The market has AI policies. It does not have AI controls.

Jurisdiction delta

• European Union — Article 26 deployer obligations require assigned human oversight with competence and authority evidenced.
• United Kingdom — SMCR requires the accountability be traceable to a Senior Manager Function with a Statement of Responsibilities.
• United States — prudential — SR 11-7 requires model ownership distinct from independent validation ownership.
• Canada — E-23 requires the accountable party be documented in the enterprise model risk framework.
• Japan — JFSA expects accountability documented in Japanese for the parent board, even where the system is deployed offshore.
• International standards — ISO/IEC 42001 Clause 5.3 — roles, responsibilities and authorities within the AI management system.

Jurisdiction delta

• European Union — Annex III high-risk determination with prohibited-practice screen under Article 5.
• United States — markets — No statutory taxonomy — classification is driven by investor-impact and supervisory-examination exposure.
• Singapore — MAS FEAT materiality assessment across fairness, ethics, accountability and transparency.
• Canada — E-23 risk rating drives validation depth and frequency.
• Gulf sovereign — National AI charter classification where the system touches citizen services or sovereign data.

Jurisdiction delta

• European Union — Article 14 requires oversight measures be built into the system design, not applied procedurally afterwards.
• United Kingdom — FCA Consumer Duty requires oversight adequate to evidence good customer outcomes.
• United States — prudential — Effective challenge must be demonstrable, with evidence the challenger could have changed the outcome.
• Japan — METI guidelines expect oversight capability proportionate to societal impact.

Jurisdiction delta

• United States — prudential — SR 11-7 core requirement; validation scope and independence are examined directly.
• Canada — E-23 requires validation depth to scale with the assigned risk rating.
• European Union — Article 17 quality management system evidences equivalent pre-market conformity.
• United Kingdom — SS1/23 requires the validation function have sufficient standing to challenge.
• International standards — ISO/IEC 42001 Clause 8 operational planning and control.

Jurisdiction delta

• United States — prudential — Ongoing monitoring is an explicit SR 11-7 pillar alongside validation.
• European Union — Article 72 post-market monitoring plan for high-risk systems.
• Singapore — MAS expects monitoring proportionate to the FEAT materiality assessment.
• Canada — E-23 requires monitoring results feed the model risk report to senior management.

Jurisdiction delta

• European Union — Article 18 requires documentation retained for ten years after placing on the market.
• United States — markets — Books-and-records retention applies where the model informed a recommendation.
• Japan — APPI retention and deletion obligations apply to the training and inference data held.

Jurisdiction delta

• European Union — Article 10 data governance for high-risk systems; GDPR Article 6 lawful basis alongside.
• Japan — APPI requires purpose-of-use disclosure and consent handling for personal data at source.
• New York State — Part 500 requires the data inventory extend to non-public information used in AI systems.
• Gulf sovereign — Residency constraints may prohibit training data leaving the jurisdiction entirely.
• International standards — ISO/IEC 23894 data quality and representativeness guidance.

Jurisdiction delta

• European Union — Chapter V transfer mechanism required; model hosting region is a transfer trigger.
• Japan — APPI Article 28 third-country transfer disclosure to the data subject.
• Canada — OSFI B-10 expects the transfer be reflected in the third-party risk assessment.
• Gulf sovereign — Sovereign residency may require in-country inference with no egress.

Jurisdiction delta

• European Union — Article 14 oversight must remain effective where the system operates autonomously.
• United States — markets — Supervisory obligations under FINRA 3110 extend to activity initiated by an agent.
• United Kingdom — SMCR accountability is not discharged by delegating the action to an agent.
• United States — prudential — Agent actions constitute model output for SR 11-7 purposes where they influence decisions.

Jurisdiction delta

• United States — markets — Books-and-records treatment applies to agent-initiated communications and orders.
• European Union — Article 12 automatic logging over the lifetime of the high-risk system.
• Singapore — MAS expects auditability sufficient for a supervisor to reconstruct the decision.

Jurisdiction delta

• European Union — Deployer remains accountable regardless of the number of intermediating systems.
• United Kingdom — Senior Manager accountability persists across delegated automated chains.
• United States — prudential — Chained models are in scope of the model inventory individually and as a system.

Jurisdiction delta

• European Union — Forms part of the Article 17 quality management system for high-risk systems.
• United States — prudential — Prompt changes constitute model change and trigger the change-management path.
• Singapore — FEAT transparency expects the behavioural constraints be documented.

Jurisdiction delta

• United States — markets — Communications with the public rules apply to generated content unchanged.
• United Kingdom — Consumer Duty and financial promotion rules apply to the output, not the technology.
• European Union — Article 50 transparency where a person interacts with an AI system.
• Japan — JFSA expects suitability obligations survive automation of the interaction.

Jurisdiction delta

• New York State — Part 500 penetration testing and vulnerability management extend to AI-enabled systems.
• European Union — Article 15 accuracy, robustness and cybersecurity for high-risk systems; DORA TLPT where applicable.
• United Kingdom — Operational resilience testing expected to cover AI-dependent important business services.
• Gulf sovereign — SAMA cyber framework testing cadence applies to the AI stack as a technology asset.

Jurisdiction delta

• New York State — Part 500.7 access privilege management, with 500.12 multifactor requirements.
• European Union — DORA ICT access management for critical or important functions.
• International standards — ISO/IEC 42001 Annex A control on AI system resources.

Jurisdiction delta

• European Union — DORA critical ICT third-party provisions plus AI Act value-chain obligations under Article 25.
• Canada — OSFI B-10 material arrangement treatment with concentration analysis.
• United States — prudential — Interagency third-party guidance applies across the full relationship lifecycle.
• United Kingdom — PRA critical third-party regime where the provider is designated.

Jurisdiction delta

• United States — prudential — An undisclosed version change is a model change and reopens validation obligations.
• European Union — Article 25 obligations shift where substantial modification occurs.
• Singapore — MAS expects reliance on external models be re-evidenced after change.

Jurisdiction delta

• European Union — DORA impact tolerance and scenario testing include ICT third-party AI dependencies.
• United Kingdom — PRA/FCA operational resilience impact tolerances apply where the service is important.
• Canada — OSFI E-21 operational resilience expectations extend to AI-dependent processes.
• United States — markets — Reg SCI availability standards apply where the system is SCI-covered.

Jurisdiction delta

• European Union — DORA concentration risk assessment for critical ICT providers.
• Canada — B-10 concentration considerations at enterprise level.
• United Kingdom — Sectoral concentration is a supervisory question, not only a firm-level one.

Jurisdiction delta

• European Union — Article 50 transparency to natural persons; Article 53 for general-purpose model providers.
• United States — markets — Disclosure of material AI use and the associated risk factors in filings.
• Japan — Disclosure in Japanese to the parent board and, where applicable, to JFSA.
• Singapore — FEAT transparency to affected customers on material AI-driven decisions.
• United Kingdom — Consumer Duty communications standards apply to the disclosure itself.

Jurisdiction delta

• European Union — Article 18 documentation and Article 19 automatically generated log retention.
• United States — prudential — Examination readiness — evidence produced within the examiner's request window.
• United States — markets — Production must be complete and consistent with books-and-records obligations.
• Gulf sovereign — Evidence must be producible in-jurisdiction where residency constraints apply.

Jurisdiction delta

• European Union — AI Act serious incident reporting alongside DORA and NIS2 clocks.
• New York State — Part 500.17 seventy-two-hour notification to the Superintendent.
• United States — markets — Item 1.05 material cybersecurity incident disclosure within four business days.
• Japan — JFSA and PPC notification paths run in parallel with differing thresholds.
• Canada — OSFI technology and cyber incident reporting within twenty-four hours.