The subset of an organization’s AI footprint that sits under active or pending regulation—jurisdiction, use case, and data type all shape scope.
Regulatory exposure is a map, not a checklist: same product may hit EU AI Act rules in the EU, Colorado AI Act in CO, and sectoral rules (HIPAA, finance) elsewhere. Maintain an AI system inventory to make exposure legible.