AI is being deployed faster than any regulatory system can adapt. While the intentions behind emerging AI laws are sound, the absence of shared global guardrails is becoming a risk in itself.
At present, the EU is progressing with the GDPR and the EU AI Act, while the US relies on sectoral/state rules; India has the DPDP and Consent Manager ideas; other regions vary. The global key points to be considered are:
Universal risk, local rules: While jurisdiction-specific frameworks may be effective locally, they result in inconsistent protections globally, creating legal gaps and real harm.
Compliance complexity: Multinational organisations are forced to operate parallel compliance programmes across jurisdictions, leading to increased costs, operational inefficiencies, and slower innovation cycles.
Trust at stake: When protections vary by geography, user confidence erodes. This lack of trust can significantly slow adoption in critical sectors such as healthcare, finance, and edtech.
What will Harmonised AI-Privacy Rules look like:
This kind of baseline alignment is not new: global regimes such as UNCAC (anti-corruption), the OECD Anti-Bribery Convention, FATF standards (anti-money laundering), and ICAO aviation standards show how states can retain domestic legal autonomy while converging on minimum safeguards, common documentation/evaluation processes, and operational cross-border cooperation, exactly the model AI harmonisation seeks to emulate.
Harmonisation does not imply a single, uniform global AI law. Rather, it points to the establishment of a common baseline of rights and safeguards such as consent quality, DPIA/AIA triggers, and data minimisation, supported by interoperable technical standards (including model cards, consent APIs, and provable audit logs), mutual recognition of audits and certifications, and structured cross-regulator cooperation. This would:
Enable a lower compliance overhead via shared frameworks and certifications.
Utilise reusable technical tooling, like DPIA templates, test suites, and model documentation.
Enhance cross-border protection of human rights and foster faster, safer innovation.
What’s next:
At the global level, AI governance is likely to move towards a greater baseline convergence rather than full legal uniformity. We can look forward to improved coordination between regulators, regional alignment on risk-based AI frameworks, and growing recognition of shared audit, certification, and accountability mechanisms, mainly for high-impact AI systems.
As global AI governance continues to evolve, the DPO Club is compiling a whitepaper on Global AI Laws. This paper will provide a comprehensive view of how AI regulations are developing across jurisdictions, where convergence is emerging, and how privacy, governance, and innovation are likely to intersect over the next decade.
Stay tuned.
In the meantime, we invite you to share your thoughts in the comments. Let’s talk privacy.