The market has AI policies. It does not have AI controls.

Jurisdiction delta

• European Union — Article 26 deployer obligations require assigned human oversight with competence and authority evidenced.
• United Kingdom — SMCR requires the accountability be traceable to a Senior Manager Function with a Statement of Responsibilities.
• United States (prudential) — SR 11-7 requires model ownership distinct from independent validation ownership.
• Canada — E-23 requires the accountable party be documented in the enterprise model risk framework.
• Japan — JFSA expects accountability documented in Japanese for the parent board, even where the system is deployed offshore.
• International standards — ISO/IEC 42001 Clause 5.3: roles, responsibilities and authorities within the AI management system.

Jurisdiction delta

• European Union — Annex III high-risk determination with prohibited-practice screen under Article 5.
• United States (markets) — No statutory taxonomy. Classification is driven by investor-impact and supervisory-examination exposure.
• Singapore — MAS FEAT materiality assessment across fairness, ethics, accountability and transparency.
• Canada — E-23 risk rating drives validation depth and frequency.
• Gulf sovereign — National AI charter classification where the system touches citizen services or sovereign data.

Jurisdiction delta

• European Union — Article 14 requires oversight measures be built into the system design, not applied procedurally afterwards.
• United Kingdom — FCA Consumer Duty requires oversight adequate to evidence good customer outcomes.
• United States (prudential) — Effective challenge must be demonstrable, with evidence the challenger could have changed the outcome.
• Japan — METI guidelines expect oversight capability proportionate to societal impact.

Jurisdiction delta

• United States (prudential) — SR 11-7 core requirement; validation scope and independence are examined directly.
• Canada — E-23 requires validation depth to scale with the assigned risk rating.
• European Union — Article 17 quality management system evidences equivalent pre-market conformity.
• United Kingdom — SS1/23 requires the validation function have sufficient standing to challenge.
• International standards — ISO/IEC 42001 Clause 8 operational planning and control.

Jurisdiction delta

• United States (prudential) — Ongoing monitoring is an explicit SR 11-7 pillar alongside validation.
• European Union — Article 72 post-market monitoring plan for high-risk systems.
• Singapore — MAS expects monitoring proportionate to the FEAT materiality assessment.
• Canada — E-23 requires monitoring results feed the model risk report to senior management.

Jurisdiction delta

• European Union — Article 18 requires documentation retained for ten years after placing on the market.
• United States (markets) — Books-and-records retention applies where the model informed a recommendation.
• Japan — APPI retention and deletion obligations apply to the training and inference data held.

Jurisdiction delta

• European Union — Article 10 data governance for high-risk systems; GDPR Article 6 lawful basis alongside.
• Japan — APPI requires purpose-of-use disclosure and consent handling for personal data at source.
• New York State — Part 500 requires the data inventory extend to non-public information used in AI systems.
• Gulf sovereign — Residency constraints may prohibit training data leaving the jurisdiction entirely.
• International standards — ISO/IEC 23894 data quality and representativeness guidance.

Jurisdiction delta

• European Union — Chapter V transfer mechanism required; model hosting region is a transfer trigger.
• Japan — APPI Article 28 third-country transfer disclosure to the data subject.
• Canada — OSFI B-10 expects the transfer be reflected in the third-party risk assessment.
• Gulf sovereign — Sovereign residency may require in-country inference with no egress.

Jurisdiction delta

• European Union — Article 14 oversight must remain effective where the system operates autonomously.
• United States (markets) — Supervisory obligations under FINRA 3110 extend to activity initiated by an agent.
• United Kingdom — SMCR accountability is not discharged by delegating the action to an agent.
• United States (prudential) — Agent actions constitute model output for SR 11-7 purposes where they influence decisions.

Jurisdiction delta

• United States (markets) — Books-and-records treatment applies to agent-initiated communications and orders.
• European Union — Article 12 automatic logging over the lifetime of the high-risk system.
• Singapore — MAS expects auditability sufficient for a supervisor to reconstruct the decision.

Jurisdiction delta

• European Union — Deployer remains accountable regardless of the number of intermediating systems.
• United Kingdom — Senior Manager accountability persists across delegated automated chains.
• United States (prudential) — Chained models are in scope of the model inventory individually and as a system.

Jurisdiction delta

• European Union — Forms part of the Article 17 quality management system for high-risk systems.
• United States (prudential) — Prompt changes constitute model change and trigger the change-management path.
• Singapore — FEAT transparency expects the behavioural constraints be documented.

Jurisdiction delta

• United States (markets) — Communications with the public rules apply to generated content unchanged.
• United Kingdom — Consumer Duty and financial promotion rules apply to the output, not the technology.
• European Union — Article 50 transparency where a person interacts with an AI system.
• Japan — JFSA expects suitability obligations survive automation of the interaction.

Jurisdiction delta

• New York State — Part 500 penetration testing and vulnerability management extend to AI-enabled systems.
• European Union — Article 15 accuracy, robustness and cybersecurity for high-risk systems; DORA TLPT where applicable.
• United Kingdom — Operational resilience testing expected to cover AI-dependent important business services.
• Gulf sovereign — SAMA cyber framework testing cadence applies to the AI stack as a technology asset.

Jurisdiction delta

• New York State — Part 500.7 access privilege management, with 500.12 multifactor requirements.
• European Union — DORA ICT access management for critical or important functions.
• International standards — ISO/IEC 42001 Annex A control on AI system resources.

Jurisdiction delta

• European Union — DORA critical ICT third-party provisions plus AI Act value-chain obligations under Article 25.
• Canada — OSFI B-10 material arrangement treatment with concentration analysis.
• United States (prudential) — Interagency third-party guidance applies across the full relationship lifecycle.
• United Kingdom — PRA critical third-party regime where the provider is designated.

Jurisdiction delta

• United States (prudential) — An undisclosed version change is a model change and reopens validation obligations.
• European Union — Article 25 obligations shift where substantial modification occurs.
• Singapore — MAS expects reliance on external models be re-evidenced after change.

Jurisdiction delta

• European Union — DORA impact tolerance and scenario testing include ICT third-party AI dependencies.
• United Kingdom — PRA/FCA operational resilience impact tolerances apply where the service is important.
• Canada — OSFI E-21 operational resilience expectations extend to AI-dependent processes.
• United States (markets) — Reg SCI availability standards apply where the system is SCI-covered.

Jurisdiction delta

• European Union — DORA concentration risk assessment for critical ICT providers.
• Canada — B-10 concentration considerations at enterprise level.
• United Kingdom — Sectoral concentration is a supervisory question, not only a firm-level one.

Jurisdiction delta

• European Union — Article 50 transparency to natural persons; Article 53 for general-purpose model providers.
• United States (markets) — Disclosure of material AI use and the associated risk factors in filings.
• Japan — Disclosure in Japanese to the parent board and, where applicable, to JFSA.
• Singapore — FEAT transparency to affected customers on material AI-driven decisions.
• United Kingdom — Consumer Duty communications standards apply to the disclosure itself.

Jurisdiction delta

• European Union — Article 18 documentation and Article 19 automatically generated log retention.
• United States (prudential) — Examination readiness: evidence produced within the examiner's request window.
• United States (markets) — Production must be complete and consistent with books-and-records obligations.
• Gulf sovereign — Evidence must be producible in-jurisdiction where residency constraints apply.

Jurisdiction delta

• European Union — AI Act serious incident reporting alongside DORA and NIS2 clocks.
• New York State — Part 500.17 seventy-two-hour notification to the Superintendent.
• United States (markets) — Item 1.05 material cybersecurity incident disclosure within four business days.
• Japan — JFSA and PPC notification paths run in parallel with differing thresholds.
• Canada — OSFI technology and cyber incident reporting within twenty-four hours.

Jurisdiction delta

• European Union — DORA ICT asset management extends to the compute estate supporting critical or important functions.
• United States (prudential) — The supervisory expectation of a complete inventory covers the infrastructure on which models run.
• Gulf sovereign — Sovereign AI factory registration where compute is state-sponsored or state-adjacent.

Jurisdiction delta

• European Union — Chapter V transfer analysis follows the inference region, not the contract.
• Gulf sovereign — In-country inference may be mandatory for systems touching sovereign data.
• Japan — APPI third-country transfer disclosure follows where inference actually occurs.
• New York State — Part 500 asset inventory must reflect where processing of non-public information occurs.

Jurisdiction delta

• European Union — DORA risk management covers shared and multi-tenant ICT environments supporting important functions.
• New York State — Part 500.3 risk assessment must address risks from shared infrastructure.
• Canada — OSFI B-13 technology risk management expects isolation assurance in shared environments.

Jurisdiction delta

• European Union — DORA register of information must reflect the data centres supporting critical functions.
• Canada — OSFI B-10 requires the location of subcontracted operations be known and assessed.
• Gulf sovereign — Evidence must be producible in-jurisdiction where residency applies.

Jurisdiction delta

• United Kingdom — Operational resilience requires mapping the resources, including infrastructure, behind each important business service.
• European Union — DORA scenario testing includes infrastructure dependency failure.
• Canada — E-21 mapping expectations extend to underlying facilities and cloud dependencies.

Jurisdiction delta

• European Union — DORA concentration assessment covers ICT providers jointly, not category by category.
• United States (prudential) — Interagency guidance expects concentration analysis across the third-party inventory.
• United Kingdom — Critical third-party designation analysis begins from concentration measurement.

Jurisdiction delta

• United States (markets) — Activity initiated by an unidentified agent cannot satisfy supervisory obligations under FINRA 3110.
• European Union — Article 14 oversight presumes the overseen system is identifiable and bounded.
• International standards — ISO/IEC 42001 resource management extends to agentic resources acting on the organisation's behalf.

Jurisdiction delta

• United Kingdom — SMCR accountability cannot be delegated; delegation chains must preserve the accountable Senior Manager.
• United States (prudential) — Each agent in a chain is an in-scope model with its own inventory entry.
• European Union — Deployer accountability persists across all intermediating systems.

Jurisdiction delta

• United States (markets) — Books-and-records obligations survive the termination of the agent that generated them.
• European Union — Article 18 retention applies to the evidence an agent produced while active.
• Canada — E-23 model retirement expectations apply to agentic systems.

Jurisdiction delta

• European Union — Article 14 oversight measures must be built into the system's operation.
• United States (prudential) — Preventive controls are examined as part of effective challenge over model use.
• New York State — Part 500 expects controls that prevent, not merely detect, unauthorised activity.

Jurisdiction delta

• European Union — Article 12 logging extends to refused and anomalous operation.
• Singapore — MAS expects anomalies in autonomous operation be escalated with auditability.
• United States (markets) — Attempted unauthorised activity is within supervisory examination scope.

Jurisdiction delta

• International standards — ISO/IEC 42001 operational control expects consistency across the AI management system.
• New York State — Part 500.3 policy coverage must extend across the systems in scope without gaps.
• European Union — DORA requires a coherent, documented ICT risk framework rather than layered fragments.

Jurisdiction delta

• United States (prudential) — Evaluation outputs that inform reliance are within validation governance under SR 11-7.
• European Union — Conformity and post-market evidence must be traceable to the assessment that produced it.
• International standards — ISO/IEC 42001 performance evaluation clause applies to the evaluation process itself.

Jurisdiction delta

• United States (prudential) — Independence of the evaluating party mirrors SR 11-7 validation independence.
• United Kingdom — SS1/23 expects the validating function to have standing to challenge the evaluated party.
• European Union — Article 17 quality management covers the integrity of assessment inputs.

Jurisdiction delta

• United Kingdom — SMCR places the consequential judgment with the accountable Senior Manager.
• United States (prudential) — Effective challenge must be human and demonstrable.
• European Union — Article 14 human oversight cannot be discharged to another model.

Jurisdiction delta

• United States (markets) — Conflicts and incentives in automated systems are within examination scope.
• European Union — High-risk classification considers the system's purpose and context of use, not its architecture.
• Singapore — FEAT accountability expects incentive structures around automated decisions be examined.

Jurisdiction delta

• United States (prudential) — Model risk includes risks arising from the interaction of models.
• European Union — Post-market monitoring under Article 72 covers emergent behaviour in operation.
• United Kingdom — Consumer Duty outcome monitoring applies to self-reinforcing decision patterns.

Jurisdiction delta

• United States (prudential) — Supervisory reporting must not present assessments as forecasts of behaviour.
• European Union — Disclosure of AI capability must not overstate what the assessment establishes.
• International standards — ISO/IEC 23894 requires the limits of risk assessment be documented.

Jurisdiction delta

• European Union — GDPR purpose limitation and Article 10 data governance apply jointly to training use.
• Japan — APPI purpose-of-use constraints follow the data into model training.
• New York State — Part 500 data inventory extends to non-public information consumed by AI systems.
• Gulf sovereign — Residency and sovereignty constraints may prohibit training use entirely.

Jurisdiction delta

• European Union — Training use beyond the stated purpose requires its own lawful basis.
• Canada — OSFI B-10 expects contractual control over subcontractor use of institutional data.
• United States (markets) — Undisclosed training use of client information raises Reg S-P exposure.

Jurisdiction delta

• European Union — AI Act transparency obligations interact with text and data mining exceptions under the DSM Directive.
• United Kingdom — Passing off and database right considerations apply to model output reuse.
• United States (markets) — Material IP exposure arising from AI use may be a disclosable risk factor.

Jurisdiction delta

• European Union — GDPR Article 3 extraterritorial scope and Chapter V together define the attachment.
• Gulf sovereign — Sovereign data classes carry explicit jurisdictional attachment by instrument.
• US — Extraterritorial reach of US lawful access instruments is assessed as a foreign dependency for non-US operations.

Jurisdiction delta

• European Union — GDPR adequacy and transfer analysis require documented comparison of regimes.
• Canada — OSFI expects cross-border arrangements meet the stricter of the applicable expectations.
• Japan — APPI requires the foreign regime's equivalence be assessed before transfer.

Jurisdiction delta

• United States (prudential) — Change in legal environment is a model risk trigger under ongoing monitoring.
• European Union — Regulatory change affecting a high-risk system requires conformity reassessment.
• United Kingdom — SMCR accountability includes keeping the control position current as obligations change.