's head. The organizations that do well will be those with sound technology and an equally deliberate regulatory strategy.

For the Board

• Which state, federal, and international rules apply to each AI deployment, and from what dates?
• Are we complying with Colorado, California, and other state laws as written, rather than waiting for federal preemption?
• Have we chosen a baseline standard for AI governance across jurisdictions, and is the choice recorded?
• Where do patient, clinical, or genetic data cross borders, and which approvals does each transfer require?
• For submissions that rely on AI, how are we applying the FDA draft framework and the joint FDA and European Medicines Agency principles?
• Who monitors regulatory change and reports it to the board, and how often?

See what applies where with the jurisdiction view, available from November 2026, in the Avancer AI Governance Navigator.

References

Addleshaw Goddard. (2026, July 1). EU AI Act: AI Omnibus formally adopted. https://www.addleshawgoddard.com/en/insights/insights-briefings/2026/technology/eu-ai-act-ai-omnibus-formally-adopted/

Al-Faruque, F. (2026, January 14). EMA, FDA issue joint AI guiding principles for drug developers. Regulatory Affairs Professionals Society. https://www.raps.org/resource/ema-fda-issue-joint-ai-guiding-principles-for-drug.html

Bowden, H. (2026, June 9). Advancing AI regulation in healthcare: Insights from AI Airlock Phase 2. MedRegs. Medicines and Healthcare products Regulatory Agency. https://medregs.blog.gov.uk/2026/06/09/advancing-ai-regulation-in-healthcare-insights-from-ai-airlock-phase-2/

Bridges, V. K., Christensen, G. S., Doyle, M. F., Fulton, F., Gelbman, S. J., Jain, V. M., Lawless, T. L., & Marotta, M. (2025, December 15). President Trump signs executive order limiting state power to regulate artificial intelligence. K&L Gates. https://www.klgates.com/President-Trump-Signs-Executive-Order-Limiting-State-Power-to-Regulate-Artificial-Intelligence-12-15-2025

Cooley. (2026, January 27). South Korea's AI Basic Act: Overview and key takeaways. https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways

Cooper, A. R., Weaver, W., Cease, C., & Ramsey, A. R. P. (2026, April 29). DOJ joins xAI in lawsuit challenging Colorado AI Act. Jenner and Block. https://www.jenner.com/en/news-insights/client-alerts/doj-joins-xai-in-lawsuit-challenging-colorado-ai-act

Darch, J. E., Brooks, P., Daudi, S., Hinckley, D., & Kaye, A. (2026, May 19). Colorado scales back AI law, with targeted implications for health care. Ropes and Gray. https://www.ropesgray.com/en/insights/alerts/2026/05/colorado-scales-back-ai-law-with-targeted-implications-for-health-care

European Commission. (n.d.). AI Act. Shaping Europe's Digital Future. Retrieved October 21, 2026, from https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

Exec. Order No. 14179, Removing barriers to American leadership in artificial intelligence. (2025, January 23). Daily Compilation of Presidential Documents, DCPD-202500170. https://www.govinfo.gov/content/pkg/DCPD-202500170/html/DCPD-202500170.htm

Ferguson, C., He, J., & Kim, D. (2023, August 29). China's new rules for generative AI: An emerging regulatory framework. Fasken. https://fasken.com/en/knowledge/2023/08/chinas-new-rules-for-generative-ai

Herbert Smith Freehills Kramer. (2026). AI tracker: UK. Retrieved October 21, 2026, from https://www.hsfkramer.com/insights/reports/ai-tracker/uk

Hunton Andrews Kurth. (2026, July 28). EU Digital Omnibus on AI enters into force. Privacy and Cybersecurity Law Blog. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force

Kelley, A. (2023, December 21). FTC bans Rite Aid from using AI facial recognition for 5 years. Nextgov/FCW. https://nextgov.com/artificial-intelligence/2023/12/ftc-bans-rite-aid-using-ai-facial-recognition-5-years/392959

Liao, T., He, M., & Hu, S. (2026, May 15). Strategic compliance: Navigating HGR and data risks in China life sciences transactions. Morgan Lewis. https://www.morganlewis.com/pubs/2026/05/strategic-compliance-navigating-hgr-and-data-risks-in-china-life-sciences-transactions

Montano, M., & Tran, S. (2026, October 8). Newsom approves 3 health care AI bills, vetoes 2. California Health Care Foundation. https://chcf.org/blog/2026/10/08/newsom-approves-3-health-care-ai-bills-vetoes-2

National Institute of Standards and Technology. (n.d.). AI risk management framework. Retrieved October 21, 2026, from https://www.nist.gov/itl/ai-risk-management-framework

Sun, J. (2025, March 31). China's AI labeling measures and mandatory national standards take effect September 1. Loeb and Loeb. https://www.loeb.com/en/insights/publications/2025/03/chinas-ai-labeling-measures-and-mandatory-national-standards-take-effect-september-1

U.S. Food and Drug Administration. (2025). Considerations for the use of artificial intelligence to support regulatory decision-making for drug and biological products (Draft guidance; Docket No. FDA-2024-D-4689). Retrieved October 21, 2026, from https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological

U.S. Securities and Exchange Commission. (2024, March 18). SEC charges two investment advisers with making false and misleading statements about their use of artificial intelligence [Press release]. https://www.sec.gov/newsroom/press-releases/2024-36