1,000+ AI Rules, One Audit Gap: Runtime Evidence Is What Regulators Want
What happened
Openlayer published its Country-by-Country AI Regulation Guide (Oct 2026), a comparative analysis of more than 1,000 AI policy initiatives across 72 countries. The guide identifies five requirements that appear repeatedly across jurisdictions: risk classification, human oversight, transparency, post-market monitoring, and version-linked audit documentation. Its central finding for enterprise compliance teams is that audit readiness is no longer satisfied by design-time policies alone. Regulators are now asking for inference-time evidence: logs and records showing that controls were active and functioning while the AI system was running in production. The guide covers binding frameworks such as the EU AI Act (Regulation (EU) 2024/1689) and in-force state laws such as the Texas Responsible AI Governance Act. It also addresses emerging requirements across Asia-Pacific and Latin America.
Why it matters
- ·Regulators across the EU, US states, and Asia-Pacific are converging on the same audit standard: evidence that controls ran in production, not just that they were documented. Teams relying on design-time policies and pre-deployment testing alone face a material gap when examiners arrive.
- ·The guide's cross-jurisdictional scope exposes a mapping problem for multinationals. Risk classification rules, human oversight thresholds, and transparency disclosures vary by country. A single AI system deployed globally may trigger obligations under the EU AI Act (Regulation (EU) 2024/1689), US state laws, and sector-specific Asian frameworks simultaneously. Without a unified control inventory, tracking these obligations is not feasible.
- ·Version-linked documentation is an emerging hard requirement. When a model is updated or replaced, regulators want records tied to that specific version, not a generic system description. Enterprises without model registries and change-linked audit logs will struggle to demonstrate compliance across the full deployment lifecycle.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit your current AI logging setup to confirm it captures what the system actually did in production, including which version ran, what inputs it received, and what outputs it produced, for each decision or action taken.
- ☐Ask your internal audit team whether their AI testing procedures include sampling live production logs, not just reviewing design documents or pre-deployment test results.
- ☐Map each AI system in your inventory against the five requirements identified in the guide (risk classification, human oversight, transparency, post-market monitoring, version-linked documentation) and note which ones lack evidence of operational controls.
- ☐Check whether your AI model registry links documentation to specific model versions, so that when a model is updated, the prior version's audit record remains accessible and distinct.
- ☐Identify which jurisdictions your AI systems touch and assign a compliance owner responsible for tracking local requirements in each, prioritizing markets where binding rules are already in force.
What to watch next
The guide's inference-time evidence standard is likely to become a focal point as regulators move from publishing rules to conducting audits and inspections. The EU AI Act (Regulation (EU) 2024/1689) enforcement machinery is now active, and US state regulators in California and Texas are beginning enforcement cycles under laws already in force. Teams should also monitor whether the convergence pattern identified across 72 countries accelerates. Countries without binding AI laws may adopt frameworks modeled on the EU. Others may issue sector-specific guidance that embeds the same runtime-evidence expectation.