Why has AI Regulation Stopped Being Just a 'Tech Issue'?
With the spread of generative AI, AI has rapidly moved from being a tool for a subset of researchers to an infrastructure for society. From recruitment, credit decisions, healthcare, education, advertising, administrative procedures, and internal business process reforms, there are more and more situations where AI participates in decision-making and information flows. Consequently, the issues of safety, accountability, copyright, privacy, and bias are no longer just technical challenges but regulatory concerns as well.
What we should note here is that AI regulation around the world is not a monolith. Put simply, the EU tends to lay down rules first, the US moves forward with operation and guidance as it progresses, and Japan pursues a balance between innovation and risk management within a soft framework — these are the hues of the three directions. This article organizes these three dynamics into a single map.
EU: EU AI Act — The Core of Risk-Based Regulation
The EU AI Act classifies AI by its use and the magnitude of its impact (risk) and applies obligations in a phased manner, adopting a risk-based approach. The EU has previously led global personal data protection through GDPR, and in this case too, it is highly likely to affect even non-EU companies (the Brussels Effect).
Risk Categorization Concept (Image)
- Prohibition (Unacceptable risk): Uses that severely infringe on human freedom or safety may be prohibited in principle.
- High risk: Areas such as recruitment, education, critical infrastructure, healthcare, judiciary and administration, where the impact on daily life is large. Compliance requirements become heavier.
- Limited risk: Imposes certain obligations such as transparency to users.
- Minimal risk: Generally free to use.
Furthermore, in response to the spread of generative AI, the EU AI Act has focused on obligations for GPAI and for large-scale models (often called foundation models). The point is that responsibilities are designed to be shared between model providers (developers) and those who deploy or use the model in business (the deployment side).
Obligations That Really Matter in Corporate Practice (Representative Examples)
- Risk management: For high-risk uses, risk assessment and mitigation should be run as a process.
- Data governance: Managing the quality, bias, and legality of training and evaluation data.
- Technical documentation and logs: Documentation and operation logs that withstand authorities or audits.
- Transparency: Notifying that AI is being used and indicating that the outputs are generated, which is a central topic of discussion.
- Human oversight: Designing to avoid fully automatic decisions on important matters and ensuring the possibility of human intervention.
From a practical perspective, the EU AI Act asks not only about the technology together with its capabilities but also whether the organization can produce audit trails for development, provisioning, and operation. In addition to model performance evaluation, it is necessary to address explainability, robustness, security, and bias testing as part of a packaged set of requirements.
U.S.: Building Up with Existing Laws + Administrative Guidance + State Laws Rather Than a Comprehensive Federal Act
The United States does not pursue a single comprehensive AI law like the EU. Instead, it leans on existing consumer protection, anti-discrimination, financial regulation, and healthcare regulation, while relying on agency guidance and enforcement, with state laws moving forward independently. At the federal level, presidential directives from the White House and agency policies carry influence.
U.S. Characteristics: Emphasis on Speed, with a Backdrop of Litigation Risk
- Regulations tend to lag behind; however, the impact of lawsuits and penalties when problems occur is large, which in turn pushes companies to voluntarily build up their frameworks.
- Transparency and fairness (avoidance of discrimination) are closely scrutinized by sector-specific regulatory authorities in areas like employment and finance.
- Cybersecurity and abuse of models are often discussed in the context of national security and election protection.
From a corporate perspective, since what constitutes a violation is not as clearly defined as in the EU, companies may be subjected to varying requirements by state and shifts in authorities' interpretations. AI legal/compliance is similar to planning around the region of deployment (states) and sector (finance, healthcare, education, etc.).
Japan: AI Strategy Emphasizes Balancing Promotion and Governance — Implementing Via Soft Law
Japan, at present, relies less on a comprehensive and forceful general AI law like the EU and more on guidelines, principles, and voluntary corporate efforts to advance social deployment while reducing risk. Underlying this is a strong focus on not stopping AI adoption in response to industrial competitiveness and a shrinking workforce.
Key Points in Japan: The Practical Borders That Are Easy to Trip Over
- Personal data protection: Risks of personal data mixing into training data or prompts. Sorting out anonymization or pseudonymization and outsourcing/common-use matters is important.
- Copyright: Legality of training/generation, scopes of secondary use in internal use, and risks of output similarity. Without establishing rules for generated outputs, things can easily spark controversy.
- Unfair competition & trade secrets: Incidents of internal information being sent to external AI, misuse of access control in RAG (retrieval-augmented generation).
- Accountability: More scenarios where responsibilities need to be explained in customer support and screening tasks.
The practical reading of Japan's AI strategy is that the emphasis is on creating governance templates that can be used in the field to reduce incidents, rather than simply increasing prohibitions. For companies, it is essential to look not only at laws but also at guidelines from ministries/agencies, industry associations, and the security requirements of partners (audits, ISO, SOC 2, etc.) to avoid getting stuck in real-world operation.
Three-Way Comparison: Even with the same AI regulation, the required preparation differs
- EU: Rules are relatively codified, with heavy emphasis on audit trails and compliance processes. The effects extend beyond borders.
- U.S.: Varies by sector and state. Strong pressures from lawsuits, agency enforcement, and reputational risk.
- Japan: Balancing promotion with governance. Guidelines-centered, with the company's implementation capabilities being tested.
In other words, the more globally a company deploys AI, the more practical it is to treat EU compliance as a superset and tailor to fit US sector-specific requirements and Japan's implementation guidance.
What You Can Do Tomorrow: The AI Governance Minimum Set
Regulations differ by country, but the preparations share common ground. Rather than aiming for perfection from the start, it is more realistic to focus on eliminating areas prone to incidents first.
1) Create an AI Usage Ledger (AI Inventory)
Knowing which department uses which AI for what purpose and what data is used is essential. Enumerate SaaS-generated AI, API usage, internal LLMs, and AI embedded in business tools (Copilot-type).
2) Classify risk by use case and adjust rules
Borrowing the EU AI Act approach clarifies this. For example, marketing content generation may be low to mid-risk, but recruitment screening or credit decisions can be high-risk. For high-risk uses, implement an approval flow, evaluation, and audit logs.
3) Define data import rules
- Is it permissible to input personal information, confidential information, or customer data?
- Whether prompts or attachments are used for training (opt-out allowed)
- Access controls (permissions, auditing) for internal documents referenced by RAG
This is a place where on-the-ground confusion can lead to incidents. Providing not only restrictions but also alternatives (internal-use options, masking, templates) helps ensure compliance.
4) Integrate evaluation into operations
Generative AI may perform well at release but degrade in operation. To monitor hallucinations, bias, and information leakage, run periodic evaluations and red-teaming. A growing set of tools provides mechanisms for LLM evaluation (prompt evaluation, regression testing, guardrails).
5) Align contracts and disclosure statements
When using external AI, review terms of service, DPA (data processing agreement), handling of training data, and delineation of responsibility. For users, clearly communicating that AI is in use and that there are limitations helps prevent trouble.
The Roadmap Ahead: Regulation Will Be More Concrete Than Strict
The focus going forward is not only whether to regulate AI, but which uses require what degree of accountability and safety measures. For generative AI, standardization of copyright, transparency (display of generated content), misinformation countermeasures, and safety evaluation is likely to advance, and companies should prepare for what to prove, to what extent, and how.
The key is to view regulation not as a constraint but as a blueprint for safe use. Companies that are well prepared can accelerate adoption.
June 23, 2026: Norway bans AI use in elementary schools
In June 2026, Norway announced a ban on AI use by elementary-school students, paired with a renewed emphasis on paper textbooks (GIGAZINE). Where the EU AI Act focuses on high-risk applications, Norway cuts across by age — restricting AI in schools wholesale and signaling that country-level child- and education-specific AI rules are sharpening alongside broader frameworks. EdTech and youth-facing services in Europe now need to track each country's child-AI guidance, not just the AI Act risk tiers.
The Vatican joins the field: Pope Leo XIV's AI encyclical "Magnifica Humanitas"
On May 25, 2026, Pope Leo XIV issued his first encyclical, "Magnifica Humanitas", framing AI not as just another new technology but as an invisible infrastructure underpinning everyday life, and calling forcefully for tighter regulation and child protection. Using the striking phrase "a new form of slavery", the document criticizes a world in which attention, decisions, and labor become subordinated to algorithms. The Vatican notably invited Anthropic co-founder Chris Olah to speak at the encyclical's presentation, signaling a willingness to engage directly with frontier AI labs. None of the three regimes covered above — the EU AI Act, the US sector-specific approach, or Japan's soft-law model — can be operated effectively without a shared yardstick of values to defend, and this marks the moment when religious and ethical voices started actively shaping the policy conversation. For Japanese companies, expect requirements on child safety, worker dignity, and transparency to start landing directly in client contracts and internal governance templates.
June 2026: Trump signs a "looser" AI executive order
On June 2, 2026 (PT), President Donald Trump signed a revised AI oversight executive order, easing earlier provisions out of concern they could hinder competition with China. The pre-release government review window for new AI models was shortened from 90 days to 30 days, and a new "AI Cybersecurity Clearinghouse" for industry and government was established. The U.S. baseline — no comprehensive federal AI law, oversight via existing laws and sector-specific regulation — remains intact, but federal safety evaluation now leans toward a "voluntary submission plus short-window review" model. This widens the gap with both the EU AI Act (comprehensive high-risk regulation) and Japan’s soft-law approach. Japanese companies selling globally now face three separate compliance regimes in the EU, U.S., and Japan. Operational details of the review process itself are still unsettled, and the industry view is that the governance buildout is still unfinished.
Conclusion
EU clarifies rules with the EU AI Act, the US builds up with existing laws and enforcement plus state laws, and Japan pursues balancing promotion and governance through a soft-law approach. Despite differences, what companies need to do can be boiled down to five items: making utilization visible, risk classification, data governance, ongoing evaluation, and contracts & disclosures. Start small, establish a solid base, and then scale up — that is the practical winning formula in the AI era.
