For most of the last three years, “AI regulation” in board conversations meant one thing: the EU AI Act. That is no longer true. In 2026 a company that builds or deploys AI across North America, Europe and Asia-Pacific faces a patchwork of national and state laws with different definitions, different risk tiers, different labeling rules and very different timelines. South Korea’s AI Basic Act took effect in January. Vietnam’s first Law on Artificial Intelligence took effect in March. Texas began enforcing prohibited-use rules, California’s frontier transparency and automated decision-making rules went live, and Colorado rewrote its landmark AI statute and moved its start date to 2027.
The temptation is to treat each law as its own project. That approach does not scale and produces contradictory controls. This article explains what changed, where the rulebooks overlap and diverge, and how to design one AI compliance program that can absorb new laws without being rebuilt every quarter.
Why AI Regulation Fragmented Instead of Converging
Many observers expected the EU AI Act to become a global template, the way GDPR shaped privacy law. Instead, governments made different bets. The EU chose a comprehensive, product-safety style framework with prohibited practices, high-risk conformity assessment and general-purpose AI obligations, and has since been adjusting its timelines through the Digital Omnibus process (we cover that in a separate article). Asian governments generally paired light-touch obligations with strong industrial-promotion goals. The United States, lacking a federal statute, let states legislate while the federal executive pushed in the opposite direction.
Three forces drove the divergence:
- Industrial policy. Korea and Vietnam framed their laws as foundations for national AI industries, with promotion measures, sandboxes and infrastructure commitments sitting beside the obligations.
- Federal–state tension in the US. Executive Order 14365 of December 11, 2025, “Ensuring a National Policy Framework for Artificial Intelligence,” directed a Justice Department litigation task force and a Commerce Department review of state AI laws, but it did not itself preempt them. State laws remain operative unless a statute, valid agency action or court ruling displaces a specific provision.
- Different harms in focus. Some laws target frontier model safety, some target discrimination in consequential decisions, and others target deepfakes and synthetic content. A single company can be in scope of all three for different systems.
The 2026 Rulebook at a Glance
The summaries below are planning-level orientation, not legal advice. Always confirm final statutes, decrees and agency rules with counsel in each jurisdiction.
Vietnam: Law on Artificial Intelligence
According to Baker McKenzie’s analysis, Vietnam’s National Assembly passed the Law on Artificial Intelligence on December 10, 2025, and it took effect on March 1, 2026. It uses three risk tiers (high, medium and low) based on impact on rights, safety and security, sector, user scope and scale. There is no separate “unacceptable risk” tier, but the law lists prohibited acts such as manipulative or deceptive uses that cause serious harm and obstructing human oversight. High-risk systems face periodic audits, and the Prime Minister will publish the list of systems requiring pre-market conformity certification. Providers must mark AI-generated audio, image and video in a machine-readable way, while deployers must disclose when content could confuse people about authenticity. The law applies to foreign as well as domestic entities active in Vietnam, and providers of certain high-risk systems need a commercial presence, an authorized representative or a contact point in the country. Most existing systems have until March 1, 2027 to comply, extended to September 1, 2027 for health, education and finance.
South Korea: AI Basic Act
Cooley’s overview notes that Korea’s AI Basic Act took effect on January 22, 2026. It defines “high-impact AI” as systems that significantly affect life, safety or fundamental rights, with examples in healthcare, energy, transportation, hiring and biometric analysis. Generative AI operators must label generated output, and realistic synthetic sound, images and video require clear notice. Foreign businesses without a Korean office must appoint a domestic agent if they exceed revenue or user thresholds (for example, more than one million average daily Korean users). Administrative fines are modest, up to 30 million won, and the science ministry has signaled a one-year grace period before imposing them.
United States: A State-by-State Map
- Colorado. The original Colorado AI Act was delayed to June 30, 2026, then repealed and reenacted by SB 26-189 in May 2026 around automated decision-making technology. Core developer and deployer duties now begin January 1, 2027, enforced by the attorney general.
- Texas. The Texas Responsible AI Governance Act (TRAIGA) brought prohibited-use provisions into force in January 2026, focused on intentional harmful uses rather than broad risk management.
- California. SB 53, the Transparency in Frontier Artificial Intelligence Act, requires large frontier model developers to publish safety frameworks and report critical incidents, and the California Privacy Protection Agency’s automated decision-making technology rules under the CCPA began phasing in during 2026.
Others Worth Tracking
Japan’s AI Promotion Act (2025) is principles-based and relies on government guidance rather than penalties. China’s measures for labeling AI-generated content, effective since September 2025, require explicit and implicit labels. Sector regulators everywhere, from banking supervisors to health authorities, continue to apply existing model risk, consumer protection and anti-discrimination law to AI systems regardless of whether an AI-specific statute exists.
Where the Rulebooks Overlap: Six Common Obligation Families
Read side by side, these laws look very different. Decomposed into obligations, they converge on a surprisingly small set of themes. This is the key insight for program design: you build controls against obligation families, then map each law onto them.
- Inventory and classification. Every regime assumes you know which AI systems you provide or deploy and which risk tier each falls into. Vietnam’s three tiers, Korea’s high-impact category, Colorado’s consequential decisions and the EU’s high-risk annexes all require a classification step.
- Transparency to users. Disclosing that people are interacting with AI, and labeling synthetic content, appears in the EU, Korea, Vietnam, China and several US state laws.
- Risk and impact assessment. Documented assessment of foreseeable harms, especially discrimination and safety risks, before deployment and after significant changes.
- Human oversight. The ability for people to monitor, override or appeal AI-driven outcomes, explicitly protected in Vietnam’s list of prohibited acts and central to the EU and Colorado frameworks.
- Documentation and record-keeping. Technical documentation, data provenance, logs and evidence that controls actually ran.
- Local accountability. Representatives, contact points or agents in the jurisdiction, plus incident reporting channels to regulators.
Do not build a compliance project per law. Build controls per obligation family, then maintain a living map from each statute to those controls. New laws become mapping exercises instead of rebuilds.
Where They Diverge: The Details That Bite
Convergence at the family level does not mean one artifact satisfies everyone. The differences tend to cluster in a few places, and these are where multinational programs most often get caught out:
- Definitions of scope. “High-risk,” “high-impact” and “consequential decision” capture overlapping but not identical systems. An HR screening tool is likely in scope almost everywhere; a customer-service chatbot may only trigger transparency duties.
- Labeling mechanics. Machine-readable marking (Vietnam, China, the EU) is a technical requirement that touches your media pipeline, while visible notices are a UX requirement. You usually need both, and formats are still being specified in decrees and codes of practice.
- Timelines and grace periods. Korea’s fine grace period, Vietnam’s 2027 transition dates, Colorado’s January 2027 start and the EU’s adjusted high-risk dates create a staggered calendar that must be tracked per system, not per company.
- Local presence. Thresholds for appointing representatives differ, and some are tied to revenue or user counts that change year to year.
- Enforcement posture. Some regimes emphasize cure periods and guidance; others carry significant penalties. Your prioritization should reflect both exposure and likelihood of enforcement.
A Step-by-Step Playbook for a Multi-Jurisdiction Program
Step 1: Build a Single AI System Register
Create one register for every AI system you build, buy or embed, including AI features inside SaaS tools. For each entry capture purpose, users, data categories, model provenance (in-house, open-weight, API), decisions influenced, and the countries and states where it is offered or used. Geography is the field most programs forget, and it is the one that determines which laws apply.
Step 2: Create a Unified Classification Rubric
Design one internal rubric with questions that resolve each jurisdiction’s tier at the same time. For example: Does the system influence employment, credit, housing, education, healthcare or essential services? Does it process biometric data? Does it generate realistic media? Does it interact directly with consumers? Answers drive a matrix that outputs the EU, Korean, Vietnamese and US state classifications in one pass.
Step 3: Write Controls Once, Tag Them Many Times
Draft a control library organized by the six obligation families. Each control gets an owner, an evidence requirement and tags indicating which laws it satisfies. ISO/IEC 42001 and the NIST AI Risk Management Framework are useful scaffolds because regulators in several jurisdictions reference them, and they give your control library a recognizable structure for auditors.
Step 4: Engineer Transparency Into the Platform
Labeling and disclosure should be platform capabilities, not per-team tasks. Embed provenance metadata (for example, C2PA content credentials) at generation time, standardize chatbot disclosure components in your design system, and log when notices were shown. This turns a recurring legal question into a reusable engineering feature.
Step 5: Maintain a Regulatory Calendar per System
Link each register entry to the obligations and dates that apply to it. A Vietnamese health-sector deployment and a Colorado lending model have different deadlines, and treating them as one corporate date wastes effort or misses obligations.
Step 6: Assign Local Accountability
Decide where you need representatives or contact points, who handles regulator correspondence, and how incidents flow from engineering to legal to the relevant authority within required timeframes.
Step 7: Monitor and Re-Map Quarterly
Implementing decrees in Vietnam, enforcement guidance in Korea, Colorado rulemaking and EU standards are all still landing. Schedule a quarterly re-mapping review in which legal and engineering update the statute-to-control map and flag any control gaps.
A Hypothetical Worked Example
Consider a hypothetical mid-sized software company headquartered in Europe, with customers in the US and a growing user base in Korea and Vietnam. It offers three AI capabilities: a résumé-screening module inside its HR product, a generative marketing assistant that creates images and copy, and a customer-support chatbot.
Running its unified rubric, the company finds that the résumé screener is high-risk under the EU AI Act, plausibly high-impact under Korea’s definition, a likely high-risk candidate under Vietnam’s forthcoming list, and a consequential-decision system once Colorado’s duties begin in 2027. The marketing assistant triggers synthetic-content labeling in the EU, Korea, Vietnam and China-facing campaigns. The chatbot mainly triggers user-disclosure obligations.
Rather than four compliance projects, the company implements one impact assessment template covering bias testing, human review of rejections and applicant notices for the screener; a platform-level C2PA and visible-label capability for the assistant; and a shared disclosure component for the chatbot. Each control is tagged to the laws it satisfies. When Colorado finalizes its rules, the team updates tags and adds one notice requirement rather than restarting.
Common Pitfalls
- Assuming the EU AI Act is the strictest everywhere, and missing local-presence or labeling rules that the EU does not impose.
- Treating the US federal preemption push as settled law. As of this writing it is policy direction and litigation, not a statute.
- Ignoring AI inside purchased software. Deployer obligations usually apply even when the model is a vendor’s.
- Documenting policies without evidence. Regulators and auditors increasingly ask for logs, test results and records that controls operated.
- Leaving classification to individual product teams without a shared rubric, which produces inconsistent answers for similar systems.
Outlook: 2027 and Beyond
The calendar for 2027 is already crowded: Vietnam’s transition periods end in March and September, Colorado’s duties start in January, Korea’s fine grace period will have run out, and EU high-risk obligations move closer under the adjusted timeline. Expect further implementing decrees, technical standards for content marking, and more sector-specific guidance from financial and health regulators.
We also expect convergence at the level of evidence rather than law. As ISO/IEC 42001 certification, standardized model documentation and content provenance become routine, organizations that can produce consistent evidence on demand will spend far less on each new regime. The winners will be the companies that treat AI compliance as an operating capability embedded in platforms and workflows, not a series of legal fire drills.
Conclusion
Fragmentation is the defining feature of AI regulation in 2026, but it does not have to mean fragmented compliance. Start with a single register that captures geography, classify systems with one rubric, build controls once per obligation family, and push transparency into your platform. With that foundation, each new law, whether in Hanoi, Seoul, Denver or Brussels, becomes a mapping update rather than a new program.
How Hanoi Technology Can Help
Hanoi Technology helps organizations build AI registers, classification rubrics and reusable control libraries that hold up across multiple jurisdictions.