Topic entry points into the regulatory briefs, case library and regulatory updates already on this site. The annual research report is still in preparation.
Research plan: mapping the most underestimated compliance frictions across the EU, US, Southeast Asia and the Middle East. A PDF will be provided on release.
Verified public enforcement and regulatory decisions (EU, US, China, Japan, Korea and more), each with official sources, plus clearly labelled fictional illustrations.
The research theme is in preparation; the ESG Governance page already covers compute carbon, ESG standards and customer due-diligence points.
Country entry briefs for priority markets including the UAE: local hosting, government and sovereign-fund clients, Arabic support and cultural fit.
In force: Art.50 transparency and synthetic-content marking (2026-08-02); legacy systems must comply by 2026-12-02. Deferred: high-risk duties to 2027-12-02 (Annex III) and 2028-08-02 (Annex I).
Vehicle cybersecurity (UN R155), software updates (UN R156), automated-driving type approval, product liability and automotive data security — each rule with its official source.
The research network directory is pending release: until a scholar confirms in writing, we show no name, affiliation or profile here. Members go live one at a time.
Confirmed scholars will appear here one by one once the directory is published.
The first comprehensive horizontal AI law, setting obligations by risk tier. Unacceptable-risk practices are banned. High-risk systems must meet requirements on risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and cybersecurity, undergo conformity assessment, bear the CE marking and be registered in the EU database. Providers of general-purpose AI models owe technical documentation, downstream documentation, a copyright policy and a public training-content summary; models meeting the systemic-risk threshold additionally owe model evaluation, risk mitigation, serious-incident reporting and cybersecurity protection. Limited-risk uses trigger transparency notices and synthetic-content marking. The AI Omnibus (Regulation (EU) 2026/1744, in force July 2026) postponed the high-risk application dates, simplified documentation for SMEs and small mid-caps, added two prohibited practices, and permits processing of special categories of personal data for bias detection under strict conditions.
On top of the existing CCPA and CPRA consumer rights and business duties, the regulation package completed by the California Privacy Protection Agency in September 2025 adds three strands. Risk assessments: a business must complete one before initiating processing that sells or shares personal information, processes sensitive personal information, uses ADMT for a significant decision, or uses automated processing to infer capability, performance, health, behaviour or movements from systematic observation of job applicants, employees, students and similar groups, and must submit summary information to the Agency. Automated decisionmaking technology: a business using ADMT for significant decisions must provide a Pre-use Notice, an opt-out mechanism and access request channels, and must be compliant by 2027-01-01. Cybersecurity audits: qualifying businesses must complete a first audit report on a revenue-phased schedule of 1 April 2028, 2029 or 2030, and annually thereafter.
AI software under the MDR is classified chiefly by Rule 11 in Annex VIII section 6.3: software intended to provide information used to take decisions with diagnosis or therapeutic purposes is class IIa, rising to class III where those decisions may cause death or an irreversible deterioration of health, or class IIb where they may cause a serious deterioration of health or a surgical intervention; software intended to monitor physiological processes is class IIa, or class IIb where it monitors vital physiological parameters whose variations could result in immediate danger; all other software is class I. Because everything above class I requires a notified body, most clinical decision support AI entering the EU must go through notified body conformity assessment, on top of quality management system, UDI, EUDAMED registration, post-market surveillance, periodic safety update reporting and vigilance obligations.
A targeted simplification of the AI Act that also amends the EU Aviation Safety Regulation (EU) 2018/1139 and the Machinery Regulation (EU) 2023/1230. Key content: postponement of the high-risk application dates (Annex III to 2 Dec 2027, Annex I to 2 Aug 2028); extension of SME-only reliefs to small mid-cap companies (SMCs); simplification of the AI literacy duty with a stronger promotional role for the Commission and Member States; clarification of the "safety component" boundary, so that AI used solely for non-safety-related user assistance, performance optimisation, service efficiency, automation, convenience or quality control does not qualify; new prohibitions on generating non-consensual intimate imagery and child sexual abuse material; a new Art. 4a permitting processing of special categories of personal data for bias detection and correction under strict conditions; expanded regulatory sandboxes including an EU-level sandbox; a single application and unified assessment procedure for notified bodies; and a presumption that systems complying with the Cyber Resilience Act meet the AI Act Art. 15 cybersecurity requirement.
How to establish AI smart city solutions in the Middle East while meeting local data sovereignty and privacy regulations
How to use AI to address language barriers and educational equity in resource-scarce African markets
How to adapt autonomous driving to strict local traffic laws, driving conventions and aging-society mobility needs
It is planned to summarise key regulation, ESG cases and market-entry signals. Until then, Regulatory Updates is refreshed weekly (human-approved).