Why should investors monitor AI regulation?

Regulation sets operational limits for AI use, potentially slowing adoption and scaling. For example, the EU AI Act bans certain uses and imposes strict rules on others, which can delay product launches, increase costs, and, if non-compliant, lead to fines, impacting the viability of AI projects. However, regulation can also help shield compliant AI systems from public scrutiny and litigation risks, reducing investment risks in the long term.

What is AI regulation?

AI regulation is any regulation that affects the provision of AI enabled services and products. There is new regulation focused specifically on AI (e.g., the EU AI Act). There is also existing regulation that affects AI systems because of the input they use (e.g., data protection laws (GDPR, CCPA)), the cloud computing on which they depend (e.g., the NIS2 Directive) or the output they create (e.g., financial regulation (DORA) for credit rating, anti-discrimination laws). Also, there are other laws and private rights that AI systems can conflict with (e.g., intellectual property rights).

How do regulators define AI?

There is no single definition. The EU follows the OECD’s AI definition, while other jurisdictions are developing their own or leaving AI largely undefined.

How does the OECD define AI?

"AI system" means a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment.

What are the most important AI regulations?

The EU AI Act is currently the most extensive and prescriptive regulation of AI, and also applies to companies outside the EU. China has adopted the Interim AI Measures, which is a specific administrative regulation on the management of generative AI services. The U.S. has a White House Executive Order on AI, which primarily guides federal agencies' AI use. While there is no comprehensive federal AI law yet, several bills are under consideration, including the Algorithmic Accountability Act. Some states are taking the lead, with the Colorado Artificial Intelligence Act (CAIA) being the most notable example.

Will all countries adopt new AI regulation?

No, at least not immediately; many countries have favoured a "wait and see" approach or are leaning towards a more flexible regulatory regime.

What do countries intend to regulate?

Key areas of AI regulation include data privacy (e.g., user consent requirements), bias prevention (e.g., no discrimination in AI-driven decisions), ethical use / protecting fundamental rights (e.g., biometric categorisation), transparency (e.g., explainable processes) and accountability (e.g., traceable decisions).

What type of AI is prohibited?

The EU AI Act bans AI systems that:

• Use subliminal or deceptive techniques to impair decision-making: e.g., manipulative advertising, hidden nudges
• Exploit personal vulnerabilities: e.g., predatory lending, addictive games targeting children
• Create or expand facial recognition databases by scraping images without targeted consent: e.g., mass surveillance, unauthorised biometric data collection
• Infer emotions of individuals in workplace or educational settings: e.g., emotion-based performance monitoring, discriminatory hiring practices
• Categorise individuals based on biometric data to infer sensitive personal information: e.g., racial profiling, social scoring systems

Other jurisdictions have not yet provided a detailed list of banned AI applications.

What are sectors attracting particular attention?

Based on the number of mentions in the EU AI Act and equivalent regulations, these are the sectors AI regulation has been focusing on the most: