Can one AI system comply with several regulatory regimes at once?

Rules about AI break into two parts that usually get discussed as one. The policy covers which data may be used, which decisions need a human, and what must be disclosed. It is genuinely jurisdictional and can differ in every regime. The enforcement point is the place in a system where a rule is checked before something happens. That is an architectural choice, and it is the same choice everywhere.

So what a system is permitted to do varies by jurisdiction. Where that permission is checked can stay the same.

Where the cost of compliance comes from

A system that enforces rules inside each application has to be rebuilt for each divergent rule. A system that routes every request through a single control point treats a divergent rule as configuration: a different rule set applied in a different deployment, on the same machinery. The cost of operating under several regimes is set largely by where enforcement sits, and much less by how many regimes there are.

This is a property of the architecture. It holds for any supplier's stack, and for one built in-house.

Sentinel, an AI gateway, is one example at the endpoint. An admin sets the rule once, either replacing the values it catches or blocking the request, and the rule applies to every request that passes through. Compliance with each regime, and any certification, rests with the organization and its auditors; Sentinel is one control inside that program.

More than one regime already applies

An organization operating internationally can face more than one regime. Under Article 2, the EU AI Act can apply to a provider placing an AI system or general-purpose model on the EU market, to a deployer established in the EU, or to a provider or deployer outside the EU when the system's output is used in the EU. Article 113 phases the Act's application dates. Serving a European customer alone does not establish territorial coverage or that every duty applies today.

Within the United States, whether federal law will preempt state AI rules is an open fight. Attempts to attach preemption to the annual defense authorization ran through 2025 and 2026, and a White House framework in March 2026 called for it. Whichever way that ends, an organization with international customers keeps more than one rule set.

What to decide

• Separate the two parts in your planning. Which rules differ by market is a question for legal and compliance. Where they are checked is an engineering decision, made once.
• Put the check where every request passes. With one control point, a new regime arrives as a new rule set.
• Keep one record across regimes. Each regime asks for evidence. One record of every request, tied to who made it, answers each of them from the same place.