AI governance has shifted from a nice-to-have compliance task to a mandatory business requirement that can make or break corporate partnerships. Large enterprises are now embedding AI governance requirements directly into supplier contracts, and companies without credible governance frameworks are losing major deals to competitors who have them.

Why Are Companies Suddenly Demanding AI Governance from Their Partners?

The regulatory landscape for AI is fragmenting rapidly across multiple jurisdictions, making it impossible for organizations to wait for clarity before acting. In 2026 alone, 45 U.S. states have proposed more than 1,500 AI-related bills, already surpassing the entire output of 2024. This explosive growth in state-level legislation, combined with federal initiatives and international frameworks, has created a patchwork of requirements that organizations must navigate simultaneously.

Rather than waiting for regulatory consensus, forward-thinking companies are using procurement as a governance enforcement mechanism. Microsoft's Supplier Security Program and similar frameworks increasingly require certifications or evidence of AI governance before companies can win contracts. Legal tech and healthcare tech companies report that large healthcare systems refuse to do business without a credible AI governance roadmap. One company lost a major deal to competitors who had achieved ISO 42001 certification, prompting its CEO to demand the same certification within weeks.

This shift reflects a fundamental change in how risk is being managed in the AI era. Rather than waiting for regulators to enforce rules, enterprises are using their purchasing power to ensure their supply chains meet governance standards before problems occur.

What Specific Governance Requirements Are Companies Now Demanding?

Organizations are gravitating toward ISO 42001, the international AI management systems standard, as the foundational infrastructure for AI governance. This standard establishes core principles applicable across jurisdictions and provides flexibility that allows companies to comply with future mandates while meeting current business demands.

The regulatory landscape includes three broad categories of AI laws that companies must prepare for:

• Comprehensive Laws: These target high-risk AI systems used in consequential decision-making, such as Colorado's original AI Act and Texas's Responsible AI Governance Act (TRAIGA), though Colorado's approach was recently replaced with a lighter-touch framework.
• Developer-Focused Laws: These directly target large language model creators and make them accountable for harm before it occurs, like New York's RAISE Act.
• Sector-Specific Laws: These address narrow use cases, including New York City's automated employment decision tools law requiring annual algorithmic bias audits and Tennessee's ELVIS Act protecting musicians from AI voice cloning.

Beyond the United States, international regulators are also tightening requirements. The UK Financial Conduct Authority (FCA) recently published the Mills Review, which recommends scaling up AI operations and adopting AI technology within regulatory operations while strengthening coordination and oversight. The FCA plans to publish guidance on good and poor AI practices later in 2026, following engagement with firms on where the technology is working well and where further clarity is needed.

How Should Organizations Build AI Governance Frameworks That Actually Work?

Rather than building compliance programs around a single regulation, organizations should construct governance on principles-based frameworks that work regardless of which specific regulation ultimately prevails. Here are the key steps experts recommend:

• Start with ISO 42001: Establish core principles applicable across jurisdictions, including governance committees, risk assessments, impact assessments, and accountability structures. This foundation positions organizations to make decisions quickly while giving them infrastructure to comply with future mandates.
• Expect B2B Enforcement First: Organizations should anticipate business-to-business enforcement before regulatory enforcement arrives. Large enterprises are already embedding AI compliance into supplier contracts, making governance a deal-breaker in procurement decisions.
• Designate Clear Ownership: Treat AI governance as a strategic function with clearly defined roles, responsibilities, and executive accountability. When GDPR arrived, organizations appointed Data Protection Officers; AI governance should follow a similar pattern with a designated governance committee.
• Apply Risk Tiering: Not all AI is created equal. Start with visibility by identifying what AI systems are in use and who owns them. Then tier by risk, prioritizing high-impact use cases that handle customer data, influence financial decisions, or affect core business revenue, while applying lighter oversight to internal productivity tools.

The risk-tiering approach is particularly important because many organizations stumble trying to bring every AI use case into scope at once. By focusing governance resources on the highest-risk systems first, companies can build sustainable programs that scale over time.

What Are Global Regulators Doing to Shape AI Governance?

International regulators are moving beyond principles and toward comprehensive regulatory frameworks. Thailand has taken a significant step by releasing a revised draft AI Act for public consultation, adopting a risk-based approach influenced by international frameworks such as the EU AI Act. If enacted, Thailand's law would introduce obligations extending beyond the country's borders and establish one of the most comprehensive AI regulatory regimes in the Asia-Pacific region.

Thailand's approach includes several notable features. The draft law would apply to AI development, deployment, and other activities affecting individuals in Thailand, regardless of where the AI provider is established. Foreign AI providers serving individuals in Thailand may be required to appoint a local representative or authorized coordinator, potentially with broad authority to act on behalf of the provider. The law also introduces a strict liability regime, meaning liability may arise independent of actual intent or negligence, subject to limited statutory defenses.

The Thai government has also launched the AI Governance Practice Centre, expanding its existing AI Governance Centre into a regional implementation hub, and plans to make AI governance requirements mandatory across public agencies. These initiatives underscore a global shift from voluntary AI governance principles toward comprehensive regulatory frameworks based on risk, accountability, and trust.

In the financial services sector, the FCA's Mills Review identified four major shifts likely to affect retail financial services: the transformation of firm operations, the evolution of consumer journeys, the reshaping of competition and market power, and the amplification of fraud and cyber risks. Research commissioned by the FCA found that one-fifth of UK adults, equivalent to 11 million people, would be likely to use agentic AI in personal finance, systems that can act autonomously within pre-set goals.

"Artificial intelligence will transform financial services by 2030. It creates significant opportunities for consumers, firms and the wider economy. This report sets out a roadmap for how industry regulators and government can prepare for the next phase of AI-driven change in our world-leading financial services sector," said Sheldon Mills, executive director at the FCA.

Sheldon Mills, Executive Director at the Financial Conduct Authority

However, experts warn that consumers need protection from overreliance on AI systems. David Brooks, head of policy at Broadstone, emphasized that pensions are complex, long-term financial arrangements where mistakes could have lasting consequences. He noted that while AI has a role in improving engagement and understanding, consumers need to treat it as a starting point, not a substitute for professional guidance or regulated advice.

"While AI has a role to play in improving engagement and understanding, consumers need to treat it as a starting point, not a substitute for professional guidance, scheme information or regulated advice," explained David Brooks.

David Brooks, Head of Policy at Broadstone

The bottom line is clear: organizations that delay building AI governance frameworks are putting themselves at a competitive disadvantage. As regulatory requirements multiply and enterprises increasingly demand governance compliance from their suppliers, the window for voluntary adoption is closing. Companies that act now to establish principles-based governance frameworks will be better positioned to adapt to whatever regulatory landscape emerges, while those that wait risk losing business opportunities and facing compliance crises when regulations finally arrive.