When AI regulation leaves the lab
and enters your category.

SIGNAL · 01The myth decision-makers still believe

Every time a new wave of regulation appears, the core categories (in this case, the large AI companies) get most of the coverage. The peripheral categories become part of the story only once the regulation touches them directly, usually too late to prepare.

AI regulation in 2024-2026 is following exactly this path: it starts with the EU AI Act, continues to the NIST AI RMF in the United States, expands to middle-tier countries, and along the way stops at every category in which automated decisions affecting people are made.

If your product makes an automated decision about people, you are in the category, even if you never declared it.

SIGNAL · 02Five "ordinary" categories already receiving AI rules

1. Financial services. Credit approval, insurance pricing, investment algorithms. Any system that introduces an automated decision about a customer is subject to new AI rules (the EU AI Act, the updated FCRA rules in the United States).
2. Health. Diagnostic tools, patient triage, treatment recommendations. The FDA has set out an expanded SaMD framework, the EMA requires algorithmic transparency, and health insurers are starting to examine "AI for billing."
3. Education and candidate assessment. Automated CV screening, exam grading, adaptive learning. A growing number of US states have enacted "Algorithmic Hiring Audits" laws, and in the European Union this area falls under the "High-Risk AI" category.
4. Real estate and property insurance. Home insurance pricing, automated property valuation, climate risk analysis. Without any explicit announcement, this area has already entered AI Act frameworks.
5. Media and advertising. Content-matching platforms, music and image recognition systems, generative AI in media. Platform "Transparency" regulation is coming into force.

SIGNAL · 03The 3-question test: are you in the category without knowing it?

If you answer "yes" to any of the following, you are subject to AI regulation, or soon will be:

1. Does your system make a decision (even a recommendation) about a person, based on that person's data?
2. Does that decision affect access to a service, price, approval, or status?
3. Does the system use any statistical model or AI, rather than only explicit human-written rules?

SIGNAL · 04A readiness playbook: 5 steps for "peripheral" categories

1. System inventory. A list of every system in your product that makes an automated decision.
2. Risk classification. Classify each system as "high risk," "medium risk," or "minimal," according to the EU AI Act framework, which serves as the international benchmark.
3. Documentation. Require a document explaining how each system reaches its decisions. Even if the regulator has not yet demanded it, the market will start demanding it from today.
4. Built-in transparency. The ability to explain to the customer, clearly, why a decision was made. This is already a standard of trust, not just regulation.
5. An update plan. Regulation keeps intensifying. Anyone who updates systems only once every two years will find themselves falling behind.

SIGNAL · 05Signals to watch in the coming months

• Publication of compliance guidelines for the EU AI Act in additional "high-risk" categories.
• First court rulings applying the law to categories that never thought of themselves as AI.
• New ISO/IEC standards for AI governance starting to enter B2B contracts.
• New disclosure requirements from financial regulators on "revenue-generating AI."
• New insurance products (Algorithmic Liability Insurance) appearing on the market.

The biggest regulatory surprise of 2026 will not be where AI is. It will be where AI has been defined as present, even when the product owners did not see it that way.