EU and US agree on overall direction for AI regulation

Transatlantic alignment on governance foundations

The EU and US have committed to minimising divergence in their emerging AI governance systems, with a specific emphasis on developing "safe, secure, and trustworthy" AI technologies. Working teams jointly staffed by US science agencies and European Commission departments have already defined milestones for deliverables in climate, energy, emergency response, and reconstruction applications. A updated EU-US Terminology and Taxonomy for Artificial Intelligence has been published to establish shared definitions — a prerequisite for regulatory interoperability.

The European Union's AI Act, recently adopted, provides a comprehensive regulatory framework for AI development within the bloc. In contrast, the United States lacks federal AI legislation; partisan divisions in Congress make enactment unlikely before the November elections. The US executive branch has instead issued guidance on AI use across federal agencies. This asymmetry creates a dynamic where EU standards may effectively become the global baseline, much as the General Data Protection Regulation (GDPR) shaped data practices worldwide.

Business implications and compliance calculus

Industry leaders have broadly welcomed the coordination effort. Gaurav Buddy, chief executive of stackArmor and member of the US AI Safety Institute Consortium, described the agreement as "a really important step in helping build a common set of AI guardrails and frameworks between the EU and the US." He noted that alignment could prevent the creation of regulatory silos that would increase friction for US AI companies operating in European markets.

The cooperation agreement seeks to establish common regulatory standards and frameworks, reducing the cost and complexity of compliance — a lesson learned from GDPR's extraterritorial impact on US firms. Buddy emphasised that businesses across sectors must stay abreast of the rapidly emerging regulatory landscape, as it will affect operations in much the same way GDPR did. For procurement and IT leaders, this means reviewing vendor contracts, data processing agreements, and internal AI policies against an evolving transatlantic baseline.

Expert caution on regulatory scope and enforcement

Academic researchers offered measured support. Professor Angelo Cangelosi of the University of Manchester characterised the UK-US agreement as "a good step in this direction" but noted that "practical steps are not fully clear at this stage." He expressed hope that coordination would expand to a wider global level, including integration with the EU AI framework and broader United Nations initiatives.

Dr Kjell Carlsson, head of AI strategy at Domino Data Lab, sounded a more sceptical note. He argued that focusing regulation on commercial AI applications overlooks the most immediate threat: criminal misuse of generative AI for deepfakes and sophisticated phishing. "Few of the proposed AI regulations, such as the EU AI Act, are designed to effectively address these threats as they mostly focus on commercial AI solutions that criminals do not use," Carlsson said. He warned that current regulatory efforts may "harm innovation and increase costs, while doing little to improve actual safety."

Testing and safety institutes as alternative investment

Carlsson advocated for prioritising investment in testing and safety research over premature regulation. He described research on effectively testing AI systems, mitigating risks, and ensuring safety — applied through AI Safety Institutes — as an "excellent public investment" that guarantees safety while fostering developer competitiveness. This perspective suggests that operational safety infrastructure may yield better outcomes than prescriptive rule-making at this stage of AI development.

The distinction between regulating commercial deployments and addressing criminal misuse highlights a fundamental challenge: regulatory frameworks typically target legitimate actors, while illicit use operates outside legal boundaries. Effective governance may therefore require a dual track — standards for commercial systems alongside law enforcement capabilities tailored to AI-enabled crime.

Corporate policy imperatives amid regulatory flux

Ben Travers, a partner at law firm Knights specialising in AI, intellectual property, and IT matters, emphasised that organisations cannot wait for regulatory clarity. "Companies should have an AI policy, which dovetails with other related policies, such as those pertaining to data security, IP and IT procurement," he advised. Such policies must define which employees may interact with AI systems and under what conditions.

Recent cases have highlighted risks when employees input confidential or protected information into generative AI tools, alongside copyright infringement concerns. Travers stressed that corporations must assess these risks, reflect them in updated policies, and communicate those policies to their teams. For procurement professionals, this extends to vendor due diligence: understanding how suppliers use AI, what data they process, and what contractual protections exist.

What this means

The EU-US agreement on AI regulation represents a pragmatic recognition that divergent rules serve neither innovation nor safety. By establishing common terminology, shared benchmarks, and coordinated risk assessment, the pact lays groundwork for a transatlantic governance model that could become the de facto global standard. However, the experts' caution is well-founded: regulatory frameworks that target legitimate commercial actors while leaving criminal misuse unaddressed risk imposing compliance burdens without commensurate safety gains. For businesses, the immediate imperative is clear — develop robust internal AI governance that anticipates regulatory direction while addressing the operational risks already present in daily use. Procurement teams, legal counsel, and technology leaders should treat this agreement as a signal to accelerate policy development, vendor assessment, and cross-functional coordination. The regulatory landscape will continue to evolve, but the cost of inaction — legal exposure, reputational damage, and competitive disadvantage — is already measurable.