Brookings: Middle-Power AI Hedging Creates a Multi-Jurisdiction Compliance Gap

What happened

Why it matters

• ·Multi-jurisdiction AI compliance mapping programs built around leading frameworks such as the EU AI Act or the NIST Artificial Intelligence Risk Management Framework Playbook are structurally underbuilt for middle-power markets, where hybrid governance expectations are emerging independently of either major bloc. Organizations operating in Australia, South Korea, Singapore, or the Gulf states need jurisdiction-specific coverage, not framework extrapolation.
• ·Procurement and vendor due diligence controls face compounding risk as middle-power governments introduce independent requirements around model provenance, hardware origin, and assurance documentation. A vendor cleared under U.S. export control rules or EU conformity assessments may face additional or conflicting requirements in markets that have chosen not to adopt either framework as a reference standard.
• ·Board-level AI risk reporting must account for geopolitical alignment risk as a distinct category. As middle-power governments make deliberate choices about which AI governance bloc to adopt selectively, the regulatory surface for multinational AI programs becomes harder to predict, and material gaps can emerge between reported compliance status and actual regulatory exposure in specific markets.

Governance controls affected

What to do now

• ☐Audit your multi-jurisdiction AI regulatory map to identify which middle-power markets your AI-enabled products or services touch, and flag where your current framework coverage (EU AI Act, NIST, etc.) has not been validated against local requirements.
• ☐Assign a named owner in regulatory affairs or compliance to monitor AI governance developments in at least three of your highest-exposure middle-power jurisdictions on a quarterly basis.
• ☐Review AI vendor and hardware procurement due diligence checklists to ensure they capture country-of-origin and alignment-related assurance requirements that may apply in markets outside the U.S. and EU.
• ☐Update your board AI risk report to include a geopolitical alignment section that flags jurisdictions where regulatory divergence from leading frameworks creates unresolved compliance exposure.
• ☐Assess whether your current voluntary framework commitments (such as adherence to NIST or OECD principles) are being treated by middle-power regulators as sufficient assurance, or whether local assurance processes are required.

What to watch next

Compliance teams should monitor whether middle-power governments translate their strategic hedging postures into binding procurement restrictions, mandatory assurance requirements, or model-access controls over the next 12 to 18 months. Developments in Singapore, South Korea, and the Gulf Cooperation Council states are particularly worth tracking, given those governments' active AI strategy programs and history of independent standards development. The Singapore National AI Strategy 2.0 and related frameworks from the IMDA Model AI Governance Framework illustrate how middle-power governance can develop with enough specificity to create genuine compliance obligations that diverge from EU or U.S. baselines. Teams should also watch whether the Commerce Department Evaluation of State AI Laws signals any federal intent to influence how middle-power governments perceive U.S. AI governance norms.