I get asked a version of the same hopeful question fairly often: won't AI regulation eventually solve most of what I write about? I understand the appeal of that hope, and I want to take it seriously enough to actually test it, rather than dismiss it out of hand — which means looking honestly at what the major regulatory approaches actually cover, and, just as importantly, what they were never built to cover in the first place.
The EU: precaution, tiered by risk
The European Union's Artificial Intelligence Act sorts AI systems into tiers based on the level of risk they pose, with practices deemed unacceptable banned outright and high-risk systems facing real, enforceable obligations around documentation, testing, and human oversight. This is a precautionary philosophy, built on the assumption that AI's biggest dangers are large in scale and identifiable in advance by category — a hiring algorithm, a credit-scoring system, a piece of critical infrastructure — and that regulation's job is to classify those categories and impose proportionate obligations on each. It's a serious, carefully constructed piece of regulatory architecture, and I don't want to undersell it. But its entire logic operates at the level of system category, not at the level of an individual brand's specific customer-facing output. A customer service chatbot that quietly stops sounding like your brand doesn't obviously fall into any of the Act's high-risk categories, because "sounding like your brand" was never the kind of harm this framework was built to classify or catch.
The Gulf: growth first, governance as infrastructure
The UAE and Saudi Arabia have taken a visibly different philosophical starting point. The UAE's National Strategy for Artificial Intelligence 2031 and Saudi Arabia's AI ambitions under Vision 2030 are both fundamentally growth-oriented documents — economic diversification targets, government-service modernization goals, national competitiveness aims — with governance treated as an enabling layer that makes ambitious adoption possible, rather than as a precautionary brake on it. This isn't a criticism; it's a genuinely different, coherent philosophy, optimized for a different set of national priorities than the EU's. But it means the actual granular question of whether a specific small business's chatbot still reflects that business's specific values sits even further from the center of the regulatory conversation than it does in the EU's more precautionary framework, precisely because the Gulf strategies were never primarily written with an individual SME's brand integrity as the object of concern in the first place.
Estonia: trust through transparent, verifiable systems
Estonia sits inside the EU's regulatory umbrella as a member state, so it's subject to the same AI Act tiering as the rest of the bloc. But Estonia's own digital culture brings something the regulation itself doesn't require: a deeply embedded national habit of building systems that are inherently auditable by the citizens who use them. Nearly all Estonian public services run through a secure digital backbone that lets citizens see exactly which official accessed their data and when. That's not AI regulation, strictly — it predates the current AI era by decades — but it reflects a philosophy of trust-through-verifiability that sits closer to what individual brand governance actually needs than either the EU's category-based risk tiers or the Gulf's growth-first framing.
Why none of these three actually answers the question a founder is asking
Here's the finding that I think should worry, or at least reorient, any founder currently comforted by the existence of AI regulation somewhere on the horizon. All three of these philosophies — precautionary, growth-first, and transparency-by-design — operate at a level of altitude that has nothing to say about whether your specific brand's specific chatbot still sounds like you this month. The EU AI Act will not tell you that. The UAE's national strategy will not tell you that. Estonia's digital trust culture, as admirable as it is, was built for citizen-state interactions, not for whether a Tallinn-based startup's AI-drafted customer emails still match its stated values. None of these three regulatory philosophies, however well-constructed each one is on its own terms, was ever designed to answer the narrower question my own research is built around — which is precisely the gap I keep returning to whenever someone hopes regulation alone will eventually make this problem go away for them.
What this means practically, for a business operating across more than one of these zones
If you're running a brand with any footprint across the EU, the Gulf, and a market like Estonia simultaneously, you're navigating three genuinely different regulatory philosophies at once, and none of the three will hand you a brand-level governance plan even if you comply with every applicable requirement in full. Compliance with the EU AI Act's risk-tier obligations doesn't mean your brand voice hasn't drifted. Alignment with a Gulf national strategy's growth ambitions doesn't mean your specific chatbot hasn't quietly stopped sounding like you. And operating inside Estonia's transparent digital culture doesn't automatically transfer that same transparency habit into your own customer-facing AI tools just because you're geographically adjacent to a government that does it well. Each regulatory philosophy solves the problem it was built to solve, at the altitude it was built to operate at, and the brand-level gap sits underneath all three of them, unclaimed by any single one.
What each philosophy would actually catch, if you tested it against my own cases
It's worth being concrete about this rather than leaving it as an abstract claim, so let me run each of the three regulatory philosophies against a case I've written about elsewhere. Take CNET's AI-generated financial content, with its factual errors sitting uncorrected for months. Would the EU AI Act have caught this? Only if a compound-interest explainer somehow qualified as a high-risk system under the Act's categories, which it almost certainly wouldn't, because financial journalism content generation isn't the kind of system the Act was built to classify as high-risk in the first place — it's closer to the Act's lightly regulated "limited risk" tier, if it's covered at all. Would a Gulf-style growth-first strategy have caught it? No, because that philosophy isn't oriented toward catching individual content-quality failures at any single company; it's oriented toward national-level adoption targets. Would Estonia's transparency culture have caught it? Only indirectly, and only if CNET had voluntarily built the same kind of auditable, verifiable production trail Estonia's government services use by default — which is a cultural habit, not a regulatory requirement, and nothing forced CNET to adopt it.
Run the same test against Levi's AI-model backlash, or the Chevrolet chatbot's dollar-Tahoe mishap, and you get the same result each time: every one of these real, documented cases falls into the gap between what these three regulatory philosophies were each built to catch, precisely because every one of them is a brand-level integrity failure rather than a systemic, category-wide risk of the kind regulation is designed to classify and address.
Why I keep coming back to this point despite how obvious it might sound
I think the reason this is worth restating clearly, rather than assumed as background knowledge, is that I meet founders constantly who've absorbed a vague sense that "AI regulation is coming" as a reason to delay building their own internal governance habits, on the theory that the eventual regulatory framework will handle it for them once it arrives. That's a reasonable-sounding assumption that turns out to be false on inspection, for the specific reason this piece lays out: none of the three major regulatory philosophies currently shaping the global AI landscape were built to answer the question "does this brand's specific automated output still match what it claims to stand for." Waiting for regulation to answer a question it was never designed to ask is not a governance strategy. It's a bet against a very specific piece of evidence, gathered case by case, that the bet doesn't pay off.
Why I think this gap is actually the more interesting research question
I don't say any of this to argue regulation is pointless — each of these three approaches is doing real, necessary work at its own altitude, and I'd rather live in a world with all three than without them. I say it because the gap between "the regulatory environment is responsible" and "my specific brand is behaving responsibly" is exactly the space my own research lives in, and I think it's a space that's going to stay genuinely under-addressed for a long time, regardless of how sophisticated any of these three regulatory philosophies eventually becomes, because the question they're each answering was simply never the same question a founder actually needs answered on an ordinary Tuesday.
Operating across more than one of these regulatory zones and want to know what's actually covered — and what isn't — at the level of your own brand? Get Your Free Brand Audit →
References
European Union. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union.
e-Estonia. (2021). E-services & registries.
UAE Government. (2017). National Strategy for Artificial Intelligence 2031. ai.gov.ae.