I had varied versions of the same conversation FOUR times this week. So figured it was topical enough to write about it. I love these kinds of conversations because it shows people are asking the right questions and trying to draw the correct distinctions.
A trend im noticing is people (understandably) putting regulation, compliance and governance into the same mental map basket when they talk about AI in regulated industries. The record needs to be set straight that (for now), they are three different things. An easy way to do this is unpack each ones meaning and intent so the mental map becomes easier to contextualise.
It usually surfaces the same way. A company sells "AI for compliance" to serious, regulated buyers, and someone reasonable asks whether that company must therefore have tight "AI governance" to be credible. One would understandably anticipate the two to go hand in hand, and they might soon. But at this point in time, they're separate.
Regulation is the law that applies to you
Regulation is the set of rules you have to follow because of who you are and what data you touch. HIPAA for example is if you handle US health records. GDPR if you process the personal data of people in Europe. Work health and safety law, climate disclosure rules, modern slavery reporting, ESG compliance depending on your industry and the countries you operate in.
If you are expected to comply to these, subject to your industry vertical, these are nonnegotiable. The flow is simple. A governing body writes the standards (the process), enforcement is carried out by the regulator (follows the process check box's), and it binds you whether you like it or not. It is external and it is fixed.
Compliance is meeting that law, and proving it
Compliance is the work of satisfying those rules, plus the evidence that you did. Controls, records, audits, an attestation like SOC 2 where a third party has checked your security. Compliance sits downstream of regulation. Its the work of actually "doing what is expected of you". The law says what you owe, and compliance is you paying it and keeping the receipt.
This is the reality for a lot of AI companies right now. A tool that sells "AI for compliance" is usually automating the reporting its clients already owe, the carbon numbers, the emissions, the safety records, whatever their regulator demands. It produces the receipt faster and with fewer people. Useful work. It is also one specific job, compliance delivery, thats it.
Governance is how you control the system itself
Governance sits on a different axis altogether. But somehow im seeing people mix it up in the regulation and compliance mental map. So lets demystify this. Governance is how you keep the AI itself under control. Scoping what it can reach, permissions, access, encrypted audit logs, hooks that fire before a tool call and are wired into the code so a clever prompt can't wave them through. Governance is engineering and discipline.
Governance is also largely a choice. There are best practice frameworks that describe it well, ISO 42001 and the NIST AI Risk Management Framework, are voluntary. They are trust signals and good practice. But I would also argue that they are features that are growing in market demand as we see incidents like the Huggingface saga spill out into the media. No one wants their agent going rogue and governance is the guardrail to prevent this. Do it wrong and its a mistake that could cost you dearly in tuition fees. No law hands you a required governance score you have to hit. You govern well because it makes your system safer and your buyers calmer, not because a statute forces a number on you.
No one wants their agent going rogue and governance is the guardrail to prevent this.
The mix-up has a cost
The mental map is often mixed because all of these are enforcement mechanisms with systems and processes baked in. So naturally people assume AI governance is itself a compliance requirement. Today, in most places, it is not. It's still a bit of a wild west in that respect.
Australia shelved its mandatory AI guardrails in December 2025 and bet that existing law already covers the ground. There is currently no dedicated AI statute & no compulsory governance standard. The EU AI Act is however an exception, and even there the heavy obligations on high risk systems have been pushed out to December 2027. Rules for general purpose models are loosely in place, but deeper governance duties are still coming.
I theorise this has a lot to do with the fear that tighter regulation around the application of governance in AI, will stifle innovation an hold back specific companies from retaining a competitive edge in a rapidly moving market.
How it really is
Governance today is a commercial and engineering call. Law in a compliance and regulatory sense, isn't a factor yet. It shows up at the procurement stage instead. A security reviewer at a bank or a health network is discharging a legal duty of their own, and if they are doing their job properly they'll ask hard questions about how you run your AI before they sign anything. This is the gatekeeper that currently drives best practice governance. Im seeing that buyer demand around governance if framing governance standards before any regulator makes them an official standard.
Data sovereignty gets tangled the same way
The sovereignty debate also muddies the mental map slightly. Im mentioning this to take it out of the picture entirely, as it builds the mental map easier. But arguing data sovereignty here is like trying to hammer a square peg into a circular hole. People assume a regulated buyer needs the model running on local soil. The law usually doesn't say that. HIPAA and GDPR care about how the data is handled and protected, not the address of whatever data centre is handling the processing of said data. Geolocated cloud, jurisdiction based storage and standard contractual clauses cover the mandated regulatory requirements without the need of a local model. Wanting your data on home ground is a real preference, not a necessity, apart from some edge cases around government and defence. For majority of regulated businesses it's closer to a governance and trust question. The requirement is about standards. Location is mostly preference. Because when you think about it, majority of the SaaS tooling you use every single day is all cloud based. Your data is already here there and everywhere. And thats fine, so long as upstream suppliers are following best practices along with the AI your using to compute over said data, introducing AI into the mix shouldn't really change anything.
Local models is a nice to have for some, but not a need to have for most.
The reason to keep them separate
Put simply, they move independently, thats it. A company can pass every compliance audit while its AI runs on loose controls. Flip it around and you get outfits with beautiful governance who still haven't met an obligation their regulator actually cares about.
Apples and oranges.
Being compliant has nothing to do with running tight governance.
Running loose governance has nothing to do with being compliant.
To conclude, regulation is the rule to follow, compliance is the receipt that proves you follow it, and governance is the grip you keep on the machine while it runs. Dissecting and examining each in detail is how you identify where your risk really sits.
Originally published on LinkedIn.
