For organizations that use AI across borders, the hardest part of AI governance is not the technology. It is the divergence of the rules, and the board should set a regulatory risk appetite for it.