Adapted with attribution. This lesson is adapted and rewritten for non-technical leaders from AI Engineering from Scratch by Rohit Ghumare, used under the MIT License. The original is a 428-lesson technical course for software engineers.
Hook
For most of the last decade, AI regulation was something to think about later. It was draft proposals, expert panels and futures that never quite arrived. A leader could reasonably file it under "not yet."
That period is over. AI regulation has moved from theoretical to real. There are now laws on the books, frameworks in active use and customer requirements being written into contracts. The leaders who still treat AI rules as a someday problem are the ones who will be caught flat: scrambling to document systems they never tracked, unable to answer a customer's compliance questionnaire, retrofitting governance onto AI that was deployed with none.
You do not need to become a compliance specialist. You do need a working map: the shape regulation is taking, why it reaches you wherever you operate and the handful of low-cost moves that make the difference between ready and scrambling. This lesson gives you that map. It closes the curriculum where it should close, on the leader's responsibility.
If you wait for your employer to design an AI strategy that serves your career interests, you will be waiting a long time.
Context
The big idea: regulation by risk tier
The single most useful concept to carry is this: modern AI regulation tends to sort AI uses by risk level and regulate each level differently. It does not treat all AI the same, and it does not try to.
The pattern, broadly, looks like this:
- Unacceptable uses. A small set of AI applications considered harmful enough to be prohibited outright.
- High-risk uses. AI used in consequential decisions about people: employment, credit, education, essential services and similar. This tier carries the real obligations: documentation, human oversight, testing, transparency.
- Limited-risk uses. AI that mainly needs to be disclosed, so people know they are dealing with AI or with AI-generated content.
- Minimal-risk uses. The large majority of ordinary AI use, lightly regulated or not regulated specifically at all.
Why this matters to you: most of what your organization does with AI will fall in the lighter tiers. The regulatory weight concentrates on a specific zone, AI in consequential decisions about people. If you can identify which of your AI uses sit in that high-risk zone, you have found where nearly all your compliance attention belongs. That is the most important practical takeaway in this lesson.
The landscape, in broad strokes
You do not need every detail, but you should recognize the pieces.
The European Union has enacted comprehensive, risk-tiered AI legislation, the most far-reaching to date, and the clearest example of the tiered model above. It is being phased into effect over time.
The United States has taken a different path: no single comprehensive federal AI law, but a growing patchwork of sector-specific rules and state-level legislation, with particular early activity around AI in hiring and employment.
Voluntary frameworks and standards sit alongside the laws and increasingly shape expectations. In the US, a widely referenced AI risk-management framework offers a structured, voluntary approach to governing AI. Internationally, a formal management-system standard for AI now exists, the kind of standard organizations can certify against. These are not laws, but customers, partners and insurers increasingly treat them as the benchmark for "are you managing this responsibly."
The specifics, exact dates, thresholds, penalties, are evolving and vary by jurisdiction, and they will keep changing. Do not anchor on the details. Anchor on the direction, which is steady and clear: more obligations, concentrated on higher-risk uses, with documentation and human oversight at the core.
Why it reaches you wherever you operate
A natural reaction is "this is an EU matter" or "this is for the big platforms." Both are mistakes.
AI regulation reaches across borders. Comprehensive regimes like the EU's generally apply based on where an AI system is used or its results felt, not only where the provider sits. If your AI touches people or business in a regulated jurisdiction, its rules can reach you regardless of where you are based.
And regulation reaches you through the market, not only through law. Large customers, wary of their own exposure, push compliance obligations down their supply chain. You will increasingly be asked to answer AI questions in procurement: what AI you use, how you govern it, what you can document. The contract becomes the enforcement mechanism long before any regulator does.
So the relevant question is not "am I legally in scope of a particular statute today." It is "do I operate across borders, or serve customers who do, or sell to organizations that will ask." For almost every professional organization, that answer is yes.
Documentation: the thread through all of it
Across every framework, every tier and every jurisdiction, one requirement recurs: be able to show how your AI works and where its data came from.
Regulators and serious customers increasingly want to see documentation: what each AI system does, what it was built and tested for, what data trained or feeds it, what its known limits are, who is accountable for it, what human oversight governs it. The technical world has names for pieces of this, structured summaries of a model's purpose and limits, records of where training and input data originated, trails of what an AI system did and when. You do not need the vocabulary. You need the through-line.
The through-line is this: an AI use you cannot describe and document is an AI use you cannot defend, not to a regulator, not to a customer, not to your own board. Documentation is not a bureaucratic afterthought. It is the spine of AI compliance, and it is the single most useful thing you can start building before you are required to.
Disclosure is rising too
One more current worth knowing: a clear move toward transparency obligations. Increasingly, the expectation is that people are told when they are interacting with an AI rather than a human, and that AI-generated content is identifiable as such. The exact rules vary, but the direction is one-way. Build on the assumption that "this was done with AI" will need to be disclosed, not hidden.
Steps
Step 1: Build an AI inventory
You cannot govern or document what you have not catalogued. Create and maintain a simple inventory of how AI is used across your organization: each tool, what it is used for, who uses it, what data it touches. Most organizations are genuinely unsure what AI is in use across their teams. The inventory ends that, and it is the foundation every other step builds on.
Step 2: Find your high-risk uses
Go through the inventory and flag every use that touches consequential decisions about people: hiring and promotion, pay, credit and lending, access to services, anything that shapes a person's opportunities. That flagged subset is your real regulatory exposure. It is where obligations concentrate and where your governance effort belongs. Everything else needs basic hygiene, not intensive compliance.
Step 3: Start documenting now
For each significant AI use, especially the high-risk ones, begin keeping a plain record: what it does, what it is and is not meant for, what data it relies on, its known limitations, who is accountable, what human oversight applies. Documentation created alongside an AI system is straightforward. Documentation reconstructed under deadline, for a regulator or a customer, is painful and often incomplete. Start now, while it is easy.
Step 4: Assign clear ownership
Name a specific person or function accountable for AI governance, someone who owns the inventory, watches the regulatory landscape and can answer for how AI is managed. AI governance that is everyone's job is no one's job. It does not require a large function. It requires a clear owner.
Step 5: Watch your sector and your contracts
Regulation is not arriving evenly. It is moving fastest in specific sectors, employment, finance, healthcare and other areas of consequential decisions. Know where your sector stands and watch it. And read the AI clauses in your customer contracts and procurement questionnaires closely: they are often where new obligations reach you first, ahead of any statute.
Recap
- AI regulation has moved from theoretical to real: enacted laws, active frameworks and customer requirements written into contracts.
- Modern regulation sorts AI uses by risk tier. The obligations concentrate on high-risk uses, AI in consequential decisions about people. Identifying those uses locates most of your compliance work.
- It reaches you across borders (rules often apply where AI results are felt, not only where the provider sits) and through the market (customers push compliance down their supply chains).
- Documentation is the thread through every framework: an AI use you cannot describe and document is one you cannot defend. Transparency and disclosure obligations are rising in parallel.
- The low-cost moves to make now: build an AI inventory, flag your high-risk uses, start documenting, assign clear ownership and watch your sector and your contracts. Governance built early is cheap; governance retrofitted under deadline is not.
You have completed AI Risk and Governance for Leaders, and with it, the curriculum adapted from the open-source AI engineering course. You can now name the real risks of AI at work, govern what happens to your data and read the regulatory landscape well enough to act before it forces you to.