A worldwide AI policy map should preserve the differences between its sources

A worldwide AI policy dashboard can become misleading even when every link points to a reputable institution. It might place a treaty signature beside a regulator’s opinion, a voluntary framework beside a domestic law, and display them all as “active rules.” The problem is the relationship between t

A worldwide AI policy dashboard can become misleading even when every link points to a reputable institution. It might place a treaty signature beside a regulator’s opinion, a voluntary framework beside a domestic law, and display them all as “active rules.” The problem is the relationship between the records. Readers need to know who issued an instrument, what kind of authority it has, which milestone is being reported and what remains to be checked before it matters to a particular service.

Imagine a fictional adult founder, Daniel, planning an enterprise research assistant for customers in several countries. A student researcher helps him collect official sources. They use only public documents and synthetic product scenarios. Their aim is to build a question map for specialist review, not to issue a worldwide legal opinion. The most useful early improvement is to separate facts about a source from conclusions about Daniel’s proposed business.

Four international developments, four different meanings

The OECD announced revisions to its AI Principles on 3 May 2024, responding to developments including general-purpose and generative AI. These are intergovernmental principles and recommendations. Their adoption should not be described as automatically creating a directly applicable company law in every adhering jurisdiction; domestic implementation is a separate question. [Organisation for Economic Co-operation and Development](https://www.oecd.org/en/about/news/press-releases/2024/05/oecd-updates-ai-principles-to-stay-abreast-of-rapid-technological-developments.html)

The Council of Europe Treaty Office records that Framework Convention 225 opened for signature in Vilnius on 5 September 2024. That is a treaty milestone. Signature, ratification, declarations, entry into force and domestic application are separate matters, and this article makes no current party-wide entry-into-force claim. A business should not infer its obligations merely from a photograph of a signing ceremony. [Council of Europe Treaty Office](https://www.coe.int/en-GB/web/conventions/full-list2?module=treaty-detail&treatynum=225)

Singapore IMDA’s 30 May 2024 factsheet describes a generative-AI governance framework with nine dimensions and participation by different ecosystem actors. It is a model-governance context rather than proof of worldwide binding legislation or mutual legal recognition. A team may learn from the framework while still needing a separate assessment of the jurisdictions where it operates. [Infocomm Media Development Authority Singapore](https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/factsheets/2024/gen-ai-and-digital-foss-ai-governance-playbook)

The EDPB’s Opinion 28/2024, adopted on 17 December 2024, considers anonymity, legitimate interests and consequences of unlawful personal-data processing in AI-model development and deployment. It is a regulator opinion under GDPR, not an approval of a particular model or a universal lawful basis. The case-specific assessment must not disappear when the opinion is summarised. [European Data Protection Board](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf)

Those distinctions are useful even before Daniel’s team studies a particular market. A source can express a shared policy direction without supplying an operative requirement for the proposed application. Conversely, a specific domestic obligation may matter even if it is absent from a global principles document. The map should support that difference rather than reward the team for collecting the largest number of links.

Build records around milestones instead of headlines

The student researcher can create a source card containing issuer, title, instrument type, jurisdiction, document date, update date, milestone date and check date. Unknown dates stay unknown. A page checked today is not necessarily a document published today, and a press-release date is not automatically the date on which an obligation applies. The card also records the particular proposition supported by the source and a short statement of what the source does not establish.

A second card describes the fictional service. It records the operator, intended customers, locations of affected people, kinds of information processed and decisions the service supports. This card may be reused across several jurisdictional reviews because it describes product facts. The resulting legal conclusions should remain separate. A change in intended use or destination can trigger another review without rewriting the historical source card to imply that it always covered the new situation.

The team can then connect the two cards through explicit questions. Does this instrument concern the kind of actor involved? Does the territorial scope reach the proposed activity? Is the relevant provision already applicable, or is the record about a future transition? Is the source a final instrument, draft, official explanation or voluntary resource? Who is responsible for resolving the remaining interpretation? An unanswered question is a legitimate map entry and can prevent a premature launch claim.

Cross-border operation requires tracing more than the customer’s address

For Daniel’s research assistant, a customer in one country may upload a document about a person elsewhere, while processing occurs through a supplier in a third location. The team should describe those facts accurately before assuming which rules apply. It should avoid treating a billing address, a server region or the language of the interface as a complete answer. The appropriate legal analysis depends on the relevant instrument and actual processing, not a single geographic label.

The supplier chain also deserves attention. The enterprise customer may determine an important purpose while the application operator chooses technical arrangements and another supplier provides model processing. The map should identify who can answer questions about retention, further use, access and updates. A contractual statement can be important evidence, but the team should record its scope and configuration rather than announce that the entire chain has been independently audited.

A practical synthetic exercise can change one fact at a time. The first scenario uses public research documents. The second introduces personal information. The third allows the assistant to influence a consequential decision. The fourth changes the intended destination. The student explains which source cards might need another look and which product facts are still missing. The exercise is valuable precisely because it does not presume that the same conclusion survives every change.

Make maintenance a reviewable task

A worldwide map becomes stale through both legal developments and product changes. Daniel can assign different responsibilities: a source researcher checks official updates, a product owner records capability changes, and an appropriate specialist resolves applicability questions. The review record identifies what changed and why an earlier conclusion was retained or reopened. A generic “last reviewed” badge gives much less information than a record of the specific milestone or capability that changed.

Access limitations should remain visible. An official page may be available through a search index while direct retrieval encounters a challenge, or a document may lack a reliable publication date. The researcher can retain the observed source passage and disclose the missing raw identity or date. It should not invent a hash, replace the source with an unofficial summary without saying so, or treat a failed fetch as evidence that the legal development does not exist.

For the ordinary reader, the map should offer a clear next step: inspect the source, review the product facts, or seek the relevant specialist decision. Internal retrieval failures should become safe, actionable states rather than raw technical errors. As of 15 October 2026, the primary developments above support the stated milestones and status distinctions. The proposed map is a method for organising evidence and questions across borders; it does not certify a service, establish treaty implementation in any country, or promise one universal route to compliance.

Evidence diagram and readable guide


Original source-milestone and question-map diagram; EDPB adoption and publication dates are distinct, and the fictional service has no legal approval.

[Open the complete evidence diagram](/assets/policy-workflow-crossborder-policy-20261016.svg)

Read the diagram

**A worldwide AI policy map should preserve the differences between its sources**

The EDPB dates illustrate distinct source milestones. The fictional product review remains separate; no treaty status, worldwide legal result or measured effect is implied.

- **Adopted · 17 Dec 2024** The PDF records when EDPB Opinion 28/2024 was adopted.

- **Published · 18 Dec 2024** The official EDPB document entry carries a separate publication date.

- **Source card** Keep issuer, instrument type, milestones, check date and access limits.

- **Product facts** Describe people, information, supplier roles and intended destinations.

- **Applicability questions** Ask which actor, territory, provision and stage match those facts.

- **Open review map** Retain what is supported, what remains unknown and who reviews a change.

A source record and a product description are separate inputs. Neither alone determines cross-border applicability.

How the connections work

- These are successive documentary dates, not a one-day change in duties or a new legal permission.

- The adoption date belongs in the source card without being relabelled as publication.

- The official publication entry is recorded alongside, rather than over, the adoption milestone.

- Source authority and temporal limits contribute questions, not a ready-made conclusion for the business.

- The fictional service’s facts independently inform which applicability questions need specialist review.

- The map keeps unresolved questions and review ownership visible instead of issuing a worldwide compliance badge.

Relationship key

The first arrow is chronology only. Dashed adoption provenance and solid publication provenance preserve distinct dates; later arrows organise questions without certifying a legal result.