AI Act vs US AI Policy Framework: Regulatory Divergence and Its Impact on Global AI Governance

The global race to regulate artificial intelligence is accelerating—and companies can no longer afford to ignore it.

In this episode of Diritto al Digitale, Giulio Coraggio, Technology and Data Lawyer, analyzes the growing divergence between the EU AI Act and the US AI Policy Framework, two competing models that are reshaping AI governance, compliance, and innovation strategies worldwide.

The European Union is advancing a risk-based regulatory framework under the AI Act, reinforced by the latest developments of the Digital Omnibus package, introducing stricter obligations for high-risk AI systems, data governance, and compliance by design. At the same time, the United States is pursuing a more flexible, policy-driven approach based on soft law, voluntary standards, and ex post enforcement.

What does this mean in practice for companies operating globally?

This episode explores:

- The latest updates on the EU AI Act and Digital Omnibus
- The structure and impact of the US National AI Policy Framework
- Key differences between ex ante compliance and ex post enforcement models
- Legal, operational, and reputational risks for businesses using AI
- Why AI governance is no longer optional for organizations

If your business is developing, deploying, or integrating artificial intelligence, understanding these regulatory dynamics is critical to managing risk and staying competitive.

Listen now to gain practical insights into AI regulation, compliance strategies, and the future of global AI governance.

Send us Fan Mail

Episode Transcript

SPEAKER_00 (00:08):
There is a structural question that
companies, regulators andinvestors can no longer ignore.
If the real competitiveadvantage in artificial
intelligence is not thetechnology itself, but the
regulatory environment in whichtechnology is developed and
deployed.
Because today we're notwitnessing a single global

(00:29):
framework for artificialintelligence.
What we are witnessing isfragmentation.
On one side, the European Unionis refining a comprehensive
risk-based regulatory regimethrough the AI Act and the
latest development under theso-called digital omnibus
package.
On the other hand, the UnitedStates is consolidating a

(00:53):
policy-driven,innovation-oriented approach
through its national AI policyframework, recently approved,
and federal guidance.
This is not just a legaldivergence, it's a structural
shift that is alreadyinfluencing investment flows,
product design, data strategies,and ultimately market

(01:15):
leadership.
I'm Giulio Coraggio, atechnology and a data lawyer at
the global law firm GLA Fiber.
This is Diretto Digitale, thepodcast where we explore the
intersection between law andinnovation.

(01:36):
So let's start with Europe.
The AI Act represents the firstcomprehensive attempt globally
to regulate artificialintelligence through a binding
horizontal framework.
But what is particularlyrelevant today is not the text
of the AI Act itself, it's howthat text is evolving.
Recent developments linked tothe so-called Digital Omnibus

(02:00):
Initiative and positions adoptedby the European Parliament
through its committees as wellas the Council of the European
Union highlight a clear trend.
Implementation complexity isforcing regulatory
recalibration.
We're seeing postponement ofobligations relating to
high-risk AI systems potentiallyshifting key deadlines to 2027

(02:25):
and 2028.
The reintroduction andstrengthening of registration
requirements in the EU databasefor high risk systems, the
confirmation of stricterconditions for processing of
special categories of personaldata, and the introduction of
new prohibited practices,including AI systems generating

(02:46):
non-consensual intimate content.
This is not the regulation.
It's regulatory engineering.
The EU is acknowledging thatenforceability is as critical as
ambition.
So, the EU model, how it'sstructured.
The AI Act is built on astructured risk taxonomy.
AI systems are classified intoprohibited systems, high risk

(03:09):
systems, limited risk systems,and minimal risk systems.
For high risk systems, theregulatory burden is significant
and highly operational.
Companies must implement robustrisk management systems aligned
with life cycle obligations,data governance frameworks,
ensuring quality, relevance andbias mitigation, extensive

(03:31):
technical documentation andrecord keeping, human oversight
mechanisms, conformityassessments, and registration in
the EU database.
This is not simply a legalframework.
It's a compliance architecture.
It effectively embeds regulatoryrequirements into the design,
development and deployment of AIsystems, what we can define as

(03:53):
compliance by design and bydefault.
However, this approach has clearimplications.
It increases time to market,operational costs, and internal
governance complexity.
If we shift to the UnitedStates, the paradigm changes
entirely.
There is no single comprehensivefederal AI law equivalent to the

(04:14):
AI Act.
Instead, the US regulatorylandscape is characterized by
the national AI policyframework, recently approved,
executive orders,sector-specific regulations, and
stronger reliance on existinglegal tools, including consumer
protection and competition law.
The approach is fundamentallydifferent.

(04:35):
It prioritizes innovation andtechnological leadership,
public-private collaboration,flexible standards, and
enforcement primarily exposed.
Even when regulatoryintervention occurs, it often
takes the form of voluntarycommitments, soft law
instruments, or agency guidance.

(04:55):
This creates a significantlymore agile environment for AI
development, but it also shiftsrisks from an exante compliance
to exposed liability.
So there are two models and tworegulatory philosophies.
At this stage, it's clear thatwe're not simply comparing two

(05:15):
regulatory frameworks.
We are comparing two differentregulatory mindsets, two
different approaches.
The U model is precautionary.
It assumes that the AI systemsinherently generate risks that
must be mitigated beforedeployment.
The US model is permissive.
It assumes that innovationshould not be constrained unless

(05:38):
and until concrete risksmaterialize.
This divergence has immediatepractical consequences.
For example, an AI provideroperating in the EU must
integrate compliance processesat the earliest stages of
development.
The same provider in the US mayprioritize speed, scalability,

(05:59):
and market penetration,addressing legal risks at a
later stage.
For globally active companies,this is not a theoretical
debate.
It's an operational challengebecause they cannot choose one
model over the other.
They must manage bothsimultaneously.
This creates a need for amulti-layered AI governance

(06:20):
framework, jurisdiction-specificcompliance strategies, and
scalable internal controlscapable of adapting to different
regulatory expectations.
And this is where manyorganizations are currently
exposed.
Because without a structured AIgovernance model, companies risk
integrating AI solutions intotheir core operations without

(06:42):
fully assessing regulatoryrisks, data protection
implications, liabilityexposure, and compliance
obligations.
The issue is timing.
These risks often emerge whenthe AI system is already
embedded in business processes.
At that point, remediationbecomes significantly more
expensive.

(07:03):
Operational disruption increasesand reputational damage becomes
a concrete risk.
There is a narrative suggestingthat regulation slows
innovation, but it is in manyrespects an oversimplification.
The absence of regulation doesnot eliminate risks.
It redistributes it and oftenamplifies it.

(07:25):
The real question is not whetherregulation is needed, it's
whether we can design regulatoryframeworks that are predictable,
scalable, and technologicallyneutral.
Because ultimately, legalcertainty is itself a driver of
innovation.
Looking ahead, several adoptionswill be critical.
In the European Union, thefinalization of the digital

(07:47):
omnibus adjustments, theprogressive implementation of
the AI Act, and the developmentof secondary legislation and
standards.
In the US, further consolidationof federal AI policies,
increased activity by regulatoryagencies, and potential
sector-specific legislativeinterventions.
At the global level, we expectincreasing regulatory

(08:09):
competition and possibly gradualconvergence driven by market
forces.
So let me leave you with thisquestion.
Will the future of artificialintelligence be shaped primarily
by engineers or by regulators?
And more importantly, arecompanies truly prepared to
operate in a world where AIregulation moves at a different

(08:32):
speed across jurisdictions?
If you have views on this topic,feel free to reach me out at
julio.com.
And if you found this episodeinteresting, subscribe to the
podcast, activate thenotification bell, and leave us
a five-star review on ApplePodcasts or Spotify.
I'm Giulio Coraggio, this is thepodcast Diritto Digitale.