AI Policy & Regulation
There is no global AI rulebook coming, only overlapping regimes moving at different speeds. We work on the architecture that lets governments enforce, and enterprises deploy, under all of them at once.
The sovereign stake
Ministers now face a live choice between three regulatory models (the EU's comprehensive statute, Washington's litigation-led deregulation, and China's rapid, narrow rulemaking), while their own deadlines keep moving. In the Gulf the stakes are sharper. The UAE's new Federal Authority for Artificial Intelligence and Data must publish the PDPL's long-awaited executive regulations and make federal supervision work alongside the DIFC's and ADGM's independent regimes. SDAIA is already issuing PDPL enforcement decisions. Qatar governs AI through data and cyber law rather than a dedicated statute. Get the institutional design right and regulation becomes an attraction strategy for compute, capital and talent. Get it wrong and you inherit Europe's compliance costs without Europe's market.
The board-level stake
If you deploy AI in more than one jurisdiction, you are already a multi-regime operator: the only question is whether your architecture knows it. GPAI transparency duties become enforceable in the EU from August 2026. DIFC Regulation 10 already demands system registers, notices and human-intervention triggers. State laws in Colorado, Texas and California are in force whatever the US preemption fight eventually decides. Boards should fund one governance architecture (inventory, logging, evaluation, incident response, mapped to ISO/IEC 42001), not one programme per statute. The cheapest compliance is the kind that falls out of systems built to be auditable in the first place.
Do not mistake Brussels' delay for retreat. The May 2026 omnibus agreement pushed the AI Act's Annex III high-risk obligations to December 2027, but the Commission's penalty powers over general-purpose model providers still arrive on 2 August 2026, and transparency duties become enforceable the same day.
The deferral moved two of these dates and none of the others. The obligations that arrive first are the ones on general-purpose models, which is the opposite of how the delay is being read. Liability under existing law was never on this calendar at all.
The deferral happened because the harmonised standards were not ready: CEN-CENELEC could not deliver the technical backbone in time. That is the real lesson: the binding constraint on AI regulation is now engineering, not politics. Deployers who spend the extra sixteen months on paperwork will arrive in 2027 no more ready than they are today. Those who build logging, evaluation and human-oversight infrastructure now will find that compliance falls out of good architecture, not the reverse.
The United States has chosen fragmentation by combat. Executive Order 14365 sent the Department of Justice to court against state AI statutes, while Colorado, Texas and California pressed ahead regardless, since an executive order cannot preempt a statute, and Congress has not supplied one. China, meanwhile, ships narrow binding rules at pace; its AI content-labelling regime has been enforceable since September 2025. The UK has quietly pivoted from a flagship AI bill to regulator-led standards for deployment. The result is not a race to the bottom but a race to different bottoms. Harmonisation is not coming this decade. Interoperability, meaning one governance architecture mapped to many rulebooks, is the only strategy that survives contact with reality.
The Gulf is the most instructive patchwork we work on. The UAE alone runs three data regimes: a federal PDPL whose executive regulations remain unpublished, DIFC's Regulation 10 (among the first binding AI-specific data rules anywhere, with deployer and operator duties and an autonomous systems officer), and ADGM's GDPR mirror.
The Federal Authority for Artificial Intelligence and Data, announced in June 2026, is the hinge: if it publishes the PDPL regulations and stands up real supervision in its first year, the UAE converts regulatory ambiguity into regulatory product. Saudi Arabia's SDAIA is already enforcing its PDPL and consulting on a Global AI Hub Law built around data embassies. The Gulf's bet is that speed plus credible institutions beats comprehensive statutes. It can work if the Authority publishes the PDPL regulations and issues its first enforcement decisions within the year.
Strip away the drafting differences and every serious regime demands the same artefacts: a system inventory, documented intended purpose, logging, human oversight that actually functions, incident reporting, and evidence you can produce under scrutiny. That is not a legal agenda; it is an engineering one. It is also precisely the discipline we have called Complex AI since 2019: AI operating inside multi-objective, high-stakes, real-world systems, traceable and auditable by construction.
Every regulator is reaching for the same gap in different vocabulary: the distance between a model that performs and an institution that can answer for it. Institutions that close it themselves, before an auditor, a court or a minister asks, will treat regulation as a moat. The rest will treat it as a fire drill.
- When the EU's high-risk obligations land in December 2027, will the harmonised standards they depend on actually exist, and what should deployers build against in the meantime?
- Can the UAE's new Federal Authority for Artificial Intelligence and Data turn three data regimes into one credible enforcement posture without losing the speed advantage?
- If US federal preemption fails in the courts, what does a fifty-state compliance architecture cost, and who can afford it?
- Which artefacts (inventories, logs, oversight records, incident reports) satisfy the largest number of regimes for the least engineering spend?
- How do Gulf states convert regulation into competitiveness, via data embassies, certification, adequacy, rather than importing the EU's compliance costs without its market size?
Fellows for this frontier are being appointed.
People who have built, governed or operated real systems in this domain. The first five fellows are named, and the rest of the founding cohort follows in September.
Have you done this at scale in AI Policy & Regulation? We want to hear from you.
Put yourself forward