Navigating AI Compliance: Building Foundations for Future Success

As governments race to establish rules for artificial intelligence, many enterprise leaders find themselves navigating an increasingly complex compliance landscape. The European Union's AI Act, General Data Protection Regulation (GDPR) requirements, state-level legislation in the U.S., and a growing collection of industry-specific guidance have created what many describe as a fragmented patchwork of regulations. For CIOs and technology leaders, the challenge can seem daunting: How do you stay compliant when the rules are still being written?

Yet the regulatory complexity may be distracting organizations from a more important reality. While the language, scope and enforcement mechanisms may differ across jurisdictions, many AI regulations are ultimately trying to solve the same fundamental problems. Organizations that focus on strong governance foundations rather than chasing individual regulations may find themselves better prepared for whatever comes next.

That perspective comes from Arron Lamp, CIO of Tokio Marine HCC's Public Risk Group. At the 2026 Insurtech Insights USA Conference, Lamp participated in a fireside chat exploring a critical question facing enterprises today: What is holding back large-scale AI deployments? In a subsequent one-on-one interview, he argued that while regulatory frameworks may continue to evolve across jurisdictions, the organizations most likely to succeed will be those that establish strong governance foundations, understand their data, and maintain clear accountability for how AI is used throughout the business.

Why AI compliance starts with shared regulatory goals

When asked about the growing divergence between U.S. and European approaches to AI regulation, Lamp offered a perspective that may surprise many executives.

At nearly every technology conference, vendors are eager to showcase AI-powered features and capabilities. While those innovations may create new opportunities, they also introduce new compliance considerations.

For CIOs, understanding what a vendor's AI capabilities actually do has become just as important as understanding the service being provided.

Organizations should be asking questions that were largely irrelevant only a few years ago:

• Does the product use AI or large language models?

• How is customer data processed?

• What controls exist around data access and retention?

• How are outputs monitored and validated?

• What governance processes exist behind the scenes?

Lamp argues that organizations should hold vendors to the same standards they would apply internally.

"You shouldn't have any vendor doing something differently than you would do it yourself," he said.

That mindset is becoming increasingly important as AI capabilities become embedded in software platforms, productivity tools and third-party services throughout the enterprise.

How data, logic and control support AI compliance

For organizations that feel behind, Lamp recommends focusing on three core priorities.

First, get the data right. Data quality, ownership, governance and access controls form the foundation of every successful AI initiative. Poor data governance inevitably becomes poor AI governance.

Second, preserve deterministic logic. Organizations need a clear understanding of which decisions should remain governed by established business rules and which can be influenced by AI systems. Not every decision should be delegated to a model.

Third, control the environment. That includes controlling access to data, monitoring model behavior, establishing review processes and maintaining oversight of how AI systems operate in production environments.

Interestingly, Lamp rejects the notion that AI represents an entirely new governance challenge. Instead, he sees it as an extension of discipline organizations have been managing for years through predictive analytics, modeling and risk management programs.

The principles remain largely the same. The scale and visibility have simply increased.

Why AI governance responsibility does not stop with vendors

One of the most common strategic questions organizations face is whether to build AI capabilities internally or rely on third-party vendors. According to Lamp, that may be the wrong question.

Whether an organization builds, buys or rents AI capabilities, the governance responsibility remains unchanged. Leaders must still understand what the technology does, how it works and what risks they are accepting.

"AI for the sake of AI is not a good thing," he said.

Instead of focusing on the source of the technology, organizations should focus on whether they understand its purpose, limitations and business impact.

That same discipline extends to broader executive decision-making. Lamp cautions against viewing AI as an arms race where every new capability must be adopted immediately. The more effective approach is to identify where AI creates meaningful business value and apply it thoughtfully.

Like any technology tool, AI excels in certain use cases and falls short in others. The organizations that succeed will not necessarily be those deploying the most AI. They will be the ones deploying it where it makes sense.

Why future AI compliance depends on today’s governance basics

When asked what AI compliance might look like three years from now, Lamp offered a candid answer: nobody really knows.

What he does know is that organizations will learn from experience.

He compares future AI governance to highway guardrails. Guardrails are installed because someone, somewhere, drove off the road. Over time, organizations and regulators will accumulate real-world examples of AI failures, near misses and unintended consequences. Those experiences will shape future controls and governance expectations.

In the meantime, CIOs should resist the temptation to chase every new regulatory headline.

The future of AI compliance may not depend on mastering an ever-changing collection of regulations. It may depend on something far less glamorous: strong data governance, clear oversight processes, disciplined vendor management and a commitment to understanding how AI systems actually work.

In other words, the future may belong not to the organizations with the most sophisticated AI strategies, but to those that get the boring basics right.