The global conversation on artificial intelligence regulation is often presented as a choice: move fast and innovate, or regulate and constrain.
That framing reflects a concern across policy and public debate that premature regulation may inhibit technological developments or weaken global competitiveness, with policymakers also acknowledging that delayed intervention will not preserve optionality. It will simply allow risks to crystallise, often to a point where harms have already materialised and are significantly harder, or impossible, to reverse. In domains such as biomedicine, where technical corrections and retrospective regulatory intervention won’t undo patient harm, this principle is well understood.
In practice, a small but influential group of jurisdictions is actively attempting to intervene early, under conditions of deep uncertainty, while many others are still observing and relying on existing legal frameworks and reactive enforcement rather than developing AI-specific regimes. What may be perceived as more “pro-innovation” or more “restrictive” in fact reflects a different theory of risk, accountability, and institutional capability across jurisdictions, with four broad approaches that are now taking shape for the governance of AI.
- EUPre-emptive system governance — a structured, risk-based regime applied before deployment.
- UKPrinciples-based & sector-specific — high-level principles applied through existing regulators.
- USState-led with a litigation backstop — sectoral oversight, state laws, and liability as a driver.
- SINGAPOREOperational governance playbooks — practical, implementable toolkits over binding law.
European UnionThe pre-emptive model of system governance
The European Union has adopted the most structured and anticipatory model with the EU AI Act; it applies a risk-based framework that classifies AI systems and imposes obligations before they are deployed, particularly for high-risk applications such as those used in healthcare.
The logic is familiar, as it mirrors elements of existing product safety regulation, including conformity assessments and, in certain cases, third-party oversight, drawing clear parallels with CE-marking regimes. The ambition is to build trust through harmonisation and legal certainty across the European market.
Yet key elements of the framework, including the mechanism for demonstrating presumption of conformity, depend on harmonised technical standards, many of which are still under development by European standardisation bodies such as CEN and CENELEC. Until these standards are finalised, operational clarity remains limited.
Reflecting the practical challenge of a framework without implementing standards and compliance tools, the application of high-risk AI obligations under the EU AI Act is expected to be deferred from 2 August 2026 (the initial date) to 2 December 2027 for standalone systems, and to 2 August 2028 for AI systems embedded in products, until the supporting compliance framework is actually available. This is important for biomedical AI, since developers of clinical, diagnostic and device-linked AI might consider that they cannot operationalise conformity assessment, documentation and post-market obligations with confidence if the technical standards needed to translate legal requirements are still unfinished. Organisations will nevertheless likely continue preparing for compliance against the original timeline, treating the revised application dates — once confirmed through formal adoption of the relevant amending legislation — as additional implementation time.
A pre-deployment model of governance such as the EU AI Act can also prove difficult to apply to complex AI systems that evolve through adaptive learning. For example, developers in biomedicine may be required to rely on conformity assessment pathways for systems that have already been deployed and subsequently re-trained on new patient data, refined to reflect local clinical practices and updated to incorporate emerging biomarkers. At that stage, the system may no longer be meaningfully equivalent to the version originally assessed, raising a fundamental challenge as to whether the initial conformity assessment still captures the risks of what has effectively become a different system.
United KingdomPrinciples-based and sector-specific
The United Kingdom has taken a different path. Rather than introducing a single cross-sector AI statute, it has opted for a principles-based framework, implemented through existing regulators.
Authorities such as the Financial Conduct Authority, the Medicines and Healthcare products Regulatory Agency (MHRA), and the Information Commissioner’s Office are expected to interpret and apply high-level principles within their respective domains. The stated objective is flexibility and responsiveness, avoiding the rigidity of a single legislative framework. By leveraging sector expertise, the UK also aims to align governance with real-world use cases, including in healthcare and life sciences.
This model, relying on fragmentation, obviously carries its own risks too. Different regulators may interpret similar concepts such as fairness, transparency, or accountability in different ways. For organisations operating across sectors, this can translate into uneven expectations and increased compliance complexity.
In biomedicine, where data protection, medical device regulation, and clinical governance intersect, this plurality can create uncertainty about which standards ultimately prevail.
United StatesA state-led approach with a litigation backstop
In the United States, no single comprehensive federal AI law currently governs the field. Instead, the regulatory landscape is shaped by a combination of sector-specific oversight, emerging state legislation, and general legal principles.
For biomedical AI, the Food and Drug Administration plays a central role, particularly through its regulation of software as a medical device. The FDA has also begun to articulate approaches to adaptive AI systems, signalling an awareness of the challenges posed by continuously learning models.
Beyond sectoral oversight, states are increasingly active. Legislative initiatives, including those addressing automated decision-making and algorithmic accountability, are beginning to fill gaps at the federal level. For example, in California, the Transparency in Frontier Artificial Intelligence Act is particularly important for developers of large-scale models used in drug discovery or biological research, imposing transparency and safety-reporting obligations on “frontier” AI systems. New York has followed a similar path through its recent RAISE Act, further reinforcing state-level efforts to govern frontier AI development.
Colorado’s original Consumer Protections for Artificial Intelligence Act sought to mitigate algorithmic discrimination in high-risk AI systems, including those that may be used in consequential health-related decisions such as diagnostics and eligibility determinations. Although the legislation was subsequently revised and narrowed ahead of implementation, the new framework is expected to take effect on 1 January 2027 and continues to reflect concerns around fairness, bias, and accountability in automated decision-making. Utah, for its part, has adopted the Artificial Intelligence Policy Act, which focuses on disclosure obligations for generative AI interacting with consumers.
In this fragmented context, the December 2025 Executive Order on Artificial Intelligence and the White House’s National AI Legislative Framework (March 2026) were less about regulating AI directly than about signalling a federal preference for a more nationally consistent approach. Subsequent policy proposals and draft legislation suggest that federal pre-emption of at least some state AI requirements is no longer merely theoretical — although the United States remains, in practice, a predominantly state-led regulatory environment.
In practice, liability exposure through litigation — whether through consumer protection claims, product liability, or class actions — will act as a significant deterrent and governance driver. In effect, the framework will rely heavily on post-deployment accountability, allowing systems to be introduced ahead of settled standards, but with legal risk realised later, sometimes in unpredictable ways. For companies, this may shift the focus from formal compliance to defensibility.
SingaporeA set of operational governance playbooks
Singapore offers a more pragmatic and operationally focused model. Rather than prioritising binding legislation, it has developed detailed governance frameworks and practical toolkits.
The Model AI Governance Framework and associated initiatives include testing and assurance tools (AI Verify) designed to be directly implementable by organisations. The emphasis is on usability, clarity, and alignment with business processes.
This approach reflects a different philosophy and is really unique globally. Instead of codifying obligations in law or relying on formal certifications, Singapore seeks to shape behaviour through guidance that organisations can adopt, test, and adapt. In biomedical contexts, this can be particularly effective, as organisations are provided with concrete methods to assess risk, document decisions, and embed governance into system development to fit their exact needs and risks.
However, the model relies on voluntary adoption and does not carry the same legal force as statutory regimes. Its effectiveness therefore depends on organisational incentives and market expectations.
Figure 01 · Interactive Map the four approaches: AI governance in a fragmented landscape
Emerging convergence and the biomedical context
Despite these differences, a closer examination reveals a notable degree of convergence across jurisdictions around the core functions that AI governance must perform.
Accountability appears consistently, whether through internal responsibility, regulatory obligations, or liability exposure. Transparency also recurs, in different forms: explainability in certain contexts, user-facing disclosures or labelling, and internal documentation. Risk management is similarly embedded — not always through formal classification, but also through testing, mitigation and ongoing monitoring. Systems are expected to remain controllable, through human oversight, operational safeguards, and governance processes.
Alongside all this sits a growing expectation that system behaviour can be evidenced, through records, documentation, or audit trails. Auditability and traceability, once technical concerns, are now recognised as core governance requirements.
This coexistence of common governance expectations and differing regulatory approaches creates a challenge for organisations operating globally — which is not simply about complying with multiple regimes, but how to reconcile them into a coherent internal approach.
Many organisations now appear caught between the need to continue advancing AI systems without waiting for fully mature regulatory and standards frameworks, and a parallel hesitation to scale rapidly without clearer governance, validation and assurance mechanisms. This reflects the broader challenge facing many biomedical organisations as they seek to accelerate adoption while ensuring that systems remain clinically reliable, explainable and governable.
The biomedical paradox
For organisations in the biopharmaceutical and broader biomedical space, regulatory fragmentation is a critical challenge — because all patients, whether in Tokyo, Prague or Toronto, carry the same clinical need and the same right to the best available care. Science at its core cannot be localised, and the confidence thresholds of medical AI tools should not depend on the jurisdiction in which they are deployed. And yet the current reality is that the frameworks shaping how these tools are built, validated and brought to market are pulling in very different directions at once.
Organisations find themselves designing AI systems that are universal in their clinical ambition, but are being asked to operationalise them within governance landscapes that are either fragmented, still forming, or at times actively contradictory. Many companies are already grappling with the practical questions this raises: do you build to the most demanding standard available and absorb the cost? Do you wait for convergence — knowing it may never fully arrive? Or do you move forward, embedding governance principles solid enough to travel across borders, even before those borders agree on what to require?
In a sector where the cost of both moving too fast and waiting too long is ultimately borne by patients, these are not comfortable questions to leave open.
In this environment, organisations will increasingly rely on existing standards and governance frameworks — such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework and the standards of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) — to translate fragmented external expectations into operational processes, controls and oversight mechanisms. Alongside these, AI ethics will also serve as a practical tool to support risk assessment, prioritisation and decision-making.
On that basis, some companies are already developing parallel compliance structures to anticipate future requirements while responding to present constraints, with internal standards often designed to be acceptable across multiple jurisdictions even where formal obligations differ.
In that context, every design decision — whether related to data, oversight, validation or deployment — will align more naturally with certain governance models than others; and over time, as regulatory frameworks continue to evolve, these implicit choices will shape how easily these systems can adapt to enable responsible innovation under conditions of incomplete information.
Future publications will focus on how organisations can operationalise existing standards, AI ethics principles and governance practices into practical frameworks for oversight, decision-making and implementation.
AI Ethics & Governance
This is the first article in an ongoing BioLiterate series examining how AI ethics and governance are taking shape across the biomedical field — from the global regulatory landscape to the practical decisions organisations face as they move from experimentation to responsible scale. Future instalments will build on the framework introduced here.
