One AI System, Many Rulebooks

2026: AI regulation is no longer a European story. For years, “AI regulation” was shorthand for one thing — the EU AI Act. That is over. An organization that builds or deploys AI now has to reason about a patchwork of regimes that reach it from several directions at once.

Spain stood up AESIA, the European Union’s first national AI supervisory authority. South Korea’s AI Basic Act took effect in January 2026 — one of the world’s first comprehensive, risk-based AI laws in force. Singapore turned its Model AI Governance Framework and the AI Verify testing toolkit into the de-facto reference for Asia. The UAE and Qatar race ahead on national AI strategy while their binding rules still live mostly in data-protection law. And across Latin America — Argentina, Brazil, Chile, Peru — data-protection statutes modernize toward European adequacy while the first risk-based AI bills move through the legislatures. The result is not one rulebook. It is many, at different levels of maturity, arriving on different clocks.

The trap: treating a technical problem as a paperwork problem

Two cards. Fragmentation: a binding, prescriptive regime (the EU AI Act, Korea's AI Basic Act) sits next to soft-but-influential guidance (Singapore's AI Verify, the Gulf's AI-ethics principles) and next to emerging law (Latin America's AI bills). Extraterritoriality: an Argentine startup whose model output reaches EU users falls within the EU AI Act and the GDPR; a vendor selling into Seoul meets Korea's high-impact-AI duties. Scope follows the user and the market, not the headquarters. — Why one rulebook never suffices: the regimes are fragmented across maturity levels, and their scope follows the user and the market — not the headquarters.

Faced with this, most teams reach for the legal function. Policies are written, roles are named, questionnaires are answered. That work is necessary — but it stops at the exact question that regulators, auditors and enterprise security teams now ask: “Show me you actually tested this system against these risks — and prove the result is reproducible.” Paperwork cannot answer that. Evidence can.

The map: a short tour across four regions

Europe & Spain

From 2 August 2026, the EU AI Act’s Article 50 transparency duties, its general-purpose-AI rules and the full penalty regime apply. The high-risk (Annex III) obligations — risk management, record-keeping, human oversight, cybersecurity resilience against data and model poisoning — were deferred to December 2027 under the Digital Omnibus, a sign of just how fast this target moves. Spain’s AESIA, created by Royal Decree 729/2023, is the first national authority to enforce it, alongside the LOPDGDD and the ENS security framework.

Latin America

Argentina’s Ley 25.326 is modernizing toward GDPR-level adequacy, and the data-protection authority (AAIP) has issued a national programme and guidance for responsible AI. Brazil pairs the binding LGPD with PL 2338 — a risk-based AI bill, approved by the Senate in December 2024 and now before the Chamber of Deputies. Data law is already binding; AI law is arriving fast.

The Gulf

The UAE (AI Strategy 2031, Dubai’s AI blueprint, a dedicated AI ministry) and Qatar are among the most AI-forward states in the world — yet their binding obligations still sit largely in data-protection law: the UAE PDPL, the DIFC Data Protection Law, and Qatar’s PDPPL, the Gulf’s first. AI-specific rules remain principle-based, for now.

Asia-Pacific

Korea’s AI Basic Act is the headline: comprehensive, risk-based, with transparency duties for generative AI, in force since January 2026. Singapore leads on operational governance with its Model AI Governance Framework and AI Verify — a toolkit built specifically to test AI systems for governance properties. Malaysia has published national AI governance and ethics guidelines and stood up a National AI Office.

The common thread: it is an evidence problem

Read across all of them — hard law and soft — and the underlying demands converge: manage risk across the lifecycle, be transparent, keep a human in the loop, be ready to classify and report incidents, and account for your supply chain. Above all, be able to demonstrate that you did — reproducibly.

Two international standards have become the shared language for that demonstration: ISO/IEC 42001 — the first certifiable AI management system — and the NIST AI Risk Management Framework. Auditors and enterprise buyers accept them from São Paulo to Seoul.

The gap that remains is not a shortage of policies. It is the shortage of technical, reproducible proof that the policies correspond to a system that was actually tested.

Where AI-Egis fits: the technical evidence layer

AI-Egis — the AI Exploitation & Governance Intelligence Suite — is not compliance-in-a-box, and it is not a legal product. It is the technical evidence layer beneath these regimes. It runs systematic, autonomous adversarial testing across 21 AI-risk domains — prompt injection, data leakage, tool misuse, agent overreach, memory poisoning, supply-chain and Model Context Protocol exploits — and maps every finding to the controls each region recognizes:

EU AI Act · ISO/IEC 42001 · NIST AI RMF · OWASP LLM Top 10 · OWASP Agentic Top 10 · CSA MAESTRO · Databricks DASF · MITRE D3FEND · NIS2 · DORA

Every assessment is reproducible: a tape — a seed and a cryptographic hash for each model call — plus a standardized SARIF report means the same test replays identically next quarter. That reproducibility is precisely what record-keeping obligations and the “prove it” question require, and it is something neither a policy document nor a one-off human review can provide.

Because ISO/IEC 42001 and the NIST AI RMF are recognized across all nine markets, AI-Egis produces credible evidence today — even where a country’s AI law is still soft. Where hard law exists, the map extends naturally: Korea’s risk-based Act mirrors the European logic AI-Egis already encodes; Singapore’s AI Verify is a governance-testing ally whose results AI-Egis’s evidence complements; Spain’s AESIA enforces the very Act AI-Egis maps to.

The boundary is honest. AI-Egis produces the evidence. Defining your legal role, running AI-literacy programmes and negotiating contractual clauses stay with your legal and GRC partners. AI-Egis is the layer that makes their work provable — and repeatable.

The takeaway

In a world of many rulebooks, the losing strategy is to chase each one with more paperwork. The winning one is to build a single body of reproducible technical evidence that speaks the language all of them already accept. That is what AI-Egis is for.

Who obligates? — official sources

The instruments below establish binding duties (Binding) or influential, voluntary guidance (Soft). Status as of August 2026 — regulatory timelines continue to evolve; verify before relying on them.