Artificial intelligence is moving rapidly into enterprise operations, with organizations using it to automate processes, enhance decision-making, and create new ways of working. At the same time, governments and regional unions around the world are racing to determine how to best regulate the technology, resulting in a varied and evolving set of AI governance approaches. For example, while regions like the EU have introduced formal legal frameworks, nations like the US have opted to take a more decentralized, voluntary approach.
These regulatory differences create a complex web of requirements for global and multinational organizations. Depending on where and how a company operates, the requirements could influence how they adopt AI and how quickly, how they manage AI-related risks, and what opportunities they have to gain a competitive advantage.
This article explores the changing global AI regulatory environment, how different approaches may shape enterprise adoption, and why effective governance could become a strategic advantage.
The European Union has taken one of the most comprehensive approaches to AI regulation through the European Union AI Act. The AI Act introduces a risk-based framework that categorizes AI systems according to their potential impact. Rather than regulating all AI equally, it applies different requirements depending on the nature of the system, its intended purpose, and the level of risk it creates.
The main categories include:
Certain AI uses that are considered incompatible with fundamental rights are prohibited. These include narrowly defined practices involving manipulation, exploitation of vulnerabilities, social scoring, and specific biometric or workplace-related applications. For example, an enterprise could be prohibited from using AI to infer employees’ emotions from facial expressions or voice patterns as part of performance monitoring or recruitment. Another example would be using AI to assign employees a behavioral score that affects access to workplace opportunities or benefits based on data unrelated to their role.
High-risk classification is a specific legal category in EU AI regulation. AI systems may be considered high-risk when they are used in areas such as employment, critical infrastructure, essential services, education, or other regulated domains. For example, an AI system integrated with SAP that supports the operation or maintenance of critical infrastructure - such as electricity, water, or transport networks - could be classified as high-risk if it meets the criteria set out in the AI Act. Classification depends on the intended purpose and context of the system, not simply the fact that AI is being used.
Organizations operating high-risk AI systems in the EU face requirements around areas such as:
Some AI systems, including certain conversational assistants and generative AI applications, require users to be informed when they are interacting with AI or when content has been AI-generated. In practice, this could mean an enterprise needs to ensure that an AI-powered chatbot on its website clearly identifies itself as an automated system, rather than allowing users to assume they are speaking with a human representative.
The AI Act also introduces obligations for providers of general-purpose AI models, particularly where those models may be integrated into a wide range of downstream applications.
The EU AI Act entered into force on August 1, 2024, but its requirements are being introduced in stages. Prohibitions on certain AI practices and AI literacy obligations began to apply in February 2025, followed by rules for general-purpose AI models in August 2025. Most remaining provisions apply from August 2026, with some requirements for high-risk systems embedded in regulated products applying from August 2027.
The Act is not limited to organizations based in the EU. It can also apply to companies outside the EU where they place an AI system on the EU market, provide it for use in the EU, or where the output of the system is used in the EU. For example, a US company offering products or services that utilize AI to EU customers may still fall within scope, even if the system is developed and operated outside Europe.
Practically, what this means for businesses is that AI governance cannot sit separately from business processes. To remain compliant, organizations need visibility into where AI is being used, what data it accesses, what decisions it influences, and whether it recommends, approves, or executes actions.
The United States has taken a different approach from the European Union in AI regulation. Rather than introducing a single comprehensive AI law, the US approach currently focuses on a combination of executive action, sector-specific regulation, voluntary frameworks, and state-level legislation.
The emphasis has generally been on encouraging innovation while addressing specific risks through existing regulatory mechanisms.
The National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF), for example, provides voluntary guidance designed to help organizations manage AI risks through principles such as:
This approach gives organizations flexibility in how they implement AI governance, but it can also create ambiguity. On the positive side, this flexibility can support faster AI deployment, particularly in industries where speed of innovation is a competitive advantage. However, a decentralized approach means different industries and states may develop different requirements, potentially adding complexity around what applies where and to whom. Fewer mandatory restrictions also place more responsibility on organizations to define and enforce their own governance standards.
The absence of a single regulatory framework does not reduce the consequences when AI is poorly controlled. A data breach, compliance failure, or operational incident still leaves the organization responsible for containing the damage, restoring trust, and addressing the underlying control failure. Stronger regulation may slow deployment in some cases, but it can also reduce the likelihood of these issues by requiring organizations to put clearer safeguards in place. For global organizations, US-based AI deployments may still need to meet stricter standards when systems operate across multiple jurisdictions.
The United Kingdom has taken a different approach. Rather than introducing a single AI law equivalent to the EU AI Act, it has relied on existing regulators to apply cross-sector principles such as safety, transparency, fairness, accountability, and redress within their own areas of responsibility. This means there is no single commencement date or blanket set of mandatory obligations under the framework itself. However, organizations may still be subject to binding requirements under existing laws and sector-specific regulation, depending on how and where they use AI.
The UK approach emphasizes principles such as:
The model aims to encourage innovation while allowing regulators in areas such as financial services, healthcare, and employment to apply AI oversight within existing regulatory structures. This offers flexibility but also places greater responsibility on organizations to interpret how principles apply in practice as well as creates a risk of inconsistent interpretation. A global business may need to satisfy the EU AI Act’s formal obligations while simultaneously demonstrating responsible AI governance under the UK’s principles-based model.
China has developed one of the most active AI regulatory environments, but its approach differs significantly from both Europe and the US.
Chinese AI regulation has focused heavily on areas such as:
Rather than regulating AI through a broad risk classification model, China has introduced targeted regulations addressing specific technologies and use cases. This approach reflects a balance between encouraging AI development and maintaining government oversight over technology platforms and information systems.
For organizations operating in China, AI adoption requires consideration of local regulatory obligations, data requirements, and operational controls that may differ significantly from Western markets.
AI regulation is also developing across other regions. Many countries are moving toward frameworks based on international principles, including transparency, accountability, human oversight, and risk management. Organizations such as the Organization for Economic Co-operation and Development have contributed to global AI principles that influence emerging approaches.
Without a single global AI regulatory standard, organizations face a growing patchwork of requirements across the markets in which they operate. For multinational enterprises, this creates a strategic challenge: how do you build AI capabilities that can operate consistently across different regulatory environments?
One of the biggest questions facing businesses is whether different regulatory approaches will help or hinder innovation.
Regions with lighter regulation may be able to move faster because companies face fewer mandatory requirements when testing, deploying, and scaling AI solutions. This could create competitive advantages in areas where speed matters, such as product development, customer experience, automation, and operational optimization.
But that speed does not guarantee long-term success, particularly if weak governance leads to security failures, compliance issues, operational disruption, or erosion of customer trust. Those risks become also more serious as AI systems gain greater autonomy. An AI system that generates incorrect information is one challenge, while an AI agent that incorrectly executes thousands of business transactions is a very different one.
More regulated environments may create a different kind of advantage. Although stronger governance requirements can increase the effort involved in early adoption, they also push organizations to establish clearer controls around data quality, accountability, monitoring, and responsible AI use. That stronger foundation can become a competitive advantage in its own right by delivering operational and consumer confidence.
Global and multinational organizations will need to carefully consider their AI governance strategy, recognizing that different regulatory requirements may call for regional variation — or a consistent global baseline that goes beyond what is strictly required in every market.
AI regulation will continue to evolve in the coming years with new laws, standards, and industry expectations emerging as technology capabilities mature.
Organizations should avoid treating regulation as a one-time compliance exercise and instead take a continuous approach that connects AI discovery, risk assessment, business ownership, security controls, and data governance.
A lighter regulatory environment may allow some organizations to move faster in the short term. But long-term AI leadership will depend on trust, reliability, and the ability to operate AI responsibly at enterprise scale.
In the next blog in this series, we’ll look at what the changing regulatory environment means for SAP customers and the practical steps organizations can take to prepare.