Why and how AI regulation is being enacted

Essay

The first AI regulations did not come from the technology departments. They came from the safety boards. The European Union's AI Act, the United Kingdom's PRA SS1/23, the Dubai DIFC Regulation 10, and the Singapore Model AI Governance Framework were all drafted by bodies whose first remit is consumer harm or financial stability. The pattern is consistent across 36 jurisdictions the Exec X AI Agent currently tracks: regulation begins where the harm is visible and the existing rulebook is closest.

The second wave is sector-specific. The United Kingdom Medicines and Healthcare products Regulatory Agency runs a separate AI as a Medical Device programme. The Cabinet Office runs an AI procurement Mandate. The Bank of England runs a model-risk regime. A firm operating across two of these is regulated twice for the same model.

The third wave is enforcement. The first material EU AI Act enforcement actions are expected in Q3 2026 against firms unable to evidence Article 8 controls. The first PRA SS1/23 inspection round lands in the same quarter. The cost of being unprepared is no longer theoretical; the fines are written into the rule.

The Atlas tracks every material rule, ranked by impact on the reader's sector. The Education sector page is a simpler entry: an essay, a list of independent sources, and one link to the full Atlas. The reader can move at the pace the audit committee asks for.

External references