Global Regulatory Innovation Platform

Regulatory Innovation Knowledge Hub

The Knowledge Hub is a curated digital platform that brings together cutting-edge case studies that highlight how governments and partners around the world are rethinking regulation for the 21st century.

Whether you're looking to explore regulatory sandboxes, AI governance frameworks, or digital public infrastructure playbooks — the Hub offers actionable insights and tested tools to support agile, adaptive, and inclusive policymaking.

Have a case study, tool, expert perspective or insight to share?

We welcome contributions from regulators, researchers, and industry leaders. Submit your case studies below or write to us at GRIP@weforum.org.

The Expert Lens

Introducing a new video series featuring curated insights from established figures across government, industry, and international organizations — offering diverse expert perspectives on the evolving landscape of regulatory innovation and its role in shaping responsible technology governance.

Klaus Moosmayer - Deutsche Bank 

Regulatory systems built for the past can’t keep pace with AI, and trust in institutions depends on closing that gap. Klaus Moosmayer explains how integrated assurance, which connects governance, risk, compliance and controls, can help boards govern AI responsibly.

Katja Roth Pellanda - Zurich Insurance

When compliance becomes a copy-paste job, who's really accountable? Zurich Insurance's Katja Roth Pellanda makes the case for keeping the human dimension at the centre of AI-era regulation.

The UK Financial Conduct Authority introduced the Consumer Duty, an outcomes-based rule requiring financial firms to prove that products, pricing, support and communications deliver good outcomes for retail customers.The dilemmaUK retail financial services had for decades been regulated through detailed, prescriptive rules layered on top of a general “Treating Customers Fairly” principle. Despite this, the sector experienced repeated large-scale consumer harm, most visibly Payment Protection Insurance (PPI) mis-selling, which generated tens of billions of pounds in redress. As products digitalised, distribution chains lengthened, and vulnerable-customer needs became more visible after the pandemic and cost-of-living pressures, the FCA judged that rules alone were being satisfied on paper while some firms still produced poor value or confusing outcomes for customers. The regulatory gapExisting Principles for Businesses and product-level rules did not require firms to actively evidence that specific customer outcomes, value, understanding, support, suitability,  were actually being achieved. Compliance could be demonstrated through process (disclosures issued, forms completed) rather than through proof of good outcomes. Regulatory intervention was largely reactive, occurring after harm had crystallised and often years after a product was sold. Retail customers, and particularly vulnerable customers, bore the risk of continued poor-value products, weak exit or switching terms, and opaque or jargon-heavy communications, with accountability increasingly diffused across multi-firm distribution chains where no single party could be pinned to the end customer outcome.The approachFollowing consultation, the FCA introduced final Consumer Duty rules and guidance in July 2022. The Duty itself came into force in two stages: from 31 July 2023 for new and existing products and services, and from 31 July 2024 for closed products and services – a phasing that matters for reading the results below, since most of the evidence gathered so far covers only the period since July 2023.At its centre is a new Consumer Principle requiring firms to “act to deliver good outcomes for retail customers.” This is supported by cross-cutting rules requiring firms to act in good faith, avoid foreseeable harm, and enable and support retail customers to pursue their financial objectives.The framework defines four outcomes against which firms should assess their performance:Products and services: products and services should be designed to meet the needs, characteristics and objectives of an identified target market.Price and value: firms must assess whether products and services provide fair value.Consumer understanding: communications should support customers in making informed decisions.Consumer support: firms should provide support that meets customers' needs throughout their relationship with the firm.A distinctive feature of the model is its emphasis on evidence. Firms are expected to monitor whether they are delivering the required outcomes, identify poor outcomes and take action where necessary. Their governing bodies must review and approve an assessment of whether the firm is delivering good outcomes at least annually.The FCA has subsequently used supervisory and multi-firm reviews and published examples of good and poor practice to support firms in understanding and improving implementation.Results achievedThe FCA reports tangible early benefits for consumers. Following base-rate increases of 0.25 percentage points between July 2023 and February 2024, firms increased easy-access savings rates by an average of 0.45 percentage points. The FCA has not claimed this increase as a proven result of the Duty, but it estimates that a change of this size could deliver around £4 billion in additional annual interest to savers if sustained across the market. A related intervention on GAP insurance commission structures is expected to save consumers a further £70 million.Evidence of implementation is more mixed. The FCA’s December 2024 review of the first annual Consumer Duty board reports, covering 180 firms, found genuine engagement with the Duty’s four outcomes, but uneven evidence that those outcomes were actually being achieved. Many firms still relied on measures of whether processes had been completed rather than data showing what customers experienced, with particular gaps for vulnerable customers and outsourced distribution. Reviews of 20 large insurers and 23 payments firms similarly found that outcomes monitoring needed to mature. A subsequent review of 80 firms found progress, but continuing weaknesses in demonstrating outcomes consistently across the full customer base rather than selected samples.The shift also carries costs. Implementing the Duty can be particularly demanding for smaller firms and those operating legacy or closed-book systems. In response to industry feedback and its own implementation experience, the FCA has begun simplifying aspects of the framework and clarifying its scope, seeking to preserve the Duty’s outcomes-based approach while reducing unnecessary regulatory burden.The transferable lessonThe UK experience illustrates how regulators can move beyond compliance with prescribed processes by defining the outcomes they expect regulated firms to achieve and requiring firms to generate evidence that those outcomes are being delivered.Three features are particularly relevant for other regulators:Define the destination without prescribing every route. Clearly specified outcomes can provide a common regulatory standard while giving regulated entities flexibility in how they achieve it.Make evidence part of the regulatory model. Outcomes-focused regulation depends on firms being able to monitor, test and demonstrate what customers experience in practice.Combine flexibility with active supervision. Greater discretion places additional demands on firms' data, governance and judgement and requires continuing supervisory engagement to identify weaknesses and clarify expectations.The case also highlights an important trade-off. Outcomes-focused regulation can make a framework more adaptable to different business models and changing markets, but flexibility can create uncertainty about what constitutes sufficient compliance. Effective implementation therefore depends on the combination of clear outcomes, evidence, governance and continuing regulatory feedback, rather than high-level principles alone.
United Kingdom
FCA Consumer Duty: Outcomes-Based Regulation for UK Retail Financial Services
Financial Conduct Authority
Sharjah's rental market had outgrown its 2007 leasing law. In 2024, a new law rewrote the rules for contracts, rent assessment and evictions, and paired them with a dedicated centre for settling disputes faster.The dilemmaSharjah's rental market in 2024 looked very different from the one its 2007 leasing law was written for. The market had expanded, leases were increasingly managed online, and landlord-tenant disputes were becoming more frequent. The old framework had not kept pace with any of this.The regulatory gapThe 2007 law gave Sharjah no clear, modern rules for the basics of leasing: registering a contract, assessing a fair rent, controlling sub-leasing, or setting out exactly when a landlord could evict a tenant. Disputes went through processes not built for today's caseload or pace. Without an update, landlords and tenants faced growing uncertainty over their rights and obligations, and investors faced a rental market without predictable rules.The approachIn 2024, Sharjah issued Law No. (5) of 2024, replacing the 2007 framework, alongside Law No. (6) of 2024, which established a new Rental Dispute Centre. The new law covers residential, commercial, industrial and professional leases, with narrow exceptions for agricultural land, government housing, hotels and free zones that have their own courts.It mixes two styles of rule. Some things are spelled out precisely: how a lease is registered, the exact grounds for eviction (including demolition, reconstruction or major renovation), the rules for sub-leasing, and the procedure for rent deposits when a landlord refuses to accept payment. Other things are left more open, such as how fair market rent is determined and how flexibly a dispute can be resolved.The law also builds in digital lease systems and electronic notifications, and gives Sharjah Municipality stronger powers to enforce compliance. It was shaped through consultation with landlords, major property developers, tenants, real estate firms, Sharjah Municipality's legal departments, and an analysis of case trends from existing dispute committees.Results achievedSince the law took effect in 2024, Sharjah reports four changes. Compliance has risen, which the authorities attribute to mandatory lease registration and clear penalties for breaking the rules. Procedural delays have fallen, largely through the fast-track timelines of the new Rental Dispute Centre. Data on the rental market has become more accurate, giving municipalities a better basis for monitoring it. And dispute rulings have become more consistent and predictable, which Sharjah says is building confidence among both investors and tenants.Two limits are worth noting. The source material describes these as observed trends rather than sets out specific figures, so the scale of the improvement in compliance, delays or ruling consistency is not quantified. And because the leasing law and the Dispute Centre took effect through two separate laws in the same year, it is hard to isolate how much of the improvement each one contributed on its own.The transferable lessonSharjah paired a substantive rewrite of its leasing rules with a dedicated institution, the Rental Dispute Centre, to resolve the disputes those rules would inevitably still produce. The lesson for other regulators updating ageing tenancy or consumer law: a new rulebook changes incentives, but a new forum for resolving disputes under that rulebook is what makes compliance and enforcement real in practice. The law's design, precise on specific triggers like eviction and sub-leasing, more flexible on judgment calls like fair rent, is also a reminder that modern regulation does not need to choose between prescriptive and outcome-based rules. It can use each where it fits best.
United Arab Emirates
Sharjah's New Leasing Law: Replacing an Outdated Rulebook for a Growing Rental Market
Before UAE air taxis carry a single paying passenger, the GCAA built rules for them covering shared infrastructure, staged testing and international alignment, drawing manufacturers to test and launch in the UAE ahead of other markets.The dilemmaAdvanced air mobility, electric aircraft that take off and land vertically, does not fit the categories UAE's civil aviation rules were built around. By the mid-2020s, manufacturers were ready to test eVTOL air taxis and cargo drones, but no existing framework told them how, or whether, they could do that in UAE airspace.The regulatory gapExisting aviation rules covered conventional aircraft and helicopters, not electric vertical-lift aircraft, the vertiports they would need, or the digital air-traffic systems required to manage low-altitude urban airspace. Without a framework built for these specifics, the UAE risked either blocking a new industry from testing and launching, or letting it develop without the safety, security and oversight standards that aviation depends on.The approachThe General Civil Aviation Authority (GCAA) introduced a regulatory framework for advanced air mobility (AAM) and eVTOLs that mixes prescriptive and outcome-based rules: safety, infrastructure and approvals are spelled out in detail, while newer areas such as air-corridor design and digital traffic management are left flexible to allow for innovation.The framework covers eVTOL aircraft, vertiports (including hybrid infrastructure shared with helicopters), air-navigation services and the digital traffic-management systems that manage them. New technology is tested in stages: simulation-based testbeds and controlled pilot sites let manufacturers run autonomous air-taxi and drone trials before full certification, and GCAA works with manufacturers to check compliance at each stage before approving the next.The framework is explicitly built to align with international practice. GCAA describes its certification programme as being "in line with the highest global safety and performance standards," monitors developments at the EASA and the FAA, and is an active member of the ICAO AAM Study Group. It was shaped with input from eVTOL manufacturers and vertiport developers, and GCAA has partnered with the Technology Innovation Institute (TII) on evidence-based airspace design.Results achievedThe framework is still in its deployment phase, commercial AAM operations are targeted for 2026, once aircraft demonstrate operational readiness. Even so, a number of outcomes are already visible.GCAA, TII and ASPIRE have activated three national AAM testbeds, at Yas Island, Zayed Port and Abu Dhabi International Airport, running corridor modelling, wind mapping, separation standards and autonomous flight trials. Dubai's vertiport network, built by Skyports and the Roads and Transport Authority (RTA), is designed for 150,000 to 170,000 passengers a year, and more than 10 further vertiport sites have been announced across Abu Dhabi and Dubai.Several manufacturers have used the framework to test and fly in the UAE. Archer completed a full in-country eVTOL flight test campaign and separate test flights at Al Bateen Airport in Abu Dhabi. Joby completed the UAE's first piloted point-to-point air taxi flight, landing at Al Maktoum International Airport, and ran daily flight demonstrations at the Dubai Airshow 2025. XPENG AEROHT flew its first public manned flight in Dubai, and the UAE-built Lodd Autonomous completed the first test flight of its heavy-lift unmanned aircraft. GCAA has also begun certifying multiple eVTOL aircraft ahead of their FAA certification, and Archer and Joby have both publicly confirmed UAE commercial launch windows of 2025 to 2026.Two limits are worth noting. None of this is commercial passenger service yet: every flight listed above is a test, demonstration or certification step, not a revenue operation. And while manufacturers cite the UAE's regulatory stability as a reason for choosing it for early market entry, the source material notes that exact investment figures tied to that decision are undisclosed.The transferable lessonGCAA's approach shows how a regulator can attract an unproven technology before it is commercially ready, by building the rules, shared infrastructure and a staged testing pathway in advance, rather than waiting for the technology to mature elsewhere first. Three choices stand out. Mixing prescriptive and outcome-based rules let GCAA lock down safety basics while leaving room for air-corridor design and traffic management to evolve with the technology. Allowing vertiports to share infrastructure with existing helipads meant the UAE did not need a new, dedicated network to make testing viable. And explicit alignment with ICAO, EASA and FAA practice gave manufacturers confidence that testing in the UAE would not mean building to a different standard than everywhere else.
United Arab Emirates
UAE's Advanced Air Mobility Rules: Regulating eVTOLs Before They Carry Passengers
A national pilot mapped Zambia's laws, institutions and data systems against the United Nations Resource Management System (UNRMS), turning fragmented evidence and stakeholder experience into a sequenced agenda for more adaptive, integrated and accountable critical-minerals governance, underpinned by an agile regulatory framework.The dilemmaZambia's mineral endowment places the country at the centre of rising demand for copper and other materials used in the energy transition. That demand can support public revenue, employment, economic diversification and local industrial development. At the same time, it can intensify familiar pressures, including environmental impacts, uneven benefit sharing, weak links between extraction and the wider economy, and gaps in the governance of artisanal and small-scale mining.The policy challenge was not simply a lack of rules. Zambia already had laws, strategies, regulators, environmental procedures and digital reporting systems. The question was whether these elements functioned as a single resource-management system across the mineral life cycle. Responsibilities were distributed among several authorities. Technical services were not equally accessible across provinces. Evidence was held in separate systems. Implementation capacity varied sharply between large mines and artisanal and small-scale operations. A static review of legislation would have shown the formal architecture. It would not have revealed how that architecture performed in practice or where its handovers were failing.The regulatory need was therefore adaptive. Zambia required a credible means of comparing its existing arrangements with an integrated international framework, learning from regulators, operators, communities and technical institutions, and turning that evidence into a sequence of nationally owned reforms.The regulatory gapExisting tools tended to examine individual laws, institutions, projects or environmental requirements. None provided a single national lens covering aspects such as sovereignty, environmental stewardship, social engagement, comprehensive recovery, value addition, circularity, innovation, transparency, health and safety, and institutional capability.This fragmentation mattered most where mandates and evidence had to cross institutional boundaries. Geological and production data might be available yet difficult to combine or use consistently. Environmental rules existed, but stakeholders reported weak enforcement in water, tailings and some artisanal and small-scale mining activities. Digital platforms supported licensing, production, exports and beneficial ownership, though coverage, interoperability and accessibility remained uneven. Innovation and formal safety systems were stronger in large operations than in smaller ones. Zambia also lacked a formal design-for-circularity framework, and technical services were concentrated in Lusaka.The stakeholders most exposed to these gaps included mine workers, communities in mining areas, artisanal and small-scale operators, local authorities, regulators and businesses seeking predictable rules. Inaction risked allowing rapid sector growth to reinforce institutional silos, environmental liabilities and limited domestic value capture.The approachThe Ministry of Mines and Minerals Development, the University of Zambia, Copperbelt University and the University of Exeter formed a government-academia partnership, supported by the United Kingdom Foreign, Commonwealth and Development Office. The pilot used the 12 principles and 55 requirements of the United Nations Resource Management System (UNRMS) as structured prompts rather than as a pass-or-fail scorecard.The work combined five elements:1.    System mapping: The team mapped institutions, policies, laws, regulatory practices, technical services and data arrangements against the UNRMS principles and requirements.2.    Evidence gathering: More than 200 questionnaires were distributed among government, industry, artisanal and small-scale mining, traditional authorities, civil society, academia and development partners. Interviews provided qualitative and operational detail. As a pilot initiative, the survey should not be read as a statistically representative national sample.3.    Provincial learning: Workshops in Lusaka, Kitwe and Solwezi tested the initial mapping against three distinct settings: the national policy centre, the established Copperbelt and the rapidly expanding North-Western mining region. Reported attendance across the three workshops exceeded 350.4.    Iterative validation: Follow-up meetings, virtual consultations and bilateral exchanges continued through 2025. Knowledge exchange with the earlier Cornwall UNRMS application helped the team distinguish transferable practice from Zambia-specific adaptation.5.    Translation into reform options: The team converted the findings into proposals covering policy integration, a permanent multi-stakeholder platform, capacity building, circularity, formalization of artisanal and small-scale mining, digital services, monitoring and further pilots.The design rationale was to begin with evidence and relationships, then move towards regulatory change. It created a learning loop between national policy, provincial experience and international practice, while leaving decisions on adoption and implementation with Zambia.Results achievedThe pilot produced Zambia's first national UNRMS baseline and the first national-level study in Africa examining the adoption or adaptation of UNRMS. It achieved several concrete milestones:•    A national mapping of the 12 UNRMS principles and 55 requirements against Zambia's mineral-governance arrangements;•    Stakeholder mapping, with more than 200 questionnaires distributed, interviews, and three provincial workshops;•    Combined workshop attendance reported at more than 350, with broad participation from public authorities, companies, artisanal and small-scale miners, communities, academia, and civil society;•    Presentation of preliminary findings at the fifteenth session of the UNECE Expert Group on Resource Management in Geneva in April 2024; and•    A set of recommendations for national policy, institutional coordination, digital services, capacity building, circularity, monitoring, and follow-up pilots.The assessment found that Zambia had a substantial foundation for integrated resource management. Relevant strategies and institutions were in place; digital systems supported licensing, production, trade and beneficial-ownership information; environmental assessment processes were in place; and large operations demonstrated established practices in safety, reporting and innovation.The same exercise made implementation gaps more visible. The most material concerns were artisanal and small-scale mining safety and labour practices, access to technical services, enforcement of water and tailings requirements, transparency coverage, design for circularity, innovation uptake and reskilling for a just transition. The report therefore recommended formally adopting or adapting UNRMS in national policy, establishing a permanent multi-stakeholder platform, creating a national mining circularity framework, expanding access to digital and technical services, and strengthening independent monitoring.The pilot laid a national foundation for adaptive mineral regulation: a shared baseline, an evidence base, a stakeholder network and a prioritised reform map. Work continued through 2025 and into 2026, moving from baseline assessment towards testing and advancing implementation of UNRMS principles in Zambia, aligned with the United Nations Guidance for Action on Critical Energy Transition Minerals (CETM), including its seven Guiding Principles and five Actionable Recommendations. Zambia is participating as a pilot country in an ongoing regulatory-learning process intended to translate shared principles into national policy, administrative practice and, where approved, formal regulatory measures. The transferable lessonThe central lesson is that adaptive mineral governance can begin before a comprehensive legislative rewrite. A country can first make the system visible: who holds each mandate, what evidence is available, where services are inaccessible, which handovers fail, and which gaps require policy, capacity, coordination or enforcement. That approach turns an international framework into a disciplined national conversation rather than an imported checklist.Three features are especially transferable:•    Adaptation is more credible than mechanical adoption. The framework was tested against Zambia's legal, institutional and provincial realities, thereby preserving national discretion and revealing the practical work required for implementation.•    Regulatory learning requires more than consultation. Surveys and workshops generated evidence, while provincial comparisons and follow-up exchanges helped test it. The next step is to link each priority to a responsible institution, an evidence requirement, a review date and a corrective route.•    Shared data and technical capacity are integral to regulation. Rules cannot perform as intended when evidence is fragmented, services are geographically dispersed, or smaller operators cannot participate. Digital infrastructure and institutional capability are therefore regulatory design choices, not secondary administrative matters.The caution is equally important. Pilots can accumulate recommendations without changing practice. Zambia's model will become a full adaptive governance cycle only when implementation yields traceable decisions, periodic review, and evidence of correction. Open questions include which recommendations will be formally adopted, how the proposed multi-stakeholder platform will be mandated, how artisanal and small-scale operators will participate, and which indicators will show improvement beyond the baseline.
Zambia
Zambia's UNRMS pilot: Building an adaptive governance and regulatory framework for critical minerals
United Nations
UNECE brought governments, industry and technical experts together to develop harmonized international regulations for Automated Driving Systems, enabling the safe deployment of highly automated vehicles across jurisdictions.The dilemmaAutomated Driving Systems (ADS) are rapidly advancing and promise significant improvements in road safety, mobility and transport efficiency. However, the technology is being developed globally while regulatory approaches have historically been fragmented across jurisdictions. Without internationally harmonized safety requirements, manufacturers could face inconsistent approval processes, barriers to market access, and uncertainty regarding safety expectations. Regulators also needed a framework capable of assessing systems that perform the complete dynamic driving task without continuous human supervision.The regulatory gapThe automotive sector is one of the most highly regulated industries globally. Manufacturers, regulators and other stakeholders rely on internationally harmonized technical regulations to support technological innovation, improve safety and environmental performance, and facilitate international trade by reducing technical barriers to vehicle approval and market access.However, global harmonization reached its limits when addressing Automated Driving Systems (ADS). Existing regulatory frameworks had evolved around two fundamentally different compliance models, namely type approval and self-certification. Type-approval systems are used in many markets including the European Union, Japan and Türkiye, while self-certification systems are used in countries such as the United States, Canada and the Republic of Korea. Reconciling these approaches created an opportunity for the development of globally aligned regulatory requirements for increasingly automated vehicles.In addition, traditional vehicle regulations were built on the assumption that a human driver is present in the vehicle, continuously monitoring the driving environment and performing the driving task. As ADS technologies evolved toward assuming the complete dynamic driving task, many existing regulations required review and amendment to address concepts such as "driver", "driver's seat" and other driver-dependent provisions that could create legal, technical and implementation challenges.New regulatory approaches and evaluation methods were therefore needed to assess vehicles equipped with ADS that perform the full tactical and operational driving functions without continuous human supervision. The absence of internationally recognized safety principles, validation methodologies, data recording requirements, safety case frameworks and in-service monitoring provisions created uncertainty for both regulators and developers. Without a coordinated international response, there was a significant risk of regulatory fragmentation, reduced public confidence, increased barriers to deployment and slower realization of the safety and mobility benefits promised by automated driving technologies.The approach1. In June 2018, UNECE established the Working Party on Automated/Autonomous and Connected Vehicles (GRVA) under the UNECE World Forum for Harmonization of Vehicle Regulations (WP.29), the main global body for vehicle regulations. 2. In June 2019, The Member States (Contracting Parties), developed the Framework Document on Automated Vehicles (FDAV) which established a common vision, high-level safety principles, key definitions and a coordinated programme of work for automated driving. WP.29 invested significant effort in achieving broad consensus on the FDAV and its subsequent updates, ensuring a shared regulatory direction for the development of automated vehicle regulations. 3. Building on the FDAV, GRVA spent four years developing a multi-pillar approach for the safety assessment and performance evaluation of automated vehicles. This work culminated in the adoption by WP.29 in June 2024 of the Guidelines and recommendations for ADS safety requirements, assessments and test methods to inform regulatory development.4. In November 2024, in accordance with the principles established in the FDAV, GRVA created the Informal Working Group (IWG) on Automated Driving Systems (ADS) to develop a regulatory framework that could be implemented both as a UN Regulation under the 1958 Agreement, primarily supporting type-approval systems, and as a UN Global Technical Regulation (GTR) under the 1998 Agreement, accommodating both type-approval and self-certification regimes. Participation and work methodsThe initiative brought together Contracting Parties from multiple regions, vehicle manufacturers, suppliers, technical services, standards development organizations, research institutions and other stakeholders. Participation included representatives from major global automotive and technology companies through industry associations and accredited NGOs, alongside government authorities and independent experts. Building on earlier WP.29 achievements, including the FDAV and the ADS Guidelines, the group used regular international meetings, workshops and consensus-based decision-making to develop performance-based and technology-neutral requirements, while broadening participation to include stakeholders that had not traditionally been involved in automotive regulation.Key concepts included:(a) A Safety Management System (SMS) covering the full ADS lifecycle.(b) A Safety Case approach demonstrating that the ADS is free from unreasonable safety risk.(c) Requirements for validation and testing credibility (incl. simulations).(d) Event and occurrence reporting mechanisms to authorities.(e) Data Storage Systems for Automated Driving (DSSAD).(f) Continuous monitoring of ADS performance after deployment.This approach enabled a high degree of international harmonization while preserving national sovereignty and providing flexibility for implementation under different regulatory systems.Results achievedThe initiative produced the world's first comprehensive globally harmonized regulatory framework specifically addressing Automated Driving Systems. In January 2026, GRVA adopted the draft UN Regulation and recommended the draft GTR for consideration by WP.29. The framework established common safety principles for ADS-equipped vehicles and provided regulators with tools for evaluating highly automated vehicles beyond conventional driver-assistance systems.Notable outcomes include:(a) Development of outcome-focused ADS safety requirements.(b) Establishment of internationally recognized Safety Case principles.(c) Introduction of lifecycle-based Safety Management Systems.(d) Creation of requirements for data recording and occurrence reporting.(e) Alignment of regulatory approaches across major automotive markets.(f) Strengthened cooperation among governments, industry and technical experts.The framework also demonstrated that international consensus on complex emerging technologies is achievable when supported by structured (consensus based) collaboration and evidence-based regulation.The work involved more than six years of international collaboration within GRVA and WP.29, multiple ADS workshops hosted across Europe, Asia and North America, and participation from government authorities, industry experts, standards organizations and technical services. The project culminated in the adoption of the UN Regulation and UN GTR on ADS by WP.29 in June 2026, following their endorsement by GRVA in January 2026.The transferable lessonThe ADS initiative demonstrates that regulators can proactively shape emerging technologies through international cooperation rather than relying solely on fragmented national measures. Performance-based regulations combined with a structured safety case methodology can provide flexibility for innovation while maintaining high safety expectations.Key lessons include:(a) Focusing initially on high-level governance, including the creation of a new working group, proved challenging. It was not necessarily the most effective entry point. In fact, simple political signals of support, such as declarations by the G7 Transport Ministers encouraging international collaboration on automated driving through UNECE, provided the momentum needed to launch and sustain the work.(b) The Informal Working Group (IWG) on ADS operated with six co-chairs from the Americas, Europe and Asia, supported by four co-secretaries representing industry, standards development organizations (SDOs) and other stakeholders. Rather than creating governance difficulties, this distributed leadership structure became an asset, helping to build trust, ensure balanced representation and maintain broad stakeholder engagement.(c) The decisive factor in securing commitment across stakeholders was the consensus-based development and adoption of the Framework Document on Automated Vehicles (FDAV), which established a common vision, shared principles and a coordinated programme of work.(d) Early and continuous engagement with industry and their trained technical experts improves regulatory quality by ensuring that regulatory objectives are informed by technical feasibility, implementation experience and an understanding of existing regulatory frameworks.(e) Technology neutral and outcome-focused regulations may remain relevant longer than prescriptive technology-specific requirements.(f) Safety assurance for AI-driven and highly automated systems requires lifecycle oversight extending beyond initial validation.(g) Data collection and post-market monitoring seem to be necessary steps for continuously improving safety of highly complex systems.(h) Neither the scale of the challenges to be addressed nor the political and economic priorities at stake justified departing from sound regulatory practices. The ADS experience demonstrated that, even in rapidly evolving fields such as artificial intelligence and automated driving, technological neutrality remains essential to ensuring effective, credible and future-proof regulation.Future questions remain regarding the integration with future artificial intelligence technologies, cybersecurity evolution and cross-border operational details.
Global
Building the first Global Regulatory Framework for Automated Driving Systems (ADS)
United Nations
The United Nations Resource Management System (UNRMS) Life-Cycle Accountability Framework clarifies who is accountable for decisions, evidence, handovers and stewardship opportunities across critical-mineral value chains, enabling earlier action on risk, value addition, circularity and comprehensive recovery.The dilemmaCritical-mineral governance spans the life cycle, while authority is usually organized by institution, sector, project or jurisdiction. Extraction, processing, manufacturing, use, recovery and recycling may each be governed and regulated effectively within their own boundaries. The connections between them are harder to see. Materials, residues, data, risks, decisions and benefits pass from one actor to another, often without a shared view of who is expected to do what next.This is commonly framed as a reporting problem: information is missing, inconsistent or insufficiently disclosed. Reporting is only part of the issue. Even where information exists, there may be no clearly identified actor responsible for verifying, interpreting, responding to or implementing agreed actions. A circularity target can be published without anyone owning the collection systems or the quality of secondary materials. A value-addition ambition can be announced without responsibility for testing feasibility, coordinating skills, securing infrastructure, mobilizing finance or building market access. Comprehensive recovery can be technically possible while responsibility for by-products, tailings or secondary resources remains divided.Accountability therefore has two dimensions. It concerns omissions: who failed to act, where a duty is absent, or where a handover failed. It also concerns actions and stewardship commitments: who is answerable for identifying and pursuing feasible opportunities that increase public value, resource recovery, circularity, innovation, skills and economic viability. The governance, and in some cases the regulatory,challenge is to make both dimensions visible without turning the exercise into fault attribution, a new compliance layer or an external judgement on sovereign resource choices.The regulatory gapExisting instruments can assess environmental impacts, structure project information, trace materials, support due diligence, disclose product information or measure circularity. These functions are necessary. They rarely map the accountability architecture around their use. Who defines the boundary, who generates and holds the evidence, who verifies it, who decides, who acts on a finding, who develops an opportunity, who bears residual responsibility and who can initiate review or correction?The resulting gap takes several forms. Mandates may overlap without a coordination mechanism. Similar evidence may be requested in incompatible formats. A public body may be responsible without the staff, tools or finance to discharge that responsibility. An actor with the capacity to reduce a risk may have little incentive to do so. Responsibility can become fragmented at transitions between institutions, companies, life-cycle stages or jurisdictions. Positive opportunities can fail in the same way: an aspiration exists, yet no accountable pathway links it to the capabilities required for delivery.No additional metric resolves this on its own. The missing layer is a common way to represent actors, mandates, duties, evidence, affected parties, opportunities, handovers and review routes within a single system. That is the gap the Life-Cycle Accountability Framework is designed to fill.The approachThe  UNRMS Life-Cycle Accountability Framework is a non-binding, principles-based framework for mapping and learning. It begins with a direct question. Who is responsible for what, to whom, with what evidence, and what happens when responsibility is clear, shared, fragmented, contested, or absent?The framework emerged from a regulatory design problem identified by the UNECE’s UNRMS Sub-group.  Existing instruments can assess impacts, trace materials, or support due diligence, yet responsibility for the handover between life-cycle stages often remains unclear. In an illustrative processing handover, one authority sets the policy expectation, one actor generates evidence, another verifies it and a further actor is expected to respond. The framework’s regulatory function is to make that chain visible, identify who is responsible at each point and specify the review or correction route. For this purpose, accountability means the clear assignment, disclosure, review and learning regarding responsibility for decisions, actions, omissions, data, risks, opportunities and handover points. It is broader than legal liability and narrower than a general sustainability claim. The framework does not determine fault or create legal obligations. It makes the operating structure of accountability visible, enabling competent actors to clarify mandates, improve evidence flows, strengthen capacity, coordinate action and develop opportunities within national law and policy.The primary users are competent public authorities and regulators. Geological surveys and technical agencies use the framework to clarify evidence duties; industry, processors and recyclers use it to clarify handovers and improvement responsibilities; regional and UN platforms use it to structure voluntary policy dialogue; and communities, workers and rights holders use it to identify information, feedback and remedy routes within national procedures.The framework applies the 12 UNRMS principles, supported by the 55 requirements. They serve as operational prompts rather than a scorecard. The principles embed positive stewardship in the map. They ask, for example, who is responsible for comprehensive recovery? Who assesses and advances the feasibility of value addition? Who owns the design, reuse, collection and recycling functions? Who develops and adopts responsible technologies? Who maintains the competencies needed for long-term resource stewardship? Accountability is thus not confined to preventing harm. It also entails answerability for creating feasible value.How the framework worksSeven connected pillars turn that idea into a practical method:1.    Life-cycle stewardship map: locates actors, duties, affected parties and handovers from extraction through recovery and recycling.2.    UNRMS principles lens: tests how responsibilities align with all 12 principles, including value addition, circularity, comprehensive recovery, innovation and transparency.3.    Actor, obligation and handover register: records mandates and identifies responsibilities as clear, shared, fragmented, contested or absent.4.    Evidence and data responsibility: clarifies who generates, holds, verifies, finances, discloses and uses information, subject to national data rules and agreed confidentiality safeguards.5.    Lead indicators of fragility: identifies weak signals before an omission, lost opportunity or failed handover becomes a larger problem.6.    Model-centric assessment: makes the assumed value-chain model, its boundaries and omissions explicit, using metrics as evidence rather than as the organising logic.7.    Policy sequencing and pilots: distinguishes issues that require mandate clarification, coordination, capacity support, interoperability, investment, policy dialogue or a bounded test.The framework defines 12 indicative lead indicators: mandate gap, duplicate mandate, contested responsibility, unverified data dependency, data model mismatch, evidence gap, weak corrective route, incentive mismatch, capacity constraint, circularity handover risk, tailings and residue uncertainty, and value-addition disconnect. Several reveal positive responsibilities as clearly as they do deficiencies. A value-addition disconnect, for example, signals that expectations are not linked to accountable pathways for skills, infrastructure, finance or market access.Its practical products include an accountability map, an actor-duty-evidence register, a handover register, a lead-indicator set, an evidence and data map, and a concise policy-dialogue note. These are working instruments for clarification and learning, not for ratings or certificates.Where it can be appliedThe method can be applied at project, portfolio, product-system, corridor, national or regional scales. It can cover the entire mineral value chain or focus on a single consequential handover. The same architecture can support several regulatory tasks:•    value addition and diversification: assigning responsibility for feasibility, skills, infrastructure, energy, finance, market access and benefit pathways;•    circularity: connecting design, collection, reuse, recycling, secondary-material quality and safe end-of-life functions;•    comprehensive recovery: clarifying responsibility for primary resources, co-products, by-products, tailings, residues and secondary value;•    evidence and traceability: separating data generation, custody, quality assurance, verification, use and disclosure;•    innovation and competence: identifying who can test, authorize, finance, adopt and learn from new technologies and who maintains the required institutional capabilities; and•    high-risk or high-opportunity handovers: examining one transition where authority, evidence or value is most likely to become disconnected.The application remains voluntary and subject to the competent government authority, national legislation, data ownership and agreed safeguards. The framework is not a life-cycle assessment, a due diligence system, a feasibility study, an audit, a certification scheme or an investment filter. Its function is connective: it makes responsibility for using those instruments visible.When benefits become availableSome benefits emerge during the first mapping cycle. Participants gain a shared vocabulary, expose competing assumptions about the system boundary, distinguish clear responsibility from assumed responsibility, and identify where evidence or opportunity ownership is duplicated or missing. These are immediate clarifying benefits; they do not require proof of downstream impact.A second set of actions depends on what happens after the map is reviewed. Mandates can be clarified, evidence requests aligned, data reuse agreed, capacity support targeted, and an opportunity pathway assigned to actors able to advance it. These are near-term governance benefits, contingent on competent authorities and participating organizations acting on the findings.Longer-term benefits remain hypotheses until field application provides evidence. Better circularity, more comprehensive recovery, stronger value addition, improved economic viability, reduced disruption and greater trust would require investment, implementation and repeated learning beyond the mapping exercise. The framework can make the route to those outcomes more governable; it cannot produce them on its own.Results achievedThe UNRMS Life-Cycle Accountability Framework is a coherent architecture. Its achieved results are design and development outcomes:•    A precise working definition. Accountability now covers decisions, actions, omissions, data, risks, opportunities and handovers. It includes answerability for performance and evidence, duties of care, corrective learning, capacity support and opportunity development.•    A non-punitive stewardship scope. The framework expressly extends beyond fault prevention to value addition, diversification, comprehensive recovery, circularity, responsible innovation, competence-building and long-term public-interest outcomes.•    A common classification. Five accountability states provide a consistent vocabulary for responsibilities that are clear, shared, fragmented, contested or absent.•    An operational method. Seven pillars link the life-cycle model, UNRMS principles, actors and mandates, evidence duties, affected parties, lead indicators and policy learning.•    An early-warning system. Twelve lead indicators identify emerging weaknesses and disconnected opportunities before they appear as harm, mistrust, stranded value or supply disruption.•    A complementarity model. The framework explains how it can sit around ISO methods, UNFC information and other UNRMS tools without duplicating their technical functions. It asks who owns the boundaries, evidence, decisions, opportunities and follow-up that those instruments reveal.•    A practical output package. The concept specifies the maps, registers, indicator menu, data view and policy note needed to move from principles to a usable prototype.•    A regulatory-output and validation protocol. The framework specifies a regulatory output chain: each material gap is linked to a responsible authority or actor, each evidence duty to a data owner and verification route, and each policy issue to a possible legal, administrative, coordination or capacity response. Validation further requires duplicate evidence requests to be identified for consolidation, review dates and corrective pathways assigned, and framework templates revised through structured user feedback.•    Safeguards against misuse. The design protects sovereign authority, national data regimes, confidentiality and technological neutrality. It prohibits use as a ranking, certification, punitive comparison, investment filter, financing condition, insurance restriction, procurement filter, technology condition or market-access barrier.These results thus establish a testable governance tool for competent public authorities and regulators, to be applied with relevant value-chain actors and affected stakeholders in clarifying mandates, evidence duties and follow-up actions.The transferable lessonAccountability is enabling infrastructure when it combines answerability with agency. A system needs to know who can respond when something goes wrong. It also needs to know who must act when evidence reveals a viable opportunity. Asking only “who failed?” produces a narrow compliance lens. Asking “who is responsible for making this opportunity feasible, and what evidence and capabilities do they need?” turns accountability into a tool for stewardship.The framework also shifts attention from disclosure volume to the quality of the connection. Information has limited regulatory value when no actor is responsible for verifying, using or responding to it. Likewise, an ambition has limited developmental value when responsibility for implementation is distributed without coordination. Mapping the handover between evidence and action can expose both conditions early.Its core design principle is restraint. The framework does not prescribe a single institutional model, replace existing standards, or reduce complex judgements to a composite score. It creates a shared representation of the system and then leaves decisions with competent authorities and responsible actors. This preserves scope for national priorities while supporting clearer coordination.How to test the frameworkA cross-border setting would be a useful stress test. The smallest useful test would follow one mineral or a bounded value-chain segment through two participating jurisdictions, including at least one country, and one partner regulatory jurisdiction, using existing evidence and a single agreed review cycle. The exercise should examine two contrasting handovers: one where an omission or risk may lack ownership, and another where a feasible value-addition, circularity or comprehensive-recovery opportunity requires an accountable pathway.The test would succeed at the framework level if participants can build and validate the accountability model; distinguish between clear, shared, fragmented, contested and absent responsibilities; identify at least one material gap and one material opportunity; assign each an evidence, action and review route; and improve the templates through practical use. Failure signals would include drift into audit or ranking, absence of competent authorities or data owners, no route from mapping to a decision, breaches of confidentiality safeguards, or an administrative burden greater than the learning produced. These signals create a disciplined choice: refine, extend, scale or stop.
Global
Closing the regulatory handover gap: The UNRMS Life-Cycle Accountability Framework
United Nations
The EU AI Act reached its main date of application on 2 August 2026. Days before that milestone, the EU published an amendment that deferred the compliance deadlines for high-risk AI systems, added new prohibitions against emerging AI-generated harms, and expanded the enforcement powers of the AI office. It is the first substantive amendment to the Act since its adoption in 2024.The challengeWhen the EU AI Act was adopted in 2024, its implementation was planned in phases to give businesses, regulators, and standards bodies time to prepare. The prohibitions on certain AI practices would take effect in February 2025, obligations for general-purpose AI model in August 2025, rules for high-risk AI systems in August 2026, and those concerning AI embedded in regulated products in August 2027. The design allowed each layer of the framework to activate as the supporting infrastructure came into place.As implementation progressed through 2025, it became clear that some elements of the supporting infrastructure, particularly the harmonised technical standards being developed by the European Committee for Standardization (CEN) and European Committee for Electrotechnical Standardization (CENELEC), would arrive later than the timeline anticipated. In response, the Commission proposed a targeted adjustment intended to align the high-risk deadlines with the availability of those standards. As proposed, the revised deadline would have been triggered only once the Commission confirmed that the necessary standards and supporting tools were in place.The regulatory gapThe question facing the institutions was how to adjust the AI Act's compliance deadlines to reflect the availability of harmonised standards without reopening the substance of the law. That pointed to a targeted amendment rather than a wholesale revision. The file also became a vehicle for other changes, including prohibitions covering AI-generated child sexual abuse material and non-consensual intimate imagery, which the European Parliament pressed for during trilogue negotiations.The approachOn 19 November 2025, the European Commission proposed the Digital Omnibus on AI as part of a broader simplification package also covering the General Data Protection Regulation (GDPR), the ePrivacy Directive, NIS2 and the Data Act. The AI strand was separated from the rest of the package and fast-tracked so that revised deadlines would take effect before 2 August 2026; the remaining strands remained under negotiation as of September 2026. Council and Parliament negotiators reached a provisional agreement on 7 May 2026, and the European Parliament formally endorsed the agreed text on 16 June 2026. The Council gave its final approval on 29 June. The regulation was signed on 8 July, published in the Official Journal on 24 July, and entered into force on 27 July 2026, ahead of the 2 August 2026 milestone in the original timeline.The Omnibus makes several targeted changes. The most significant is timeline alignment. The application of rules for stand-alone high-risk AI systems, those listed in Annex III of the AI Act and covering areas such as recruitment, worker management, education, credit scoring, risk assessment and pricing in life and health insurance, and access to essential services, is set to apply from 2 December 2027, sixteen months later than originally scheduled. Rules for high-risk AI embedded in regulated products, such as medical devices and machinery, apply from 2 August 2028, twelve months later than originally scheduled. Both deadlines are fixed calendar dates. The conditional trigger in the Commission's proposal, under which application would have depended on confirmation that standards were available, was removed during negotiations.The Omnibus also strengthens the Act's substantive protections. Two new prohibitions are introduced under Article 5, covering AI-generated child sexual abuse material and AI-generated non-consensual intimate imagery, both to be complied with by 2 December 2026. Watermarking obligations for AI-generated content under Article 50 apply from the same date.Several obligations are retained on their original timeline. The AI literacy duty under Article 4, which has applied since February 2025, remains in force. The transparency obligations that apply to deployers under Article 50 continue to apply from 2 August 2026. General-purpose AI model rules, which took effect in August 2025, are unchanged. And 2 August 2026 remains the date national market surveillance authorities activate, and when the AI Office's enforcement powers over general-purpose AI models begin.One obligation was recast rather than retained. Article 4 on AI literacy, which had applied since February 2025, was replaced in full. Providers and deployers no longer have to ensure a sufficient level of AI literacy but must take measures to support its development, and the amended text states expressly that they are not required to guarantee any specific level of literacy for any individual. The revised wording applies from 27 July 2026, with no deferral.The Omnibus also changes more than the timetable. New Articles 75a to 75d give the AI Office the powers of a market surveillance authority, including own-initiative investigations, remote and on-site inspections, the power to seal premises and records, binding commitments, and periodic penalty payments of up to 5% of average daily worldwide turnover. The AI Office gains exclusive supervisory competence over AI systems built on general-purpose AI models where the model and the system come from the same undertaking, and over systems integrated into very large online platforms and search engines designated under the Digital Services Act, subject to defined exceptions. A new Article 4a provides a legal basis for processing special categories of personal data for bias detection and correction, extended beyond providers of high-risk systems. Documentation and quality-management requirements are simplified for SMEs and small mid-caps, the deadline for national regulatory sandboxes moves to 2 August 2027, and a new Annex XIV establishes a nomenclature for the designation of notified bodies whose residual category for emerging technologies names agentic AI.Intended outcomesThe Omnibus entered into force on 27 July 2026. The provisions that took effect on 2 August 2026, notably the Article 50 transparency obligations, the penalty regime and enforcement of the general-purpose AI rules, are now operative. The deferred high-risk regime does not apply until December 2027 and August 2028, so the outcomes below remain what the EU institutions expect the amendment to deliver rather than results already observed.The Commission proposed the sixteen-month adjustment to align compliance obligations with the availability of harmonised standards. The co-legislators retained the additional time but replaced the standards-based trigger with fixed dates, which favours planning certainty over responsiveness to standards readiness. In agreeing its negotiating position in March 2026, the Council described the proposal as bringing greater legal certainty, more proportionate rules and more harmonised implementation across member states; on final adoption in June 2026 it restated the legal certainty and harmonised implementation objectives. The new prohibitions under Article 5, targeting AI-generated child sexual abuse material and non-consensual intimate imagery, respond to specific harms that had emerged since the Act was drafted.The Omnibus is a precise refinement rather than a rewriting. The substance of the AI Act, its risk-based approach, its focus on high-risk systems, its safeguards for fundamental rights, and its governance architecture, remains intact. What has changed is the sequencing, and the Act has gained new protections against emerging harms.The transferable lessonEvery jurisdiction writing rules for fast-moving technology faces the same balance. The rules need to be strict enough to matter and predictable enough to plan against, while remaining responsive to how the world changes between drafting and implementation. The EU designed the AI Act with a phased schedule to manage exactly this balance, and the Digital Omnibus shows that schedule being adjusted in light of implementation experience.There are two lessons here for regulators elsewhere. First, big new laws work best when the supporting systems are built alongside them, not after. When technical standards, the bodies that check compliance, and the people trained to run them are all ready in step with the law itself, implementation is smoother for everyone. Second, updating a law openly and in a targeted way is a sign of a mature regulator, not a weak one. The EU's willingness to refine the AI Act openly, less than two years after adoption, shows a legislative framework adaptive and designed to learn. Other countries building similar frameworks may find themselves doing the same.
Europe
The EU's Digital Omnibus on AI: The First Substantive Amendment to the AI Act
Consultation on draft laws is a familiar part of good policymaking. What is less familiar is a digital platform designed specifically to collect, structure, and analyse that feedback at scale. The UAE Ministry of Economy and Tourism launched one in 2025, starting with the federal SME law.The dilemmaConsultation on draft legislation has long been part of how governments make better laws. The people affected by a rule usually understand it best, and inviting them to comment helps drafters catch problems that would otherwise emerge only after the law takes effect. But traditional consultation is time-consuming and hard to compare across contributions. Written submissions come in different formats, from different types of stakeholders, and often need extensive manual processing before their substance can be used. When a country is drafting laws for a fast-moving economy, the pace of consultation can become a real constraint on the pace of legislation itself.The regulatory gapWhat was needed was a way to make legislative consultation both faster and more structured. Faster, so that a draft law could benefit from stakeholder feedback within the timeframe a modern legislative process requires. Structured, so that the feedback could be analysed consistently, compared across contributors, and handed to legislative committees in a form they could actually use. Achieving both meant treating consultation as a data problem rather than a paperwork problem, and building the infrastructure to match.The approachIn 2025, the UAE Ministry of Economy and Tourism launched a Digital Legislative Consultation Platform, beginning with the federal SME law. The platform allows the Ministry to design structured digital surveys tailored to the specific draft under consultation, invite stakeholders to complete them through a defined process, and generate analysis for legislative committees automatically.The design is hybrid. It is outcome-focused in how consultation results feed into policymaking, giving weight to the evidence quality of what stakeholders say rather than to the format of their submissions. But it is prescriptive in its underlying data structure, with defined survey fields, formats, and validation rules that ensure contributions can be compared and aggregated.The platform is designed to be modular. New laws, new surveys, and new analytics tools can be added without redesigning the underlying system. The Ministry has framed the SME law consultation as Phase 1, with planned expansion to cover all Ministry of Economy and Tourism laws and regulations over time. Later phases will introduce sentiment analysis on stakeholder responses and version tracking for draft laws as they evolve through consultation.The Ministry has designed the platform to align with international standards for open policymaking, including the OECD Principles on Open and Inclusive Policy Making, the OECD framework for regulatory impact assessment, and the World Bank Regulatory Governance Indicators. This alignment is intended to make the platform's outputs interoperable with international consultation methodologies over time.Results achieved so farThe Ministry reports increased participation in the SME law consultation, drawing input from SMEs, business owners, chambers of commerce, government partners, and legal specialists. It reports that consultation questions and summaries were fully published, contributing to legislative transparency. It reports that structured datasets were generated automatically for legislative committees, and that stakeholder feedback directly shaped amendments to specific provisions of the SME law. The Ministry has also indicated that the digital process cut consultation cycle time by 40 to 60% compared to manual consultation methods, and that the platform is now the first unified digital method for legislative consultation across the Ministry.One limit is worth noting. The platform is in its first phase, focused on a single law. Its longer-term impact, particularly whether the model can scale across all Ministry laws and whether the standardisation of consultation formats maintains quality of engagement as it expands, will only be clear as later phases roll out. Independent evaluation of the platform's outcomes is not yet available.The transferable lessonThe Ministry has designed the platform to align with the OECD Principles on Open and Inclusive Policy Making, the OECD framework for regulatory impact assessment, and the World Bank Regulatory Governance Indicators. That alignment matters beyond the technical alignment of formats. The OECD's principles set expectations for what open policymaking should deliver in practice: participation that is broad, transparency that is real, and evidence that actually informs legislative choices. The World Bank's indicators focus on whether consultation processes are systematic and whether their results are accessible to stakeholders.A digital consultation platform, on its own, does not deliver any of this. What delivers it is the combination of the platform, the commitment to publish consultation questions and summaries, and the analytical capacity to turn stakeholder input into structured evidence for legislative committees. The UAE case shows one way of putting these three pieces together in a single national approach.
United Arab Emirates
The UAE's Digital Legislation Platform: Turning Public Feedback on Draft Laws into Structured Data
Regulating banks, insurers, and now fintech and virtual assets used to mean navigating separate laws written for a different era of finance. The UAE has replaced that patchwork with a single federal statute, giving its central bank one unified legal foundation to supervise a financial sector that looks very different from the one the original laws were written for.The dilemmaFinancial regulation tends to accumulate over time. A law is written to govern banks. A separate law is written to govern insurance. As the financial sector evolves, particularly as digital finance, virtual assets, and open banking begin to blur the lines between what used to be distinct categories of financial activity, regulators can find themselves supervising a modern financial system through a set of laws that were never designed to work together. The UAE faced this problem directly. Its central bank law and its insurance law had developed separately, and neither had been built with today's fintech landscape in mind.The regulatory gapWhat was needed was a single, unified legal foundation for financial sector regulation, one that could incorporate provisions for the technologies reshaping the industry, align with the international standards that global financial institutions and investors expect, and support the UAE's ambitions for competitiveness and economic growth. Achieving that meant more than updating each existing law separately. It meant merging them into one.The approachIn 2025, the UAE enacted Federal Decree-Law No. 6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, known as the CBUAE Law. The law merges what were previously separate central bank and insurance laws into a single federal statute.The law actively promotes fintech and digital transformation, including through the Open Finance Regulation and the addition of virtual asset services, in terms of payment methods, to the scope of licensed activities. At the same time, it reinforces risk management, consumer protection, and financial stability through stronger supervisory powers and stricter governance and compliance requirements.The regulatory design is a hybrid model, combining prescriptive and outcome-based elements. The law sets out clear demarcation of responsibilities, defines financial activities and participants, and establishes regulatory principles for supervising the financial sector in a manner that protects financial stability.The law is designed to be adaptive and future-responsive, empowering the Central Bank to update rules, issue new regulations, and respond to emerging financial and technological developments through its own regulations, decisions, and circulars, rather than requiring new primary legislation each time.As a Federal Law, the CBUAE Law was developed with all relevant authorities involved in the discussions, and the final draft was discussed at the Cabinet level within the relevant committees.Results achieved so farThe CBUAE Law is expected to deliver a more innovative and internationally aligned financial system. It is intended to strengthen financial stability and financial sector supervision while fostering innovation and adapting to change.The law is described in terms of its intended effects rather than measured outcomes. Independent evaluation of its impact on financial stability, innovation, or competitiveness is not yet available.The transferable lessonThe CBUAE Law is intentionally aligned with international standards and regulatory frameworks, with the stated aim of maintaining a globally resilient and innovative financial system. That alignment is not incidental to the merger. A single, consolidated law is easier to align with international standards than two separate ones, because there is only one legal text for regulators, investors, and international bodies to assess against.
United Arab Emirates
The UAE's CBUAE Law: Merging Central Banking and Insurance Regulation into One Federal Law
When generative AI reached the mainstream in 2022, most companies started thinking about AI governance for the first time. TELUS had already been building its programme for three years. The framework it had in place let the company adopt AI quickly  while meeting the kinds of standards regulators were only beginning to draft.The dilemmaWhen large language models became widely available to the public in late 2022, companies faced a difficult trade-off. Adopting the new technology quickly could deliver competitive advantage, but doing so without proper governance created risks around privacy, bias, misinformation, and regulatory exposure. Waiting for governance frameworks to catch up meant falling behind competitors. In sectors like telecommunications and healthcare, where AI would touch sensitive customer data and clinical decisions, getting this wrong could damage trust in ways that would take years to repair.The regulatory gapAt the time, there was no comprehensive AI-specific regulation in Canada or most other jurisdictions where TELUS operates. Existing privacy laws covered some of the ground, but did not address AI-specific questions like how to test a model for bias, how to explain an AI decision to a customer, or how to keep a generative AI tool from producing false information. Companies deploying AI at scale had to either wait for regulators to catch up, or build their own governance systems in the meantime.The approachTELUS committed publicly to responsible AI in 2019, three years before generative AI reached mainstream use. The company already had an established  Data and Trust Office - staffed with privacy, data governance, and data ethics specialists, including an in-house Data Ethicist – guided by TELUS’ Trust Model. This model defines how data should be used to generate value, promote respect, and deliver security for stakeholders, and it underpins TELUS’ broader Data Principles.  Building on that foundation, TELUS developed a set of internal frameworks including an AI Policy approved by the board, a Responsible AI Framework, and model governance standards.When generative AI arrived, TELUS was able to adapt these structures rather than build from scratch. It consolidated its responsible AI, privacy, and security reviews into a single integrated process, so that projects went through one review rather than three separate ones. It certified data stewards across business units to embed governance in the day-to-day work of teams outside the central office. And it used a practice it calls Purple Teaming, adversarial testing of AI systems by diverse cross-functional teams, to catch problems that a single expert group might miss.Results achievedIn October 2023, TELUS became the first company in the world to receive the ISO 31700-1 Privacy by Design certification, awarded for its Data for Good programme. In May 2024, its generative AI customer support tool, powered by the Fuel iX platform, became the first in the world to receive the same ISO 31700-1 certification for a GenAI product. Both certifications were evaluated by KPMG.In 2025, TELUS became the first Canadian company to contribute to the G7 Hiroshima AI Process Transparency Report, an international framework for AI transparency reporting hosted by the OECD. The company also became the first Canadian telecom to join the US AI Safety Consortium, part of the US National Institute of Standards and Technology's work on AI safety.Two limits are worth noting. Much of what TELUS reports about the internal reach of its programme, including its adoption metrics and the business value it attributes to responsible AI, is drawn from the company's own accounts. Independent evaluation of whether the governance framework actually reduces harm to customers, or whether it materially outperforms other AI governance approaches, is not yet publicly available.The transferable lessonThe most useful design choice TELUS made was to consolidate rather than fragment its governance reviews. Combining responsible AI, privacy, and security assessments into one integrated process meant teams could move quickly without skipping steps, and gave the company a single point of accountability for each AI project. The lesson for companies at earlier stages of AI adoption is that governance done as a series of separate approvals slows innovation and creates gaps between reviews, while governance built into a single integrated process can enable faster deployment. The lesson for regulators is complementary: mandates that focus on outcomes and evidence, rather than prescribing separate reviews for each type of risk, are easier for well-run companies to align with.
Canada
TELUS's Responsible AI Programme: Building Governance Before the Rules Arrived
Most governments update their laws when problems emerge. The UAE is building an AI-powered system designed to update its laws continuously, drawing on live data and connected legal knowledge. The vision was published in January 2026 and is now moving into pilots.The dilemmaOver the past five years, the UAE has updated more than 90% of its federal legislation, one of the largest legislative overhauls any government has undertaken in recent history. Even so, its legislators saw that this kind of periodic reform, however ambitious, could not keep up with a world in which technology, business models, and social change now shift within months rather than years. What was needed was a different way of keeping laws current. The UAE asked whether the tools now available, artificial intelligence, live data, and structured legal knowledge, could allow a country to keep its laws current in a more continuous way, rather than in occasional bursts of reform.The regulatory gapWhat was needed was a system that could do three things at once. It had to hold a complete, up-to-date picture of every law, regulation, and court ruling in the country, in a form that both people and computers can read. It had to make sense of how those laws connect to each other, where they overlap, where they conflict, and where they leave gaps. And it had to link laws to real-world data on how they are actually working, so that lawmakers could see, in something close to real time, whether a rule is doing what it was meant to do. No existing government system does all three at national scale. Building one meant designing it from scratch.The approachIn January 2026, the UAE Cabinet, through the General Secretariat of the Cabinet, published the whitepaper setting out the Regulatory Intelligence Ecosystem, known as the RIE. It is a national vision for how lawmaking will evolve, developed by a newly established Regulatory Intelligence Office. The whitepaper is a design blueprint rather than an implementation report, and the system it describes is being built and piloted in stages.At the core of the design is what the UAE calls a Unified Regulatory Digital Twin. This is planned as a live, digital mirror of the country's entire legal system, covering federal laws, laws of each of the seven emirates, rules of the financial free zones such as DIFC and ADGM, and court judgments. Each law and ruling is intended to sit as a node in a connected knowledge graph, so that changes in one part of the system can be traced through to the rest.Around this foundation, the RIE is designed to operate in three layers. The first layer, described as the foundation, is the knowledge graph itself, providing a structured picture of the country's laws. The second, described as the brain, is a set of AI tools intended to help with drafting, spot inconsistencies between laws, integrate court judgments back into the drafting process, and compare UAE rules against international benchmarks. The third, described as the nervous system, is a monitoring and feedback function that links laws to real-world data such as compliance rates, service performance, and enforcement outcomes.Because introducing AI into lawmaking raises real questions about accountability, the design includes a governance framework called Sovereign Governance-in-the-Loop. Under this framework, AI is intended to assist human lawmakers rather than replace them. Every AI suggestion is meant to be traceable, no AI output can become law without human approval, and specific mechanisms including audit trails, role-based access, ethics reviews, and emergency stop controls are being built into the system. The whitepaper also introduces new hybrid roles, Regulatory Knowledge Engineers, Regulatory Data Scientists, and Regulatory Program Managers, that combine legal, technical, and analytical expertise, and are being trained and embedded across government.Intended outcomesBecause the RIE is still being built, the outcomes below are what the UAE government expects the system to deliver once it is operational, rather than results already achieved.The Regulatory Intelligence Office intends the system to identify gaps, conflicts, and outdated provisions in existing law more systematically than manual review allows, and to shorten the time between spotting a problem and updating a rule. It expects the system to strengthen coordination between federal and emirate-level lawmaking, by giving policymakers a common view of how federal legislation is playing out in each emirate. It intends the AI tools to support drafting, translation, and consistency checks in both Arabic and English. And it expects the Innovation Loop, the process for identifying, testing, and deploying new AI tools inside the RIE, to keep the system improving over time.The whitepaper also positions the UAE's readiness in international context. The country ranks first globally for digital transformation in companies, first for digital and technological skills, and first for public-private partnerships according to the 2025 World Competitiveness Yearbook, and is placed among the top ten globally for AI talent, cybersecurity, and governance quality across other independent indices. These rankings do not measure the RIE itself, but they describe the underlying institutional and digital capacity that the UAE argues makes the initiative achievable.One important note. Because the system is still in its early phase, its real effects on legislative quality, on public trust, on business certainty, and on how laws actually perform will only become clear once it is operational and independently evaluated. The whitepaper is upfront about this, describing itself as an invitation to collaborate on the design rather than a report on results delivered.The transferable lessonThe most interesting thing about this case for other regulators is the method rather than the technology. Building a system to keep laws continuously up to date, before the technology has fully proven itself, is a deliberate choice to shape the direction of legislative modernisation rather than react to it. The UAE is publishing its design openly, inviting international dialogue, and building the system in stages, which allows it to learn as it goes and lets other jurisdictions follow the same path or learn from its early experience.This case study is best read as an example of anticipatory design in regulatory innovation, the deliberate choice to build the framework while the technology and the practice are still emerging.
United Arab Emirates
The UAE's Regulatory Intelligence Ecosystem: Redesigning Lawmaking Before the Rules Fall Behind
AI, Digital Economy and Remote Work Applications Office of the United Arab Emirates
A few large banks in Brazil held most of the customers and most of the data. Open Finance gave customers the right to share their data with whoever they chose. By 2025 it connected 65 million accounts, the largest such system in the world.The dilemmaBrazil's banking market was highly concentrated. A small number of large banks served most of the country's customers, and as a result held most of the financial data those relationships generated. This was a feature of how the market had developed over decades, not a failing of any one institution. But it created a structural challenge. Newer fintech companies and smaller banks could build strong digital products, but they could not easily access the financial data needed to offer someone a loan or tailor a service, because that data was spread across separate institutions with no common way to share it. The same fragmentation also limited the potential reach of PIX, the central bank's instant payment system, which was being developed around the same goal of a more open and competitive market.The regulatory gapWhat Brazil needed was a system that did three things at once. It had to give people and businesses a legal right to decide who could see their financial data. It had to set a common standard for how that data moved safely between institutions. And it had to require the big banks to take part, rather than letting them opt out. All of this had to happen without weakening security or the customer's control over their own consent.The approachWhat Brazil needed was a system that did three things at once. It had to give people and businesses a legal right to decide who could access their financial data. It had to set a common standard for how that data moved safely between institutions. And it had to apply consistently across all major institutions, so that the system worked as a genuine network. All of this had to happen without weakening security or the customer's control over their own consent.Results achievedBy August 2025, Open Finance connected around 65 million accounts, with more than 800 financial institutions taking part. In July 2025 alone, it processed around 1.16 billion Brazilian reais in payments and transfers. The number of active permissions to share data passed 100 million, and loans made possible by Open Finance data sharing totalled roughly 31 billion reais between 2021 and 2025. By most measures, it is the largest open-finance system in the world.Two limits are worth noting. The harder question is who has actually benefited. Surveys of small businesses in Brazil suggest that awareness of Open Finance among ordinary users remains low, even in a country where almost everyone now uses PIX. The infrastructure has been built. The everyday reasons for a customer to use it are still being developed.The transferable lessonOpen data-sharing systems tend to grow faster when participation is consistent across all major institutions and coordinated centrally, rather than relying on each company to join voluntarily. This is why Brazil's system grew larger than the UK's, even though the UK started first. The harder and less-told lesson is that building the infrastructure is not the same as delivering value to customers. Whether people actually benefit depends on the products and services built on top of the system, by banks and fintechs alike, and those are not something the regulator controls.
Brazil
Brazil's Open Finance: Giving Customers the Right to Share Their Own Financial Data
World Economic Forum
Software can now diagnose illness and guide treatment, but it does not fit the rules written for physical medical devices. Singapore's health regulator built a system that matches oversight to the risk each tool carries.The dilemmaA new kind of medical product was emerging: software that diagnoses illness, supports clinical decisions, or reads medical scans using AI. This kind of software, known as software as a medical device, did not fit the rules written for physical medical devices like pacemakers or syringes. Singapore's health regulator faced a choice. It could apply the strict, slow approval process used for physical devices, which would hold back useful software. Or it could treat the software like ordinary technology with light-touch rules, which would risk leaving tools that make real clinical decisions without proper oversight.The regulatory gapWhat was needed was a system that matched the level of regulation to the level of risk. Software that helps diagnose a serious illness should face strict controls. A low-risk wellness app should face far fewer. The system also needed to follow international standards, so that companies selling medical software around the world would not face a set of rules unique to Singapore.The approachSingapore's Health Sciences Authority, known as the HSA, built a system that sorts medical software into four risk classes, from A to D, based on principles set by the International Medical Device Regulators Forum, the main global body for coordinating medical device rules. The level of regulation rises with the risk. The lowest-risk software only needs to be listed. The highest-risk software needs full registration before it can be sold, must meet international quality management standards, and is monitored after it reaches the market. The HSA has updated the rules over time to cover AI-powered software and cybersecurity. The thinking was that matching the rules to the risk, while following international standards, would attract digital health companies to Singapore while keeping patients safe.Results achievedThe framework underpins Singapore's wider strategy to become a hub for digital health. It has also supported international cooperation. In December 2025, Singapore and the UK launched the UK-Singapore Regulatory Innovation Corridor, a joint fast-track pathway between the two countries' health regulators for breakthrough health technologies.Two limits are worth noting. The system is well-developed when it comes to classifying software and setting controls. But the harder-to-see results, such as how many products get approved, whether approval times have improved, and what safety problems show up after products launch, are not published in a way that lets outsiders judge how well the system is actually working. The framework is widely praised as best practice, but the data that would prove that label is only partly available.The transferable lessonFollowing international standards gives a smaller regulator more power than it might seem. It lowers the cost for global companies to enter the market, builds the regulator's credibility, and makes cooperation with other countries easier to set up, as the UK-Singapore corridor shows. The lesson is that a small country's regulatory influence is partly a network effect. Countries that align with international standards early tend to gain more than they give up.
Singapore
Singapore's HSA: Matching the Rules for Medical Software to the Risk It Carries
World Economic Forum
Singapore chose not to pass an AI law in 2022. Instead, it built a free toolkit that lets companies test their AI systems and show the results. Four years on, it has become a model other countries study.The dilemmaBy 2022, governments around the world were trying to work out how to govern AI. The European Union was moving toward a law. The United States was issuing guidance. Singapore took a different view. As a small country that depends heavily on cross-border digital trade, it had reasons to be cautious about passing a law too early. Rules written before anyone fully understood the technology risked locking in mistakes, and rigid local rules could have created friction with the many trading partners Singapore depends on.The regulatory gapWhat was needed was a way for companies to show, credibly, that they were using AI responsibly, to their customers, their partners, and regulators in other countries, without yet being forced to comply with a law. Without such a tool, companies were left either disclosing too much by default, or making claims about their AI that no one had any reason to trust.The approachIn 2022, Singapore's Infocomm Media Development Authority, known as IMDA, launched AI Verify. It is a voluntary testing framework and free software toolkit built around 11 internationally recognised principles for responsible AI. It runs technical tests and process checks on an AI system and produces a report that a company can share with customers, partners, or regulators. In 2023, IMDA made the software open-source and set up the AI Verify Foundation to develop it further. Later that year it added a sandbox for testing generative AI, and by 2025 the testing framework had been extended to cover generative AI tools. The thinking was that a voluntary, open-source, internationally compatible approach would shape company behaviour faster than a law, and would make Singapore a trusted global centre for AI testing.Results achievedTake-up grew quickly. By June 2023, IMDA reported that more than 50 companies had shown interest, and the AI Verify Foundation launched with 7 founding members and more than 60 general members. By October 2023, more than 10 major global companies had joined the generative AI testing sandbox. A 2025 Global AI Assurance Pilot involved more than 33 organisations across 9 countries and 10 industries, testing 17 generative AI applications, 16 of which were already in real-world use. The framework is built to line up with the main international AI standards, including the US NIST AI Risk Management Framework, the G7 Hiroshima Code of Conduct, and the ISO/IEC 42001 standard.Two limits are worth noting. The visible results so far are mostly tools, catalogues, and pilot reports. Whether all this testing actually makes AI safer, makes companies more productive, or protects consumers, in ways that can be measured, is still an open question. The ecosystem is real. The proof that it changes outcomes is not yet in.The transferable lessonA voluntary framework only spreads internationally if it works alongside other countries' rules. AI Verify's key design choice was to map its tests directly against the major international standards. That is what turns it from a Singapore initiative into something other countries can use. The lesson for any country building voluntary AI governance is to design for compatibility with international standards from the start, or expect to redo the work later.
Singapore
Singapore's AI Verify: Building a Way to Test AI Before Writing AI Laws
Singapore let telemedicine providers operate under direct supervision while it worked out the rules. The test ran, the rules were written, and in 2023 telemedicine became formally licensed. A rare example of a sandbox reaching a clear endpoint.The dilemmaBy 2018, companies offering telemedicine in Singapore, where doctors consult patients by video or phone, were operating under an old law written for clinics with physical premises. The Ministry of Health wanted to let telemedicine grow, but it did not yet understand the service well enough to write good rules for it. Writing rules too early risked getting them wrong. Leaving the service unregulated risked patient safety.The regulatory gapWhat was needed was a staged path. Providers could operate under the Ministry's direct supervision while the rules were being worked out. And there had to be a credible promise that the test would eventually lead to proper licensing, rather than leaving providers stuck in a temporary arrangement forever.The approachIn April 2018, the Ministry of Health launched the Licensing Experimentation and Adaptation Programme, known as LEAP, starting with telemedicine. The first group included the providers WhiteCoat and RingMD, and eventually 11 telemedicine and mobile medicine providers took part. The idea was that the sandbox would do two jobs at once. It would build a safe track record that justified formal regulation, and it would generate the actual content of those rules, drawn from watching how the service worked in practice rather than guessing in advance.Results achievedVideo consultations grew sharply, from roughly 1,947 patients between 2017 and early 2020 to 36,000 by January 2021, with the COVID-19 pandemic accelerating demand. The sandbox closed in February 2021, having done its job. The Ministry moved providers to a voluntary listing with required online training, and from June 2023 telemedicine providers have been formally licensed under the Healthcare Services Act. More than 600 providers had voluntarily listed by the time of the change.The Ministry has since reused the LEAP model for new sandboxes, including a 2024 sandbox letting community pharmacists give flu vaccinations. Singapore's regulatory cooperation also expanded internationally with the December 2025 UK-Singapore Regulatory Innovation Corridor between the two countries' health regulators.One limit is worth noting. The move from sandbox to law worked partly because Singapore's regulators are unusually well-resourced and centralised. The same approach is harder to copy in countries where regulators do not have the capacity to turn a sandbox into working legislation.The transferable lessonThe most useful sandboxes are the ones with a clear endpoint. From the start, LEAP committed to formally licensing telemedicine once the test was complete. That gave providers a reason to invest in meeting the rules, gave regulators a deadline to write them, and gave the public a clear sense of where the process was heading. Sandboxes without a defined endpoint tend to drift into endless experimentation.
Singapore
Singapore's LEAP Sandbox: How a Test Programme Became a Permanent Law
In 2024, the Swiss insurer Zurich bought a 70% stake in Kotak Mahindra General Insurance. The deal was widely reported as a major foreign investment in India. It was also the clearest sign yet that a years-long change in how India regulates insurance had taken hold.The dilemmaBy the mid-2020s, India had set itself an ambitious goal: "Insurance for All by 2047", the hundredth anniversary of independence. Reaching it would require enormous growth, large amounts of capital, and a steady flow of new insurance products. But India's existing rules were getting in the way. The system required insurers to get formal approval before launching most products, which was slow and left little room to adapt. The government and the regulator faced a real tension. They could loosen the rules to attract investment and speed up innovation, but doing so in a market where consumer protection was still developing carried clear risks.The regulatory gapWhat India needed was a way to let insurers move faster while making sure they remained accountable. If the regulator was going to stop checking every product before launch, then insurers themselves would need stronger internal controls, and the regulator would need to supervise more closely after products reached the market. The shift required building up accountability inside insurance companies at the same time as relaxing the approval process, so that one could safely replace the other.The approachThe Insurance Regulatory and Development Authority of India, known as IRDAI, moved over several years from a rules-heavy system toward what it calls a principle-based one. Three changes mattered most.The first was a pathway called "Use and File", which lets insurers launch many products immediately and submit them for regulatory review afterwards, rather than waiting for approval first. The second was a regulatory sandbox, where insurers could test new products, processes, and technologies in a controlled setting. The third was a governance framework that placed clear responsibility for compliance and risk management on each insurer's own board, through dedicated committees of senior managers.Alongside these changes, the government steadily raised the cap on foreign investment in insurance, reaching 100% in the 2025 to 2026 period. The thinking was that giving insurers room to innovate, while holding their boards accountable for the consequences, would attract investment and speed up growth without sacrificing oversight.Results achievedZurich's purchase of a 70% stake in Kotak Mahindra General Insurance in 2024 was a direct beneficiary of these changes. Under the old system, the deal would have been structurally harder to do. The combination of principle-based regulation and the opening to foreign investment changed the calculation for global insurers thinking about entering India.The client's own account of the experience is instructive. Zurich has described how the regulator's focus on innovation, customer protection, and operational resilience now allows the company to operate with greater clarity and confidence in a fast-growing market. The wider point Zurich draws from this is that forward-looking engagement with regulation, combined with carefully judged risk-taking, can unlock progress even in a traditionally conservative sector like insurance, with benefits that extend across the broader economy.The regulator has also launched Bima Sugam, a single digital marketplace for insurance, sometimes described as a "UPI for insurance" because it aims to do for insurance what India's payment system did for payments.Two limits are worth noting. A principle-based system depends heavily on insurers governing themselves well, because the regulator is no longer checking everything in advance. And the success of the "Use and File" pathway depends on whether the regulator follows through with credible review after products launch. Early signs from investment activity are encouraging. The longer-term evidence on whether the system protects customers and keeps insurers financially sound will take more time to establish.The transferable lessonForeign investment is a useful test of whether a regulatory reform has actually taken hold. Outside investors weigh uncertainty more honestly than companies already established in a market, because they have less reason to be optimistic and more capital at stake. The Zurich and Kotak deal is most interesting not as an insurance story, but as a signal. It marks the point where India's reforms stopped being announced policy and became something investors were willing to put real money behind.
India
How India's Insurance Reform Opened the Door to the Zurich–Kotak Deal
Zurich Insurance Group
Could a regulator certify the company rather than every product, in software that updates weekly? The FDA tried for five years, ran into the limits of its own legislation, and the model was picked up by regulators in the UK, Singapore and Japan.The dilemmaBy 2017, the FDA was approving a new kind of medical device. It was not a syringe or a scanner. It was software, often an app on a phone, that diagnosed skin conditions, monitored heart rhythms, or guided insulin doses. Unlike traditional devices, this software updated every few weeks, learned from the data flowing through it, and was built by companies whose engineering culture looked nothing like a traditional medical device manufacturer..The regulatory gapWhat was needed was a different question. Instead of asking 'is this version of the product safe?', the regulator would ask 'is this company capable of producing safe software, and of catching problems quickly when they emerge?' That would let regulators evaluate the developer's quality controls, monitoring systems, and track record. Trusted developers could then update their software more freely, without going through full approval every timeThe approachThe FDA launched the Digital Health Software Precertification (Pre-Cert) Pilot Program in 2017, working with nine companies — including Apple, Fitbit, Johnson & Johnson, Pear Therapeutics, Roche and Samsung. The pilot tested whether the FDA could assess organisational excellence (culture of quality, monitoring capability, real-world performance) and grant pre-certified firms a faster, less burdensome pathway to market. The intent was that trust in the developer, properly evidenced and continuously monitored, could be a substitute for premarket scrutiny of every release.Results achievedThe pilot ran until 2022. In its published review, the FDA was unusually candid. The agency concluded it did not have the legal authority, under the existing Food, Drug, and Cosmetic Act, to run Pre-Cert at the scale it had been designed for. A full version of the programme would require new legislation. The pilot closed without becoming permanent.Its influence, though, has been larger than its formal status suggests. The FDA folded the lessons into a broader approach it now calls the 'Ecosystem of Trust' for digital health. The underlying ideas, assess the company as well as the product, require ongoing evidence after launch, and match the level of oversight to the level of risk, have shaped digital health regulatory experiments at the UK's MHRA, Singapore's HSA and Japan's PMDA. They have also influenced work at the International Medical Device Regulators Forum, the main global body where medical device regulators coordinate.The transferable lessonThe most useful regulatory pilots are not always the ones that succeed on their original terms. Sometimes they are the ones that show clearly what would need to change for the model to work. Pre-Cert did that. It demonstrated that certifying the company instead of the product is workable in principle but requires new legislation to operate at scale.
USA
US FDA's Pre-Cert Pilot: A Five-Year Test of Whether Regulators Can Certify Companies Instead of Products
FDA
The UAE changed how its federal government keeps its books, moving from cash accounting to accrual accounting. Most countries treat this as a technical adjustment. In practice, it reshapes what a government can see about its own finances, and what it can do with that information.The dilemmaThere are two main ways a government can keep its accounts. Cash accounting records money only when it actually comes in or goes out, which is simple but short-sighted. Accrual accounting records financial commitments when they are made, even if the money changes hands later, which gives a fuller picture but is more complex to run.The UAE federal government had been using a simplified cash-based system. It was easy to operate, but it hid important things. It did not clearly show long-term debts, it did not account for the way buildings and equipment lose value over time, and it made it hard to compare one year against another. For a government managing large assets, major infrastructure projects, and long-term obligations to employees, the gap between what the cash accounts showed and the government's true financial position was getting wider.The regulatory gapWhat the UAE needed was an accounting system built on international standards, one that would give the federal government a complete and accurate picture of its finances. But adopting the standards was only half the problem. The government also needed enough trained people across its ministries to actually apply the standards and use the information they produced. A new system is only as good as the people running it.The approachThe UAE Ministry of Finance introduced the Federal Government Accrual Accounting Standards, known as FGAAS, in 2021, with the most recent version of the manual published in October 2025. The standards set out a step-by-step move to full accrual accounting, aligned with the International Public Sector Accounting Standards, the globally recognized standards for government accounting. The Ministry reviews the standards at least once a year, in consultation with other federal bodies, the national audit institution, and international experts. The reasoning was straightforward. Better financial information leads to better decisions, whether in managing assets, planning budgets, or carrying out audits.Results achievedMore than 50 federal bodies now produce accounts on an accrual basis, and the federal government's consolidated annual financial statements now meet the international standards. This has measurably strengthened the UAE's alignment with the transparency benchmarks used by the International Monetary Fund.The Ministry has also built an AI advisory tool called FinXpert, which draws on the new accrual-based data. It is being used to speed up financial advice and produce evidence-based recommendations across the federal government. This is a concrete example of a wider point: the better the underlying financial data, the more useful the tools built on top of it.The rollout has been deliberately gradual. The Ministry has invested heavily in training, with hundreds of finance professionals across ministries learning to apply the new standards. This reflects an understanding that the standards are only as useful as the people who apply them.The transferable lessonAccounting reform is rarely thought of as regulatory innovation. But it is one of the most powerful forms of it, because so much else depends on it. Once a government has an accurate, internationally consistent picture of its finances, almost every decision that follows gets better, from setting budget targets to planning infrastructure to building AI tools that rely on clean data. The hard part is the patience to invest in foundations that will not produce visible, headline-grabbing results for several years. The payoff is real, but it arrives slowly.
United Arab Emirates
UAE Federal Government Accrual Accounting Standards: Why a Change in Accounting Is a Change in Governance
Britain's financial regulator wanted firms to test AI safely — but most lacked the compute to try. Its answer: a sandbox with Nvidia's GPUs built in, opened to its first cohort in October 2025.The dilemmaBy early 2025, AI was already reshaping fraud detection, customer service and compliance across UK financial services. But for most firms the FCA regulates — particularly mid-sized incumbents and smaller fintechs — the GPU infrastructure, datasets and technical capacity needed to experiment safely were not readily available. The FCA's existing digital sandbox, launched a decade earlier, was not built for compute-heavy AI workloads.The regulatory gapTwo things at once: a controlled environment where firms could prototype AI models against realistic data without exposing customers, and the processing power to run it. Without both, the regulator risked seeing a two-tier market — frontier firms experimenting freely while everyone else waited — and losing the ability to learn from those experiments in real time.The approachIn June 2025, the FCA announced a partnership with Nvidia and its existing sandbox infrastructure provider NayaOne to build the "Supercharged Sandbox": GPU-enabled compute, the Nvidia AI Enterprise software suite, more than 200 anonymised datasets and over 1,000 APIs, all wrapped in regulator-supervised testing. The idea: the FCA would learn faster from live experiments than from consultation papers, and giving firms access to compute would open innovation to more of the market.Results achievedThe first cohort of firms began testing in October 2025, focused on early-stage proof-of-concept models. Applications for a second cohort opened in early 2026, with the FCA signaling particular interest in agentic AI use cases — payment agents, compliance agents, and customer-service agents.The arrangement is not without trade-offs. Industry commentators have noted that the partnership functions, in part, as a showcase for Nvidia's stack — increasing exposure to one vendor's tooling within a regulated environment. The FCA has been explicit that participation does not constitute approval, endorsement or authorization of any product.The transferable lessonSandboxes usually exist to give firms room to test ideas under lighter rules. The Supercharged Sandbox reframes them as infrastructure: the regulator brings the compute, the data and the supervisory capacity, and lowers the cost of experimentation for firms that couldn't otherwise afford to try. The harder question — one other jurisdictions will need to answer — is how to provide that infrastructure without entrenching dependence on a single technology vendor.
United Kingdom
UK FCA–Nvidia AI Sandbox Collaboration
Financial Conduct Authority, NVIDIA
Anyone could post stock tips or crypto picks to thousands of followers, with no rules and no accountability. In 2025, the UAE became the first country in the Middle East to require financial influencers to be licensed.The dilemmaSocial media had created a new kind of financial adviser: the financial influencer, or finfluencer. These are individuals who post investment tips, stock picks, and cryptocurrency recommendations to large followings on platforms like YouTube, Instagram, and TikTok. In the UAE, this was happening with no oversight at all. A finfluencer could recommend a risky product, hide a paid promotion, or run a pump-and-dump scheme, where someone talks up an asset they own and then sells once followers have pushed the price up. Their followers had no way of knowing whether the advice was honest, qualified, or paid for. The regulator faced a now-familiar choice: write rules for an activity that had grown up entirely outside regulation, or leave retail investors exposed to advice that no one was accountable for.The regulatory gapThere was no legal framework covering people who give financial advice through social media. Licensed financial advisers had to meet professional standards, disclose conflicts of interest, and answer to a regulator. Finfluencers giving similar advice to far larger audiences had to do none of these things. What was needed was a way to hold finfluencers to comparable standards of honesty and transparency, without shutting down a legitimate and growing form of financial communication.The approachIn May 2025, the UAE's Securities and Commodities Authority issued Chairman's Resolution No. 10 of 2025, creating the first licensing system for financial influencers in the Middle East. The rules took effect almost immediately after being issued. Under the system, anyone who provides financial recommendations in the UAE, whether about local or foreign products, virtual assets, or financial services, must register with the regulator. To get a licence, applicants have to show their qualifications, disclose any conflicts of interest, and make clear when content is paid for. Licences must be renewed each year. The approach is a hybrid. It sets specific requirements, such as mandatory registration and clear disclosure, but leaves finfluencers free to choose how they communicate, whether through social media posts, blogs, or seminars. The framework was shaped by two public workshops, one open to the public and one for financial advisory firms, and was designed to line up with international standards, in particular the global standard-setter IOSCO, which published its own report on finfluencers in May 2025.Results achievedIn its first months, the regulator licensed 104 finfluencers and rejected 18 applications from people who did not meet the standard to give financial advice. Enforcement has also begun. One finfluencer was fined 10,000 dirhams for breaching the new rules. Another was referred to the public prosecutor for publishing financial analysis and recommendations on foreign exchange and virtual currencies through YouTube and other platforms in breach of the regulations.Two limits are worth noting. The system is new, so there is not yet evidence on whether licensing actually reduces the harm to investors that prompted it, or simply moves unlicensed advice to platforms and accounts that are harder to monitor. And the regime applies to the UAE mainland. Financial free zones such as the Dubai International Financial Centre are not directly covered, though they have their own overlapping conduct rules.The transferable lessonFinancial regulation has traditionally focused on firms and licensed professionals. The rise of finfluencers shows how financial advice can reach millions of people through channels that sit completely outside that perimeter. The UAE's response is an early example of extending familiar regulatory tools, registration, disclosure, and the threat of enforcement, to a new type of actor. 
United Arab Emirates
The UAE's Finfluencer Licence: Bringing Social Media Financial Advice Under Supervision
UAE Capital Market Authority (CMA)
The case studies featured on this Knowledge Hub are compiled from publicly available information and contributions from the GRIP community for informational purposes only. Their inclusion does not constitute an endorsement, and the views expressed therein do not necessarily reflect the position of the World Economic Forum.

Global Regulatory Innovation Platform

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service