A lender using artificial intelligence (AI) to assess creditworthiness may be required to provide human oversight without knowing precisely what intervention is sufficient. An authority investigating an automated hiring decision may have powers to interview the employer but lack access to the data or software behind the decision.

These practical gaps featured in the opening of the World AI Regulation Summit in London on 5 November. Perspectives from the European Union (EU), United States (US) and United Kingdom (UK) reveal connected challenges: defining workable requirements and equipping authorities to enforce them.

Gabriele Mazzini, architect and lead author of the EU AI Act, criticised legislative complexity while advocating more specific requirements for companies. Former White House AI adviser Alex Engler argued that existing sector regulators need investigative powers and technical capabilities suited to algorithmic systems. Lord Chris Holmes of Richmond, a member of the UK House of Lords and chair of the summit, proposed a statutory authority to provide shared expertise and coordinate oversight.

Their addresses were followed by a leadership dialogue on how these approaches work in practice. Effective oversight depends on connecting legal requirements with practical tests: what constitutes meaningful human oversight, how an automated decision should be explained and what information a supervisor needs to investigate it.

More rules do not necessarily provide clearer answers

The EU AI Act entered into force in August 2024, with provisions taking effect in stages. Regulation (EU) 2026/1744 subsequently moved the application of specified high-risk obligations to 2 December 2027 for systems covered by Annex III and 2 August 2028 for systems covered by Annex I.

Pressure to postpone implementation came from within Europe as well as the US, Mazzini said, amid concerns about regulatory burdens and European competitiveness. He cited calls from venture capital investors, major companies and political leaders, including Mario Draghi, the former European Central Bank president.

The Act also became substantially more complex during its development: a 144-page law accompanied by guidance already three or four times its length, by Mazzini’s estimate, with further material pending.

Mazzini’s criticism of legislative complexity nevertheless supports a case for more specific guidance. Drawing on experience with the EU’s General Data Protection Regulation (GDPR), he explained how broad legal protections can leave businesses uncertain about their practical obligations.

For lenders using automated credit scoring, Mazzini highlighted practical questions about what constitutes meaningful human oversight or an adequate explanation. Businesses may have to make engineering and compliance decisions while awaiting guidance or judicial interpretation. Giving companies greater specificity enables a “faster cycle for product development and compliance”, he said during the leadership dialogue.

Standards can supply the necessary detail, but their development also takes time. Where standardisation is too slow, Mazzini favoured giving regulators the capacity to produce specifications themselves.

Beyond clarifying requirements, Mazzini questioned whether prescribing safeguards before deployment is always the most effective legal approach. Where technology and development practices remain unsettled, establishing “who is liable under what conditions for what kind of damages” may be more effective than prescribing requirements before those practices have solidified.

Investigative powers must reach data, models and software

For an agency investigating discrimination, authority over an employer does not necessarily provide the tools to examine an algorithm influencing its hiring decisions.
“An agency may have the ability to go interview people, but they may not have the ability to get data or models or software systems,” Engler said.

Now executive director of the Penn Center on Media, Technology and Democracy, Engler worked on the Biden administration’s AI executive order at the White House Office of Science and Technology Policy.

The Trump administration’s March 2026 legislative recommendations favour existing sector regulators over a new federal AI rulemaking body and seek to pre-empt certain state requirements. The recommendations require congressional action.

Relying on existing authorities leaves unresolved whether their powers extend to investigating algorithmic systems, Engler argued. Older legislation may not adequately address accuracy, robustness and explainability or authorise the technical interventions needed to assess them. Even with access to evidence, agencies may lack the computing resources or staff to analyse it.

Engler also called for targeted guidance on high-impact uses, comparing algorithms used to set university tuition prices, value property and approve mortgages.

“They are so different in the reality of them that I do not think you can govern them the same,” he said. He favoured allowing sector regulators to make nuanced judgements about particular applications.

Updating sector laws could strengthen oversight, but Engler said supporters of regulation feared that reopening them might weaken existing civil-rights and consumer safeguards.

States should introduce protections rather than wait for federal legislation, in his view, despite the administration’s push to limit state AI rules. Stronger state provisions could, he acknowledged, make a subsequent federal settlement harder to negotiate if it supersedes them.

Shared expertise raises questions about regulatory responsibility

The UK relies principally on existing sector regulators to oversee AI. Holmes called for shared technical support rather than each regulator building the same capabilities independently.

Through his Artificial Intelligence (Regulation) Bill, first introduced in 2023 and reintroduced in March 2025, he proposed a statutory authority to coordinate existing UK regulators, provide technical support and identify gaps in oversight. Neither version of the bill has become law.

“I don’t think we are fully empowering our existing regulators by giving them AI and saying over to you,” Holmes said.

Alongside that authority, the bill envisages designated AI officers and independent audits of businesses’ processes and systems. Regulatory sandboxes can allow firms to test applications and safeguards together, Holmes said, pointing to the Financial Conduct Authority’s AI sandbox work.

Engler, on the other hand, cautioned during his keynote that giving a separate AI regulator enforcement responsibilities could divide oversight of the same activity between two authorities.

“If you have a central tech regulator for AI in hiring and then you have a sectoral regulator for humans when they’re hiring, how does that work?” he asked.

Their remarks highlight a distinction between sharing technical expertise and creating overlapping enforcement responsibilities. Regulators can draw on common support while retaining clear accountability for the activities they supervise.

Regulatory competition involves more than lighter obligations

Regulatory arbitrage arises when companies seek jurisdictions with more favourable rules or enforcement. Holmes challenged the assumption that stronger regulation necessarily drives business away, arguing that clear, proportionate rules can give investors confidence that their investments and intellectual property will be protected.

“Would you invest into a market with no rules?” he asked.

National differences need not prevent international compatibility. Drawing on his experience competing at the 1988 Seoul Paralympics, Holmes compared coordination with agreeing the dimensions and rules of a pool while allowing competitors to swim their own races.

For Mazzini, common EU legislation does not eliminate regulatory arbitrage. Member states’ different political priorities, supervisory resources and enforcement capabilities can influence where companies choose to operate. Common rules do not produce consistent enforcement without comparable regulatory capacity. He called for simpler laws and closer alignment of policy and supervision across the bloc.

The AI Act’s product-regulation approach seeks to limit that opportunity by allowing authorities across member states to act, Mazzini explained. But broader legal authority does not ensure that each has the expertise and resources to enforce the rules. Europe’s ability to influence global practices through the “Brussels effect” likewise depends on effective enforcement and companies’ incentives to adopt common requirements.

Engler regarded domestic US governance gaps as more urgent than arbitrage. Describing it as a “luxury” concern, he said concentrated corporate power remains insufficiently checked, compounded by close relationships between technology companies and political leadership.

While accepting that European regulation can be excessive, Engler pointed to intrusive data trading and unwanted communications as consequences of inadequate US privacy safeguards. He favoured introducing protections and refining them over time.

Mazzini called for governments to establish their objectives for AI, assess how existing laws apply and organise the institutions and expertise needed before introducing new legislation. Such preparation requires understanding “not only how to write the law, but also how to execute it”.

For businesses, the test is whether regulatory requirements can be translated into safeguards that can be implemented and demonstrated. For regulators, it is whether they have the authority, expertise and resources to determine whether those safeguards work. The effectiveness of AI regulation will depend not simply on the rules governments adopt, but on whether businesses can comply with them and regulators can enforce them.