Global AI Regulation: EU, US, China, UK, and APAC Side-by-Side
Five major regulatory regimes differ in scope, risk classification logic, and enforcement mechanism, but converge on audit logging, access controls, and clear accountability for AI system behavior. Enterprises operating across jurisdictions need an internal framework that maps deployed AI agents against each regime's requirements individually, rather than assuming uniform obligations across regions.
Why a Direct Comparison Requires a Common Framework
The EU, US, China, UK, and APAC do not classify or enforce AI obligations against a shared taxonomy. Some regimes assign obligations based on where a system falls within a defined risk hierarchy. Others apply rules by sector, by use case, or through general principles enforced case by case.
Because of this, a feature-by-feature comparison drawn from secondary summaries can be misleading if treated as current law. The comparison below describes each regime's structural character, its general orientation, and the type of question an enterprise needs to answer for that jurisdiction.
Important: Specific thresholds, dates, penalties, and certification requirements change frequently. Confirm all details directly against each regulator's current published text before using this comparison to set compliance timelines or design controls.
Five Regimes at a Glance
Each regime approaches AI governance through a different structural lens. Understanding that structural character is the first step to building a cross-jurisdictional compliance program.
European Union AI Act
Risk-tiered obligations tied to system classification and conformity evidence. High-risk systems face mandatory documentation, conformity assessment, and post-market monitoring before and after deployment.
United States
Federal guidance layered with a growing state-by-state patchwork of AI laws. No single comprehensive federal statute yet. Agencies apply existing sector rules; several states have enacted or proposed standalone AI obligations.
China
Regulation centered on algorithms, generated content, and security review processes. Distinct rules govern recommendation algorithms, deep synthesis (deepfakes), and generative AI services, each with specific registration or filing requirements.
United Kingdom
A principles-based approach enforced through existing sector regulators rather than a single AI-specific statute. Regulators are expected to apply cross-sector principles within their existing mandates.
Asia-Pacific
Distinct national frameworks rather than one unified regional regime. Singapore, Japan, South Korea, and Australia have each developed their own guidance, voluntary frameworks, or binding rules at different stages of maturity.
Structural Comparison Across Jurisdictions
The table below compares five structural dimensions across regimes. These dimensions are the most consequential for enterprise compliance program design.
| Dimension | EU AI Act | US (Federal + State) | China | UK | APAC (Selected) |
|---|---|---|---|---|---|
| Classification logic | Tiered risk model (unacceptable, high, limited, minimal) | Sector-based; use-case specific at state level | Use-case and content type (algorithms, generative AI, deep synthesis) | Principles-based; no formal classification tiers | Varies by country; some tiered, some voluntary |
| Enforcement mechanism | Pre-deployment conformity assessment; market surveillance | Agency enforcement of existing rules; state-level penalties emerging | Government-led registration, security review, and filing requirements | Regulator-driven investigation of outcomes under existing powers | Mix of voluntary guidance and binding sector rules |
| Audit and record-keeping | Mandatory logging for high-risk systems; defined retention | Varies by agency and state; no uniform federal standard yet | Required for certain algorithm and generative AI operators | Expected as part of demonstrating accountability; no fixed format | Ranges from recommended practice to required by sector |
| Accountability model | Named provider and deployer roles with distinct obligations | Accountability through existing product liability and sector rules | Operator registration and named responsible parties | Board-level and senior manager accountability expected | Varies; Singapore and Australia have published formal guidance |
| Extraterritorial scope | Applies to systems placed on the EU market or affecting EU persons | State laws vary; federal rules generally follow sector jurisdiction | Applies to services offered to users in China regardless of provider location | Broadly applies to UK market activity | Generally limited to domestic jurisdiction |
Where the Frameworks Converge
Despite their structural differences, several technical and governance expectations recur across risk-based regimes:
- Audit logging and traceability appear as recurring technical expectations, though retention periods and scope of what must be logged differ by regime.
- Accountability for AI system behavior is a common governance theme, even where it is expressed differently (named roles versus board accountability versus operator registration).
- Access controls are implicitly or explicitly required to protect system integrity and restrict unauthorized modification or use.
- Transparency toward affected persons is a shared principle, expressed through disclosure requirements in some regimes and through outcome-oriented principles in others.
Enterprises should treat audit logging and access control as baseline capabilities that any of the five regimes could reasonably require. Record-keeping should be designed to meet the most demanding applicable requirement once that requirement is confirmed for each jurisdiction, rather than building separate logging standards per region.
Where the Frameworks Diverge
The most consequential differences for compliance program design fall into two areas.
Enforcement timing: before or after deployment
A regime built on pre-deployment conformity assessment, such as the EU AI Act for high-risk systems, requires evidence to exist before a system goes live. Documentation, testing records, and conformity declarations must be in place prior to market placement. A regime built on post-deployment market surveillance or outcome-based investigation, such as the UK model, places more weight on the enterprise's ability to reconstruct system behavior after the fact. The operational implication is significant: pre-deployment regimes favor investment in documentation workflows and pre-launch review gates; post-deployment regimes favor investment in durable logging infrastructure and investigative readiness.
Classification logic: tier, sector, or principle
Tiered risk models require an internal process to determine and document a system's tier, typically before deployment. Sector-based models require mapping AI use cases to existing sector rules, which may already have documentation, testing, or disclosure requirements embedded in them. Principles-based models require demonstrating that outcomes meet stated expectations rather than meeting a fixed checklist, which shifts the compliance burden toward evidence of governance process and outcome monitoring rather than pre-defined deliverables.
Questions to Answer Before Building a Cross-Jurisdiction Compliance Program
Before designing controls or assigning compliance resources, governance teams should answer the following questions for each jurisdiction in scope:
- Does the jurisdiction apply a tiered risk model, a sector-based model, or a principles-based model, and which tier or sector applies to each deployed system?
- Is the primary enforcement mechanism pre-deployment assessment, post-deployment surveillance, or regulator-initiated investigation?
- What record-keeping is required, what must be retained, and for how long?
- Who is the named accountable party under this regime, and does that role map to an existing internal function?
- Does the regime apply extraterritorially, and if so, does the enterprise's deployment model bring it within scope even without a local entity?
- How does the regime handle AI systems that cross risk categories or are used for multiple purposes?
Designing a Governance Architecture That Absorbs Regulatory Divergence
Because these five regimes will not converge on a shared taxonomy in the near term, the most durable enterprise approach is to build internal governance capabilities that are regime-agnostic at the infrastructure layer and regime-specific at the policy layer.
At the infrastructure layer, centralized audit logging, role-based access controls, and agent permission management provide a consistent evidence base regardless of which regulatory regime applies to a given deployment. These capabilities can be configured to meet the most demanding retention or traceability requirement in scope without duplicating the underlying architecture.
At the policy layer, each deployment should be mapped against the specific requirements of each applicable jurisdiction, using the classification logic and enforcement model of that regime. This mapping should be documented, reviewed periodically as regulations evolve, and linked directly to the audit records produced by the infrastructure layer.
This separation means that as new regimes emerge or existing ones are amended, the policy layer can be updated without rebuilding the technical foundation. It also means that a single compliance audit can produce jurisdiction-specific evidence from a shared record source, reducing the operational cost of multi-jurisdictional reporting.
Frequently Asked Questions
Does the EU AI Act apply to my organization if we are based outside the EU?
The EU AI Act applies to AI systems placed on the EU market or put into service in the EU, and to systems whose outputs are used in the EU, regardless of where the provider is located. If your organization deploys AI systems that affect persons in the EU, you should confirm with legal counsel whether your specific deployment model falls within scope. Extraterritorial application is defined by system reach and effect rather than by the provider's physical location.
Is there a single US federal AI law that governs enterprise AI deployment?
As of the time of publication, there is no single comprehensive US federal AI statute equivalent to the EU AI Act. Federal agencies apply existing sector rules to AI systems within their jurisdiction, and several states have enacted or proposed standalone AI obligations. This creates a patchwork that requires organizations to track both federal agency guidance and applicable state-level requirements. The situation is evolving, and new federal proposals or executive actions should be monitored regularly.
How should we approach compliance when a single AI system is subject to multiple regimes?
When a single deployed system is subject to requirements in multiple jurisdictions, the practical approach is to identify the most demanding requirement in each category (logging retention, documentation depth, disclosure format) and design your controls to meet that ceiling across the board. This avoids maintaining separate technical implementations per jurisdiction. The policy documentation that maps the system to each regime's requirements should be maintained separately per jurisdiction and reviewed whenever a regulation is amended. Legal counsel familiar with each applicable jurisdiction should validate the multi-regime mapping before it is used to set control design.
What is the difference between China's algorithm regulation and its generative AI regulation?
China has enacted distinct rules for different AI use cases rather than a single unified statute. The Algorithmic Recommendation Regulation covers systems that use algorithmic filtering or recommendation to shape content presented to users. The Deep Synthesis Regulation covers synthetic media including audio, video, and image generation. The Generative AI Regulation covers services that produce text, image, audio, video, or other content in response to user prompts. Each regulation carries its own filing, labeling, or registration requirements. An enterprise deploying a generative AI service in China needs to assess which specific regulations apply to its particular system and use case, as multiple regulations may apply simultaneously.
What does the UK's principles-based approach mean in practice for enterprise compliance?
The UK approach means that rather than meeting a fixed checklist, enterprises are expected to demonstrate that their AI governance processes and outcomes align with cross-sector principles published by the UK government. Regulators in relevant sectors are expected to apply these principles within their existing enforcement powers. In practice, this places a higher burden on governance process documentation, board accountability records, and outcome monitoring, since regulators evaluating compliance will look at whether the enterprise can show how it governs AI rather than whether it has completed a defined set of pre-deployment steps. The absence of a fixed checklist also means that what constitutes satisfactory compliance may be interpreted differently across sectors.
Build Governance That Holds Across Jurisdictions
Runtime policy enforcement, agent permissions, and centralized audit logging give governance teams a consistent evidence base regardless of which regulatory regime applies to a given deployment.
Explore Runtime Governance