The Regulatory Overlay

AI regulation globally operates along two independent axes. First, subject matter: what the law targets. Three species dominate — Frontier Model Safety (regulating the largest, most capable models at the development layer), Algorithmic Discrimination (protecting individuals from biased automated decisions in employment, housing, credit, and healthcare), and Transparency & Disclosure (requiring notice, explanation, and documentation when AI processes personal data or makes consequential decisions). Second, approach: Comprehensive Framework jurisdictions (a single integrated AI law covering multiple species — EU, Korea, Brazil, Canada's historical trajectory with AIDA) versus Soft Law/Innovation First jurisdictions (voluntary frameworks, sectoral rules, and regulatory sandboxes — Japan, Singapore, UAE, Saudi Arabia).

The approach axis tells you how hard the obligation bites. A principles-based obligation under a sandbox regime is a different contractual animal than a prescriptive obligation under a comprehensive framework with €35M fines. Both axes matter for procurement: the subject-matter axis tells you which battlegrounds matter most under which regulator; the approach axis tells you how to calibrate the contractual response.

In the US, no federal AI law exists. State pressure comes from three directions. Algorithmic discrimination: Colorado's AI Act (SB24-205, effective February 1, 2026) imposes a duty of reasonable care on developers and deployers of high-risk AI systems to protect consumers from algorithmic discrimination — with an affirmative defense for organizations aligned with NIST AI RMF or ISO 42001 (a direct incentive to anchor contracts to those frameworks). New York City's Local Law 144 requires bias audits for automated employment decision tools (enforcement active). Transparency and disclosure: California continues rulemaking on automated decision-making technology under the California Privacy Rights Act. Frontier model safety: California's frontier model safety efforts sit at the development layer and do not directly regulate enterprise deployers — but they affect your vendor's model provider obligations.

Globally, the EU AI Act is the high-water benchmark. It entered into force August 1, 2024, with obligations phasing in through August 2026, and classifies systems by risk. High-risk systems trigger obligations for data governance, transparency, accuracy, robustness, and human oversight. Fines reach €35 million or 7% of global annual turnover. For any buyer whose vendor's AI system processes data in the EU or serves EU-based users, the EU AI Act's obligations are extraterritorial and immediate. Korea's AI Basic Act and Brazil's proposed AI framework follow the same structural pattern.

Canadian buyers face three live pressures, none of which wait for federal AI legislation. PIPEDA enforcement: the Office of the Privacy Commissioner, alongside provincial counterparts in Quebec, British Columbia, and Alberta, has made clear that existing privacy law applies to AI processing. The OPC's joint investigation into large language model providers established: publicly accessible training data does not mean consent-free; user interfaces must enforce privacy by default; indefinite retention of personal information used in training is unacceptable. Quebec Law 25 is in force with administrative penalties and directly challenges AI systems that process data through third-party model inference providers — every sub-processor in the AI supply chain must be disclosed and flow-down terms must reflect Quebec's heightened standard. British Columbia PIPA and Alberta PIPA impose consent and breach-notification regimes, with BC's commissioner actively enforcing in AI-driven processing contexts.

Canada's AIDA (Bill C-27) would have established a comprehensive framework with high-impact system classification, transparency obligations, and human oversight requirements. It died on the order paper when the 44th Parliament dissolved in January 2025 but remains the most detailed legislative signal of where Canadian federal law is heading. The regulatory change clause is the contractual answer: if a change in applicable law renders continued use of the AI Services unlawful, subject to regulatory pre-market authorization that the Provider cannot reasonably obtain, or commercially unreasonable due to new compliance costs, the customer may terminate without penalty. Both sides must be able to pause quickly when the regulatory environment shifts.

Red Flags

• Silence on risk classification under the EU AI Act — no acknowledgment of which risk tier the vendor's system falls into
• No training data provenance representation and no notification obligation if a challenge arises
• No regulatory change exit mechanism — the buyer is locked in if new law renders the service commercially unreasonable
• Audit rights limited to SOC 2 reports with no NIST AI RMF or ISO 42001 alignment documentation
• Governance warranty that references internally defined benchmarks with no reference to recognized frameworks