Amir Al‑Maamari, a researcher at the University of Passau, published the paper "Between Innovation and Regulation: A Cross‑Regional Study of AI Risk‑Management Frameworks in the EU, US, UK and China" (arXiv:2503.05773, March 2025). Through qualitative comparative analysis, it reveals similarities and differences among the four major economies in AI governance: the EU's structured, tiered risk management; the US's flexible, sector‑oriented approach; the UK's adaptive sectoral regulation; and China's centralized, rapid implementation. The paper emphasizes the importance of risk classification, compliance, oversight, transparency and balancing innovation, but as a March report its data cut‑off is relatively early. By November 2025, global AI regulation has accelerated in response to the generative AI surge and geopolitical risks, producing frequent policy iterations. This report uses the paper's framework and supplements it with the latest regional developments in AI risk management, focusing on high‑risk areas (such as healthcare, finance, and autonomous driving) to update the governance landscape and promote cross‑regional dialogue.
EU: AI Act fully implemented, enforcement mechanisms maturing
In the paper, the EU AI Act is presented as the most comprehensive global AI governance framework, using a tiered risk approach (unacceptable, high, limited, minimal), emphasizing mandatory assessments and transparency disclosures; its strength lies in procedural safeguards, but coordination challenges in enforcement are significant. After the Act formally took effect in August 2025, November saw notable progress: on October 10 the European Commission published a severe‑incident reporting template for general‑purpose AI ("GPAI") models, requiring developers to report biases or security vulnerabilities and covering models such as OpenAI's. The template integrates elements of the NIST framework to improve cross‑border reporting efficiency. Meanwhile, the August 14 update to AI Act enforcement mechanisms included GPAI practice guidelines and provided compliance sandbox testing to reduce burdens on SMEs.
Recent moves include expansion of the "AI Factory" network (announced October 10), with over €1 billion in investment to support ethical audits of high‑risk AI such as medical diagnostics. On November 4 the Commission launched a public consultation on an "adaptive review" to assess implementation challenges, with potential revisions to the tiered standards in 2026. Under global influence, the EU is promoting OECD standardization and maintains maximum fines of €35,000,000 for "unacceptable" risks such as certain uses of facial recognition. Compared with the paper, enforcement has moved from theory toward practice: the 2025 edition of the Stanford AI Index shows relatively higher compliance rates among EU high‑risk systems, though SME burdens remain high. This reinforces the paper's finding of a structural lead but also exposes fragmentation risks in coordination.
US: From deregulatory posture toward targeted action, emphasis on infrastructure and leadership
The paper characterizes US AI governance as decentralized and sector‑specific (e.g., FDA oversight of medical AI), relying largely on voluntary guidance that fosters innovation but is fragmented. Following the inauguration of the Trump administration in 2025, policy shifted: on July 24 the "America’s AI Action Plan" prioritized deregulation, infrastructure and global leadership, directing NIST to revise the AI Risk Management Framework (RMF) to remove references to "misinformation", DEI and climate change and to emphasize "national security first." The plan instructed federal agencies to simplify AI export controls and to support chip exports for companies such as NVIDIA (note: the latest statement from President Trump expressed unwillingness to export high‑end NVIDIA chips), while establishing regulatory sandboxes and shortening approval timelines for some high‑risk areas such as autonomous driving.
November developments focused on state‑level implementation: Colorado's AI Act (effective February) pioneered high‑risk rules for employment and consumer AI, requiring bias audits; New York's RAISE Act (passed August) mandates frontier model risk disclosures and covers fintech. Executive Order 14277 (April) promoted arts and AI integration, funding cultural AI projects. At the federal level, an OMB memorandum (May) revised Biden‑era guidance to emphasize internal accountability over mandates. A Morrison Foerster report (July 27) noted that this shift has boosted innovation (AI investment up 20%) while weakening some ethical guardrails (for example, deepfake prohibitions limited to non‑consensual sexual content under the May 20 TAKE IT DOWN bill). Compared with the paper, the US is moving from fragmentation toward coordinated deregulation, increasing adaptability but reducing transparency and potentially amplifying bias risks.
UK: Growth‑oriented action plan and flexible, tool‑based regulation
The paper praised the UK's sectoral flexibility (e.g., the FCA for finance, ICO for data) supported by CDEI advice, but noted uneven coverage. After the Labour government took office in 2025, UK AI governance shifted to a "growth‑first" posture: on January 13 the "AI Opportunities Action Plan" launched AI growth zones, a National Data Library and new infrastructure, targeting a 10% GDP contribution from AI by 2030. On February 10 the Government Digital Service published the "AI Playbook" to guide public‑sector deployment, offering 13 principles covering secure design, development and maintenance, and applying to high‑risk cases such as digital planning (where AI tools replaced paper systems in April).
By November: the "AI (Regulatory) Bill" was reintroduced to Parliament on March 4, reasserting producer liability and ethical review; a consultation on the "Cloud and AI Development Bill" opened April on computing needs and edge infrastructure. July saw development of AI regulatory tools including a unified digital policy library to simplify compliance (King & Spalding report). A February governance announcement strengthened voluntary codes covering lifecycle security. A RAND analysis (January 26) positioned the UK as a leader at the Paris AI Summit (February) with higher adaptability than the EU, though legislation lags (BCLP predicted on January 28 that statutory law might not pass within the year). Supplementing the paper, the UK is evolving from "flexible" to "tool‑based" governance, responding faster on innovation while public participation still needs strengthening.
China: Standards surge and tightened security, accelerated governance for generative AI
The paper classified China's framework as centralized and state‑led (with CAC and MIIT as main actors), characterized by rapid enforcement but limited transparency. By November 2025 China entered a "standards year": on October 31 the Cybersecurity Law and the incident reporting regime were revised (effective November 1), integrating AI infrastructure risks and requiring generative AI providers to report data‑labeling security issues. The "Standards for Safe Governance of Generative AI" that came into force on April 25 cover ethics review and bias audits; on September CAC measures consolidated previously scattered requirements with maximum fines of RMB 100,000,000.
Recent moves include the "Rules for Labeling AI‑Generated Content" issued March 14 (effective September 1), mandating watermarking and disclosure to address deepfakes and social surveillance. On October 9 SAMR announced 30 national AI standards with 84 more accelerated for development, including GB/T 45674‑2025 on data labeling (tracked by Bird & Bird). A July "Personal Information Protection Compliance Audit Measures" requirement mandates periodic review of AI processing activities; under the Shanghai Cooperation Organization framework China is promoting AI standard exports along the Belt and Road. Science (2025) discussed a draft "Model AI Law" emphasizing an open future, but no formal release has occurred. An ICLG report (July 21) noted a March ruling by the Beijing Internet Court recognizing copyright protection for AI‑generated images. Compared with the paper, China is moving from rapid deployment to deeper standardization and improved transparency (including public audit mechanisms), though international cooperation frictions have increased (for example, US‑China chip restrictions).
Cross‑regional comparison and global lessons: the challenge of dynamic balance
After supplementation, governance in the four regions converges toward risk stratification (EU/China leaning toward mandatory regimes, US/UK favoring voluntary approaches), but differences have widened: the EU and China emphasize safety (reporting templates and standards), while the US and UK prioritize growth (action plans and playbooks). High‑risk sectors show clear impacts: EU medical AI compliance has risen, the US has expanded autonomous driving pilots, the UK has toolified financial regulation, and China has standardized facial recognition labeling. Globally, OECD coordination on high‑risk standards is emerging as common ground but geopolitical tensions (such as US‑China trade restrictions) impede progress. The paper's limitations, such as a static snapshot, are partly addressed here: 2025 AI financing is projected to exceed $500 billion, underscoring the need for "local adaptation plus international dialogue."
Conclusion: Toward sustainable AI governance
Al‑Maamari’s paper provided a foundational framework for AI risk governance; subsequent developments show major jurisdictions shifting from static frameworks to dynamic ecosystems. The EU is maturing in enforcement, the US is deregulating to spur innovation, the UK is operationalizing flexible tools, and China is rapidly standardizing — each with strengths and complementary gaps. Future cross‑regional agreements (for example a G7 AI pact) could prove pivotal in promoting inclusive development. Policymakers, industry and scholars should beware: innovation must not come at the expense of rights. Ongoing tracking of 2026 revisions to global AI risk governance will help shape the next era of AI.