Baker McKenzie | Theo Ling, Michael Rubinger, Jim Holloway and Conrad Flaczyk

Global | United Kingdom | USA

This article is an extract from Lexology Panoramic Next: Artificial Intelligence 2026. Click here for the full guide.

Theo Ling heads Baker McKenzie’s Canadian data and technology practice and is a member of the firm’s global International Commercial practice group, and technology, media and telecoms and financial institutions industry groups. Theo helps market-leading businesses develop and implement global strategies to support multi-jurisdictional commercial activities and manage complex cross-border compliance risks. The focus of Theo’s international commercial/regulatory practice is on data and technology-related issues, which include digital transformation and data governance projects that involve data privacy, data security, electronic payments, data monetisation, records retention, media/format, electronic signatures, cross-border data transfers, digitisation, fintech, and AI and machine learning considerations. He also advises clients on internet services involving smart/connected devices subject to telecom and broadcasting laws.

Jim Holloway is an experienced litigator and trusted strategic adviser whose practice focuses on IP law and technology, including trademark, copyright, patent and trade secret disputes. Jim advises clients on the development and protection of their intellectual property assets, as well as how to avoid or manage risk. Jim also handles anti-counterfeiting litigation, diversion and grey market matters, unfair competition claims, marketing and advertising complaints, licensing and distributorship disputes, breach of confidentiality matters and product liability claims involving technology.

Michael Rubinger is a senior associate in Baker McKenzie’s global Commercial group in Canada. He regularly advises clients in connection with IP transactions, licences and litigation, and assists with managing and enforcing clients’ global IP portfolios. Mike was recently recognised as a Rising Star in IP STARS by Managing IP.

Conrad Flaczyk is a senior associate in Baker McKenzie’s global Commercial group and a Canadian data and technology lawyer. Conrad’s practice focuses on AI and data governance, complex and cross-border privacy and cybersecurity issues, regulatory investigations, and building data compliance programs in highly regulated sectors like financial services, telecoms, banking, and consumer-facing businesses. He also advises on the roll-out of new offerings such as AI systems, virtual currencies, payment systems, video games, hardware products, software, and data-heavy consumer offerings, including with respect to commercial agreements, interactions with regulators, and consumer-facing policies.

From AI principles to operational accountability

Artificial intelligence has entered a new phase. For many organisations, the defining challenge for 2026 is no longer whether AI will be adopted, but how its use will be governed in practice.

For several years, governments, regulators, and international organisations have focused on developing principles for trustworthy and responsible AI. While those principles remain important, organisations are increasingly being asked to demonstrate how they being implemented in practice, focusing on whether organisations can explain how an AI system was tested, what data it uses, what safeguards have been implemented, who is responsible for oversight, and how risks are monitored and mitigated throughout the lifecycle of the system.

In short, questions that were once largely theoretical or principle-based are becoming operational, and these questions are especially challenging for global organisations that operate across multiple regulatory environments that take different approaches to AI regulation and legal enforcement.

Regulatory approaches continue to diverge

While many jurisdictions are pursuing the same broad objectives of accountability, transparency and risk management, they are doing so through markedly different legal frameworks. Broadly speaking, current approaches can fall into several categories:

  • Comprehensive AI legislation: The European Union and South Korea have adopted dedicated AI frameworks built around risk-based obligations and defined AI requirements.
  • Existing law and sectoral approaches: Jurisdictions such as the United Kingdom, Canada, and the United States continue to rely, to varying degrees, on existing legal frameworks, sector-specific regulation, standards, guidance and targeted measures.
  • Technology-specific regulation: China regulates AI through overlapping rules governing algorithms, generative AI, synthetic content, data governance and online platforms.
  • Innovation-focused governance: Japan combines AI development with proportionate risk management and government guidance rather than a highly prescriptive compliance regime.

While regulatory models differ, practical expectations are increasingly converging. Organisations across jurisdictions are being expected to understand where and how AI is used, assess and document risk, implement appropriate safeguards, maintain meaningful human oversight, and retain evidence demonstrating that governance controls operate effectively in practice.

The defining challenge for 2026 is therefore not merely compliance with a particular AI law or requirement, but translating broad principles of responsible AI into operational accountability. For global organisations, the difficulty lies in doing so across multiple jurisdictions that apply different regulatory models while increasingly expecting similar evidence of governance, oversight, and risk management.

The regulatory landscape in 2026

The principal regulatory models differ materially in structure, territorial reach, and enforcement. For multinational organisations, the practical challenge lies in identifying which aspects of an enterprise governance framework can be applied consistently across markets and which require local classification, notices, documentation, product features or regulatory engagement.

European Union: implementation becomes a central issue

The EU Artificial Intelligence Act (EU AI Act) remains the most comprehensive horizontal AI law adopted by a major market and region, and provides a clear example of the shift from AI principles to operational accountability. The EU AI Act has moved the regulatory conversation beyond high-level concepts such as transparency, fairness, and human oversight toward more practical questions concerning governance, documentation, testing, accountability, and evidence.

Much of the discussion surrounding the Act initially focused on classification, such as whether an AI system constitutes a prohibited or high-risk system, or whether it is subject to transparency obligations. In 2026, however, classification is now only the starting point; a more significant challenge is the organisation’s operationalisation. Depending on the system and company, compliance may require:

  • risk management and governance processes;
  • technical documentation and record-keeping;
  • testing, monitoring, and incident management;
  • copyright compliance and publication of information about training content (particularly for general-purpose AI model providers);
  • transparency and human-oversight measures; and
  • information required by other participants in the AI supply chain.

For multinational organisations, the Act is increasingly functioning as a global governance reference point. However, using the EU framework as a baseline does not eliminate the need for local analysis. Other jurisdictions may classify the same system differently, regulate different participants or impose different disclosure and operational requirements.

United States: accountability tested through enforcement and litigation

The United States illustrates a different route from AI principles to operational accountability. Rather than imposing a comprehensive federal AI framework, accountability is emerging through existing federal laws, an expanding patchwork of targeted state-level AI and privacy legislation, litigation, and aggressive enforcement by federal agencies such as the Federal Trade Commission, the Equal Employment Opportunity Commission, and the Consumer Financial Protection Bureau, leveraging existing statutory powers to police algorithmic bias, unfairness, and deception.

Legal scrutiny often focuses on the activity, representation or outcome involving AI. Depending on the use case, AI deployments may attract scrutiny under consumer protection, employment, civil rights, privacy, financial-services, healthcare, intellectual property or securities laws. State-level measures increasingly supplement these frameworks with targeted AI-related requirements.

As a result, operational accountability is frequently assessed through enforcement investigations, litigation, and contractual disputes. Regulators, claimants, and counterparties may examine:

  • why the system was selected for the intended use;
  • what representations were made about its capabilities;
  • how those representations and the system’s performance were evaluated;
  • which risks and known limitations were identified;
  • what safeguards were implemented; and
  • who retained responsibility for oversight.

The practical implication is that testing, documentation and governance records increasingly function not only as governance tools, but as evidence supporting deployment decisions.

The EU and US frameworks differ in structure, but increasingly converge in practical effect. The EU AI Act prescribes many governance obligations through a comprehensive, role-based framework. In contrast, the United States often evaluates the adequacy of governance through existing legal duties, targeted regulatory requirements, enforcement actions, litigation and contractual risk. In both cases, broad commitments to responsible AI are becoming less important than an organisation’s ability to demonstrate how a particular AI deployment was governed in practice.

Canada: operational accountability through existing law and cross-border compliance

Canada entered 2026 without comprehensive federal private-sector AI legislation. The proposed Artificial Intelligence and Data Act did not become law before the dissolution of Parliament. As a result, privacy, human rights, consumer protection, competition, employment, intellectual property, securities, and sector-specific laws continue to perform much of the immediate regulatory work relating to AI. Public sector directives, procurement requirements, and regulatory guidance are also shaping expectations concerning risk assessment, transparency, documentation, and human oversight.

This framework places less emphasis on whether an AI system falls within a prescribed statutory category and greater emphasis on the context in which the system is used. The central compliance question is often whether an organisations can identify the legal regimes applicable to a particular deployment, justify its use of data, assess potential impacts on individuals, and demonstrate that appropriate safeguards and oversight mechanisms are in place. As AI systems become integrated into decisions affecting employment, services, benefits and other significant interests, those requirements are becoming increasingly operational rather than theoretical.

Canada also highlights the growing importance of cross-border AI governance. Canadian organisations developing AI systems or offering AI-enabled products and services internationally may become subject to foreign requirements that are materially more prescriptive than domestic law, such as the EU AI Act that may impose role classification, documentation, transparency and governance obligations on Canadian organisations whose services or outputs fall within its scope.

The practical effect is that operational accountability in Canada is increasingly assessed through the interaction of existing Canadian legal frameworks and foreign regulatory expectations. Even without a comprehensive AI statute, organisations are being expected to demonstrate how AI systems are governed, how risks have been assessed, what safeguards have been implemented and who remains accountable for the resulting outcomes. Canada reinforces the broader global trend of movement from high-level AI principles toward demonstrable and evidence-based governance in practice.

United Kingdom: operational accountability through existing regulators

The United Kingdom continues to favour regulation through existing legal frameworks and sectoral regulators rather than a comprehensive horizontal AI statute. AI-related issues are therefore addressed through established regimes such as data protection, consumer protection, competition, financial services and communications regulation, with existing regulators expected to apply their powers to AI-enabled activities.

A central question is increasingly not whether new AI principles are needed, but whether existing regulatory institutions can apply them effectively to emerging technologies. An AI deployment may simultaneously engage the Information Commissioner’s Office, the Competition and Markets Authority, the Financial Conduct Authority or other sectoral regulators, depending on how the system is used. A challenge for organisations is therefore often one of regulatory coordination rather than compliance with a single AI statute.

In that respect, the United Kingdom highlights a different aspect of the 2026 landscape: the challenge is increasingly institutional rather than legislative. The question is not simply whether organisations have adopted responsible AI principles, but whether they can satisfy multiple regulators that those principles are operating effectively in practice.

China: operational accountability through function-specific regulation

China has not adopted a single comprehensive AI statute comparable to the EU AI Act. Instead, it regulates AI through binding technology-specific rules, administered largely by the Cyberspace Administration of China (CAC), governing recommendation algorithms, generative AI services, deep-synthesis technologies, data security, and personal information protection under the Personal Information Protection Law (PIPL).

As a result, compliance obligations are often determined by the functions performed by a system rather than by a single risk classification applicable to the system as a whole.

This creates a different operational challenge from that seen in the European Union or the United States. Organisations cannot assume that a single AI assessment will identify all relevant obligations. A generative AI service may simultaneously engage requirements relating to training data, cybersecurity, content governance, transparency and platform responsibilities. Different legal requirements may apply depending on whether a system recommends content, generates content, modifies content or distributes content.

For businesses, the starting point is often not classifying the AI system itself, but mapping its functions and deployment model against the applicable regulatory regimes. Questions such as whether the service is publicly available, generates content, distributes information, processes personal information or operates through an online platform may be as important as the underlying model architecture. Compliance therefore requires a detailed understanding of how the system operates in practice rather than a high-level assessment of the technology alone.

Japan: operational accountability through guidance and market practice

Japan has adopted a markedly different approach from the European Union’s prescriptive model. The Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology establishes a national framework for AI development, innovation and governance, but does not impose the type of detailed risk classifications, conformity assessments or operational requirements found in the EU AI Act. Instead, Japan continues to rely heavily on government guidance, voluntary governance measures, and the application of existing legal frameworks. While it avoids the highly prescriptive, rigid risk tiers of the EU AI Act, it empowers government bodies to investigate severe risks, issue administrative guidance, and intervene if systems violate public rights and safety.

This approach places particular emphasis on organisational judgment and accountability. Rather than asking whether a system falls within a prescribed regulatory category, organisations are increasingly expected to determine for themselves what safeguards are appropriate for a particular use case, taking into account factors such as the nature of the deployment, the risks posed to individuals and the potential consequences of error. Existing privacy, consumer-protection, competition, intellectual property and sector-specific laws continue to provide important legal constraints on AI deployment.

The practical challenge is therefore less about satisfying a detailed statutory rulebook and more about demonstrating that governance decisions were reasonable and proportionate. Organisations increasingly need to be able to explain how risks were assessed, why particular controls were selected and how oversight is maintained as systems evolve. In practice, customer expectations, industry standards, procurement requirements and government guidance may shape governance obligations as significantly as legislation itself.

Building a globally defensible AI governance program

Sophisticated multinational programs generally do not cover every local legal requirement into a separate policy. They establish a common operating model that supports local compliance and produces evidence when challenged. Seven governance pillars are recurring across jurisdictions.

1. Inventory and ownership: maintaining an up-to-date inventory of AI systems and material use cases, and identifying responsible business and technical owners, vendors, connected data, affected jurisdictions and purposes

Inventories increasingly extend beyond internally developed systems to include embedded AI functionality, enterprise software with AI features, vendor-provided services, application programming interface integrations and employee-procured tools. Increasingly, organisations are attempting to track not only the technology itself, but also:

  • the business purpose of the deployment;
  • responsible business and technical owners;
  • key vendors and service providers;
  • connected datasets and systems;
  • affected jurisdictions; and
  • whether the system generates content, supports decisions or takes actions.

2. Risk assessments

Risk assessments increasingly focus on questions such as:

  • Who could be affected by the system?
  • What decisions or actions does it influence?
  • How significant are the consequences of error?
  • Does the system operate autonomously or support human decision-making?
  • Could the deployment affect legal rights, employment, access to services or safety?

3. Data and model governance: documenting data sources, permissions, restrictions, model versions, data retention periods, and material configuration decisions

As organisations increasingly rely on foundation models, third-party datasets and retrieval systems, governance is expanding from “what model was used?” to “what ecosystem of data, models and external services supports deployment?” Across jurisdictions, increasing attention is being paid to:

  • data provenance and licensing;
  • personal -information use;
  • confidential or proprietary information;
  • model versions and updates;
  • retention practices;
  • fine-tuning and customisation activities;
  • retrieval systems and connected repositories; and
  • significant changes in functionality or deployment scope.

4. Testing, monitoring and incident management

Testing and monitoring are increasingly being examined not only as governance controls, but as evidence supporting deployment decisions. Whether scrutiny arises under AI-specific laws, privacy regulation, employment law, litigation or contractual disputes, organisations are increasingly being asked how a system was evaluated and monitored over time. Areas frequently receiving attention include:

  • performance and accuracy testing;
  • robustness and resilience;
  • cybersecurity assessments;
  • bias and fairness analysis;
  • documented limitations;
  • incident escalation procedures; and
  • post-deployment monitoring.

The focus is increasingly moving from whether testing occurred to whether the testing reflected the actual use case, user population and deployment environment.

5. Human accountability, transparency and recourse

Human oversight remains a recurring feature of AI governance, but expectations are becoming more sophisticated. Many regulatory frameworks now focus less on whether a human appears somewhere in the workflow and more on whether meaningful accountability exists in practice. Increasing attention is being paid to:

  • who may approve deployment;
  • who may review outputs;
  • who may override or suspend a system;
  • who remains accountable for resulting decisions; and
  • what information is available to users or affected individuals.

As systems become more autonomous and are integrated into consequential decisions, questions concerning responsibility and authority are becoming increasingly important.

6. Third-party governance and contractual controls

Because many organisations deploy AI through third-party providers, contractual governance is becoming a significant component of AI risk management. Commercial negotiations increasingly address:

  • use of customer data;
  • confidentiality protections;
  • security obligations;
  • model updates and material changes;
  • subcontractor use;
  • audit and transparency rights;
  • incident notification;
  • intellectual -property allocation;
  • regulatory support obligations; and
  • transition and termination assistance.

For many organisations, contractual diligence is increasingly functioning as an extension of the governance framework, particularly where the organisation does not control the underlying model.

7. Evidence of governance

Perhaps the most significant common theme across jurisdictions is that governance is increasingly being evaluated through evidence rather than policy statements.

Whether scrutiny arises through AI-specific legislation, existing legal frameworks, regulatory inquiries, procurement processes, contractual disputes or litigation, the same questions arise:

  • Why was the system deployed?
  • What risks were identified?
  • What controls were implemented?
  • Who approved the deployment?
  • What monitoring occurred?
  • What evidence supports those decisions?

The ability to answer those questions consistently is becoming one of the defining characteristics of mature AI governance programs. This trend is visible across both prescriptive regulatory regimes and jurisdictions that continue to rely primarily on existing law, guidance and market practice.

Conclusion

The global AI landscape in 2026 is defined by simultaneous convergence and divergence. Jurisdictions differ substantially in legislative form, scope, enforcement and policy philosophy.

Yet practical expectations are becoming more consistent. Businesses are increasingly expected to identify their AI systems, understand their regulatory roles, assess foreseeable harms, govern data, test material risks, preserve human accountability, oversee vendors, monitor deployment and maintain evidence of their operational compliance.

A central lesson for 2026 is not that organisations should anticipate a single global AI standard. No such standard exists, and regulatory differences remain commercially and legally important. The more defensible strategy is to implement an enterprise governance system capable of satisfying recurring expectations across jurisdictions while accommodating targeted local requirements.

Organisations that can explain not merely that they use AI, but why they use it, how it is controlled and what evidence supports their decisions, will be better positioned to manage present exposure and adapt to the next stage of regulation.

Content is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee similar outcomes. For more information, please visit: www.bakermckenzie.com/en/client-resource-disclaimer.

This article first appeared on Lexology | Source