AI, Regulation, Geopolitics and Global Competition

Picture the one-page AI rules calendar that the legal team of a retailer selling in Europe, the United States and South Korea might have put in front of its board in January 2026. Every date on it was the official date at the time. The page itself is a mock-up; the dates are not.

By October, three of the five rows were wrong. The sharpest change was in Europe. The high-risk duties for systems used in hiring, credit and essential services had been due on 2 August 2026. A regulation amending the AI Act entered into force on 27 July 2026, six days earlier, and moved them to 2 December 2027¹. In Colorado, the first US state law aimed at algorithmic discrimination was replaced before it ever took effect². In Washington, the White House was asking Congress to override state AI laws altogether³.

None of this was treated as a crisis. It was the year’s normal motion, and for a company using AI across borders the outside world is a moving input to the plan.

Two forces, not one

Executives often fold everything external into one word, regulation. It helps to separate two forces, because they behave differently and call for different responses.

Rules are laws, regulations and binding guidance about what you may do in a market, usually for a particular use: telling people they are talking to a machine, labeling a generated image, auditing a hiring tool. They arrive with dates, drafts and consultations, even when the dates later move.

Access is the supply side: whether you can buy the chips, rent the compute, use a given model, keep data in a given place or sell in a given country. Trade policy and national security decisions shape it, and they can arrive by announcement. Export controls are themselves law, so the two overlap, but they ask different questions. Rules ask “are we allowed?” Access asks “will we still have it?”

Four rulebooks, not one

There is no global AI law. Four approaches show the range a company operating internationally faces in 2026, and they rest on different ideas of what the problem is.

The European Union has a single statute, the AI Act, which sorts systems by risk and assigns duties by role: provider or deployer⁴. Its obligations for general-purpose model providers, described in The Evolution of AI Models, are only one layer of it.

The United States has no federal AI statute. The rules that bite are state and city laws, such as New York City’s bias-audit rule for hiring tools, plus sector regulators. Federal policy is now pulling the other way: Executive Order 14365 of December 2025 set up a Justice Department task force to challenge state AI laws, and the March 2026 National Policy Framework asked Congress to preempt “burdensome” ones⁵³.

China regulates generative AI services offered to the public, which need security assessment and filing. Since 1 September 2025, generated text, images, audio and video must carry both a visible label and a machine-readable one⁶.

South Korea’s AI Basic Act, in force since 22 January 2026, is a framework law in the EU’s spirit but lighter: notice of AI use and AI-generated content, extra duties for high-impact uses such as hiring and credit, and a local representative for foreign providers⁷.

A Council of Europe treaty on AI and human rights sits above all four, but it binds only countries that ratify it⁸.

The calendar moves

The second lesson of the hook is that the legal calendar is not fixed. The EU’s own timeline shows how much has changed since the Act entered into force in August 2024.

The amendment, known as the Digital Omnibus on AI, also added two prohibited uses and softened the AI-literacy duty. It kept the transparency duties at 2 August 2026, with one short transition: generative systems already on the market have until 2 December 2026 for machine-readable marking¹⁹. A company that had paused all work waiting for the Act to “settle” would have missed the dates that did not move.

The US pattern is different. Executive orders and frameworks signal direction, but they are not statutes, and they do not repeal state laws. Until Congress or the courts act, New York City’s hiring rule still applies, and Colorado’s replacement law takes effect on 1 January 2027². A preemption push is a reason to watch, not a reason to stop complying.

Classify the use, market by market

The practical consequence of four rulebooks is that the same feature carries different duties in different markets. A risk classification, as AI Inventory and Risk Classification in Module 07 set out, tells you how dangerous a use is. A market map tells you what each jurisdiction requires of it.

Two things stand out. The duties attach to the use, not the model: the same model behind a product-copy tool and a hiring screen produces two very different compliance burdens. And the duties cluster. Disclosure and labeling now appear in three of four rulebooks, while hiring tools are treated as high-risk or high-impact almost everywhere they are regulated. Those clusters are where one design can serve many markets.

Geopolitics: access, not permission

The second force is harder to see from a retailer’s head office, because it usually arrives through suppliers. The clearest example is advanced chips.

In January 2025 the US government issued a rule to license advanced chips worldwide in three tiers of countries. It was rescinded in May 2025, before it applied, while controls on China continued¹⁰. In April 2025 Nvidia was told it needed a license to sell its H20 chip to China, and booked a 4.5 billion dollar charge for inventory it could no longer sell¹¹¹². In December 2025 the President announced that H200 chips could be sold to approved Chinese customers with a quarter of the revenue going to the US government, and in January 2026 the Commerce Department moved to case-by-case review¹³¹⁴.

A retailer does not export chips. But it rents the compute those chips provide, so the cost and capacity it can buy depend on these decisions. The same is true of models: whether a given model can be used depends on the country, and its provider can change that. The model you build on is part of your market access.

Governments call the control of these things sovereignty. For a company it comes down to six questions about each critical AI capability: where the data is stored and processed, under whose law the model provider operates, where the compute runs, where the chips come from, which market rules apply, and what the tested alternative is if the model vanished from one market tomorrow.

Build once where rules agree, switch where they conflict

How should a product team respond to four rulebooks and unstable access? The legal scholar Anu Bradford named one answer the Brussels effect: firms selling into the EU often adopt its rules everywhere, because one global standard is cheaper than several¹⁵. That works when the rules point the same way. It fails when they conflict.

Labels and disclosures are the clearest build-once case. Telling a customer that the assistant is an AI, and marking generated images visibly and in metadata, satisfies the EU, Korea and China at once, and costs little more than doing it for one market. Bias audits for hiring tools are a strictest core with local extras: test once to a high standard, then publish or file in the form each jurisdiction asks for.

Market switches are for genuine conflicts. A model that is not available in a market, a data path that may not cross a border, or a filing that a foreign service cannot make all call for a different configuration by market, not one design for all. And sometimes the cost of a separate stack is high enough that the right answer is to stay out of a market for that use. That is a board decision, and it should be made explicitly. How to keep a tested path to a second provider is covered in Model and Third-Party Risk, Module 06; it is the precondition for every switch.

Story: an assistant that reached Europe eighteen months late

Meta launched its AI assistant, Meta AI, inside WhatsApp, Messenger and Instagram in the United States in September 2023¹⁶. People in the European Union did not get it until March 2025, and then only in part. The eighteen months in between show both forces of this chapter acting on one product.

The first force was rules. In June 2024 Meta planned to train its models on public posts by adult Facebook and Instagram users in the EU. Ireland’s Data Protection Commission, its lead regulator, raised concerns on behalf of other European authorities, and Meta paused the training¹⁷. Meta called the pause “a step backwards for European innovation”¹⁸. When the assistant arrived in 41 European countries in March 2025, it offered text chat only, in six languages¹⁹. In May 2025 the regulator said it would not stop training from 27 May, after Meta had sent new notices to users, made its objection form easier to find and lengthened the notice period¹⁷. What unlocked the market was notice, a way to say no and documentation: the disclosure-and-control cluster that can be built once.

The second force was access, and here Meta was the one deciding. In July 2024 it said it would release a multimodal Llama model “but not in the EU due to the unpredictable nature of the European regulatory environment”²⁰. When Llama 3.2 appeared in September 2024, its license did not grant the right to use the multimodal models to individuals or companies based in the EU²¹. A European company building on an openly licensed model found the vision versions closed to it, not by a statute but by its provider’s reading of the rules.

Read the case through the floor-or-switch matrix. Meta ran different configurations by market: the full assistant in the United States, text chat only in Europe, and a model license with an EU carve-out. Those were explicit, company-level decisions about where to switch and where to stay out, and their price was time. The outside world, not the product plan, set the European timetable. For a company that uses AI rather than builds it, the lesson runs the other way too: the model you build on can come with its own map of where you may use it, and that map can change.

What this means for leaders

The argument comes down to four habits. Separate the two forces: for each critical AI capability, ask what the rules require and what could cut off access, and give the two questions different owners. Keep a market map rather than a global answer, classifying each use in each market and updating it when a dated duty arrives or moves. Build to the clusters, making disclosure, labels and logs standard everywhere and keeping switches and separate stacks for genuine conflicts. And treat preemption and policy swings as signals, not exemptions: comply with what is in force, and watch what is coming.

Check yourself

1. The EU AI Act’s high-risk duties for hiring systems have applied since August 2026.MythFact
2. A US executive order can, by itself, cancel a state AI law.MythFact
3. The same AI feature can carry different legal duties in different markets.MythFact
4. Chip export controls matter only to chipmakers and cloud providers.MythFact
5. Building to the strictest rule everywhere is always the cheapest approach.MythFact
6. Both China and the EU now require AI-generated content to be labeled.MythFact

Reflection: draw your own calendar

What comes next

Rules move, access swings, and neither can be forecast with confidence. Leaders still have to commit money and people now. The next chapter, Preparing for AI Uncertainty and Strategic Change, turns that uncertainty into a planning discipline: how to decide when capabilities, costs, rules and competitors are all changing faster than the annual plan.