Direct answer: the US looks at procurement, the EU at regulation, Japan at guidelines, and all three require AI suppliers to produce verifiable governance evidence: how data is used, how risk is managed, how performance is monitored, and who is accountable. An AI management system built on the international standard ISO 42001 can serve as the common basis for answering all three at once.
What the three markets require of AI suppliers
| Market | Main basis | Nature and status | Requirements on suppliers |
|---|---|---|---|
| United States | OMB M-25-22, the federal AI procurement memorandum | In force; applies to contracts whose solicitations were issued after 30 September 2025 | No training of public models on non-public government data, protection of data and intellectual property, avoiding vendor lock-in, disclosure of AI use, and regular risk assessment and mitigation |
| European Union | AI Act (as amended by Regulation (EU) 2026/1744); draft Cybersecurity Act revision CSA 2.0 | The AI Act applies in stages, with Article 50 transparency obligations applicable since 2 August 2026; CSA 2.0 was proposed on 20 January 2026 and is in the legislative process | High-risk AI must meet risk-management, data-governance, technical-documentation and human-oversight requirements; the draft CSA 2.0 establishes a trusted ICT supply-chain framework |
| Japan | AI Act (Japan), AI Basic Plan, AI Guidelines for Business | The AI Act fully in force since 1 September 2025; the Basic Plan approved by Cabinet on 23 December 2025; Guidelines version 1.2 published on 31 March 2026 | Centred on "trustworthy AI" without penalties; government procurement and subsidies lead by requiring safety, transparency and accountability |
Key dates ahead
- 2 December 2026: under the EU AI Act, generative AI systems placed on the market before 2 August 2026 must complete technical marking of AI-generated content.
- 2 December 2027: EU AI Act obligations for stand-alone high-risk AI systems apply.
- 2 August 2028: EU AI Act obligations for high-risk AI embedded in products apply.
- The research firm Gartner predicts that by 2027 AI governance will become a mandatory requirement of sovereign AI regulations worldwide (a research-firm forecast, not an established fact).
What this means for Taiwanese companies
Companies selling into the US government supply chain must be able to explain data use and risk management; AI products sold into the EU must prepare technical documentation and human-oversight mechanisms by risk class; companies supplying Japanese customers may be asked to explain their governance against the AI Guidelines for Business. The evidence for the three requirements overlaps heavily: risk assessment, data governance, change and performance monitoring, incident reporting and the division of responsibility. Build the AI management system once, and you do not need a separate one for each market.
How Winners approaches it
What follows is Winners' own account. Use the three markets' requirements above to test us in exactly the same way you test any other consultant.
- Determination one by one: by product and use case, determine the requirements and roles that apply in each of the three markets.
- One management system: build the AI management system on ISO 42001 and map the three markets' requirements onto the same system and evidence.
- Process definition: who is responsible, what is done, when, and where the evidence of doing or not doing it is.
- Consulting team: VP- and director-level consultants guide the whole engagement; consultants hold ISO 42001 lead-auditor credentials.
Related questions
- How should the ISO 42001 and AI Act budget and timeline be planned? ISO 42001 and AI Act budget and timeline
- How do I choose an AI governance consultant? How to choose an ISO 42001 and AI Act consultant in Taiwan
- My product has AI functions; how is the CRA handled? Article 12 of the CRA gives high-risk AI products that comply with the CRA a presumption of conformity with Article 15 of the AI Act for the cybersecurity part. Estimating a CRA budget
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.