Question 37 of 45
How do we map AI compliance obligations across multiple jurisdictions?
Published by AI Governance Institute · Practical Governance for Enterprise AI
A structured process for organizations operating AI systems across multiple regulatory environments — identifying overlapping obligations, resolving conflicts, and building a unified compliance posture that satisfies the most stringent applicable requirements.
If you only do 3 things, do this:
- 1.Start with your shortest fuse: identify the jurisdiction with the most imminent deadline or the strictest obligation, and build your compliance posture from there outward. Trying to build a unified framework before you know which obligations are most pressing is how organizations end up with elegant frameworks that miss deadlines.
- 2.Most AI governance obligations across jurisdictions share a common core — risk classification, human oversight for high-stakes decisions, documentation, and incident notification. Build once to satisfy the most stringent version of each shared requirement, then layer jurisdiction-specific additions.
- 3.Regulatory divergence is the real risk. Where two jurisdictions impose genuinely conflicting requirements, you need a legal opinion and a documented resolution — not a governance framework that silently fails to satisfy either.
The Situation
Who this is for: GRC teams, Legal, and AI Governance leads at multinational organizations or those with customers or employees in multiple regulatory jurisdictions
When you need this: When expanding to a new market with AI regulation, when the EU AI Act comes into scope, or when a regulator asks for evidence of multi-jurisdiction compliance
The Decision
Which obligations apply in each jurisdiction, where do they conflict, and what unified control posture satisfies all of them?
The Steps
- 1Map every jurisdiction where AI systems are deployed or where data subjects are located
- 2For each jurisdiction, inventory applicable AI-specific regulations, AI-relevant data protection rules, and sector-specific requirements
- 3Identify the shared control requirements across frameworks — risk classification, documentation, human oversight, incident notification
- 4For each shared requirement, identify the most stringent version across all applicable frameworks and design controls to meet it
- 5Identify genuine conflicts where two jurisdictions impose incompatible requirements — escalate each to Legal for a documented resolution
- 6Assign a monitoring owner for each jurisdiction responsible for tracking regulatory changes
- 7Review the mapping annually and after any regulatory change in a covered jurisdiction
The Artifacts
- —Multi-jurisdiction regulatory inventory (jurisdiction, applicable frameworks, key obligations, effective dates)
- —Unified control mapping showing which internal controls satisfy which obligations across which jurisdictions
- —Conflict register: genuine incompatibilities between jurisdictions with documented legal resolution
- —Regulatory monitoring assignments by jurisdiction
The Output
A unified control framework that satisfies the most stringent version of each shared obligation, with documented resolutions for genuine conflicts and assigned monitoring ownership for each jurisdiction.
The shared core across most frameworks
Despite surface-level differences, most AI governance frameworks converge on a small set of shared requirements. Understanding this shared core is the starting point for multi-jurisdiction mapping because it tells you what to build once rather than repeatedly.
The shared core includes: risk-based classification of AI systems (EU AI Act, NIST AI RMF, UK approach, Singapore IMDA framework all require some version of this); documentation of AI system purpose, data sources, and decision logic (required by GDPR's automated decision provisions, EU AI Act, and most sector-specific frameworks); human oversight requirements for high-stakes or regulated decisions (universal across major frameworks, differing in specifics); and incident notification obligations (timelines and recipients differ, but the obligation to notify appears in GDPR, the EU AI Act for GPAI incidents, and several national frameworks).
Build controls to satisfy the most stringent version of each shared requirement across your applicable jurisdictions. A risk classification scheme that meets EU AI Act standards will generally satisfy less prescriptive frameworks. Documentation that satisfies GDPR Article 22 requirements will cover most automated decision documentation obligations. Building to the highest standard in each category is more efficient than maintaining jurisdiction-specific variants for shared requirements.
Identifying and resolving genuine conflicts
Most apparent conflicts between AI governance frameworks are not genuine conflicts — they are differences in specificity or emphasis that can be resolved by satisfying the more stringent obligation. A genuine conflict exists where two jurisdictions require incompatible actions: for example, where one requires that AI decision logic be disclosed to affected individuals and another prohibits disclosure of the same information as a trade secret or on national security grounds.
Genuine conflicts require a documented legal resolution, not a governance framework that silently tries to satisfy both. The resolution process should involve Legal counsel with expertise in both jurisdictions, a documented analysis of the conflict, a chosen approach (satisfy one jurisdiction, seek an exemption in the other, or structure the system to avoid the conflict), and a record of who approved the resolution.
Maintain a conflict register. When a new regulation creates a conflict with an existing obligation, the conflict should be escalated to Legal within 30 days of the regulation's publication and resolved before it takes effect.
Maintaining the map over time
A multi-jurisdiction compliance map is not a one-time deliverable. Regulatory environments change continuously — new laws come into force, guidance updates existing obligations, enforcement actions reveal how regulators interpret ambiguous requirements, and the organization's own geographic footprint changes.
Assign a monitoring owner for each jurisdiction covered in the map. This person is responsible for flagging regulatory changes within 30 days of publication and triggering a map update before the change takes effect. Monthly news scans and regulatory authority subscription lists are the minimum. For high-priority jurisdictions (EU, US federal, wherever you have the largest customer base), consider a dedicated legal monitoring subscription.
Review the full map annually regardless of interim changes. Organizations often find that incremental updates have created inconsistencies — a new control added for one jurisdiction silently breaks compliance in another. The annual review is the check on accumulated drift.
Governance Controls
Operational controls that implement the guidance in this playbook.
Related frameworks
Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →