Three Rulebooks, One Agent

At WebexOne this week, Cisco shifted the collaboration narrative by introducing "digital teammates" powered by Claude Managed Agents. Moving away from reactive, prompt-based chatbots, the new Webex AI Agent platform allows users to invite collaborative AI agents directly into spaces and meetings to execute complex, multi-step work across third-party applications. For example, a human worker can tag an analytics agent in a Webex space to pull real-time usage statistics and seamlessly hand that data off to a presentation agent to automatically update a PowerPoint deck. This integration effectively turns enterprise communication channels into active, autonomous execution hubs.

The enterprise governance of autonomous AI took a leap forward this week as Workday announced its acquisition of C1.ai, a specialized agentic identity platform. As companies deploy autonomous agents that interact with sensitive HR and finance data, governing what these digital workers can access has become a critical security liability. By integrating C1.ai and partnering with Anthropic, Workday is building an HR system of record for AI. This allows organizations to provision, monitor, and revoke the system permissions of AI agents exactly as they would for human employees, ensuring agents only hold access while actively performing a specific role.

Despite the hype surrounding autonomous systems, a sobering report released this week by Flashpoint highlights a massive trust deficit on the front lines of enterprise IT. According to their 2026 Enterprise Threat Intelligence Report, 75% of cybersecurity teams have yet to actively deploy agentic AI tools into their defense strategies. While some early adopters are using AI agents for basic alert prioritization, the vast majority are deliberately blocking these systems from taking automated, active defense measures; like updating blacklists or blocking IP addresses; due to profound concerns over granting unsupervised decision-making authority to autonomous algorithms in high-stakes environments.

The cleanest way to understand the divergence is to notice that each regime is, structurally, asking a different question. The EU's framework asks whether an AI system's behavior has been disclosed, documented, and classified by risk category before it reaches a user. The U.S. patchwork, built state by state rather than as a single federal structure, asks which state's resident is affected by a given decision and what that state specifically requires for that category of harm. China's framework asks something neither of the other two asks directly: how much independent authority has this specific agent been given to act without a human in the loop.

That's not a minor philosophical difference. It means the same autonomous agent, performing the same task, can be fully compliant in one jurisdiction and either overregulated or underregulated in the other two, not because the underlying technology changed but because the legal question being asked of it changed. Gartner's forecast that 35% of countries will be locked into region-specific AI platforms by 2027, up from roughly 5% today, is the macro consequence of exactly this problem. Sovereignty pressure isn't only about data residency anymore. It's about which question your agent has to answer correctly to operate at all.

It's worth being precise here, because the EU AI Act's timeline has shifted since "The Compliance Countdown" (Apr 23) covered the original path toward enforcement. The Act's prohibitions, covering practices like workplace emotion recognition, and its AI literacy obligations have applied since February 2025. General-purpose AI model obligations for providers took effect in August 2025, with a grace period for signatories of the Commission's Code of Practice running until August 2026. New transparency obligations took effect this past August: providers must now disclose that users are interacting with AI and mark AI-generated content in a machine-readable way, and deployers must disclose deepfakes and inform people about emotion recognition and biometric categorization. Member states were also supposed to have market surveillance authorities operational and empowered by that same date, though most are expected to miss that deadline by months or longer.

Here's the part worth flagging clearly: the Act's high-risk system obligations, the ones most compliance planning has centered on, were pushed back by a recently adopted omnibus regulation. High-risk obligations for standalone systems like HR technology and financial services now apply from December 2027, and obligations for AI embedded in products follow in August 2028. That's a real reversal from the enforcement path "The Compliance Countdown" tracked, and it matters for this issue specifically because it means the EU, often treated as the strictest of the three regimes, currently has less binding agent-specific law in force than either Texas or China does today.

If anything, the American picture has gotten less unified since "The Liability Question" covered Colorado's original reversal. Texas's TRAIGA law took effect January 1 and is already being enforced by the state attorney general, with civil penalties running from $10,000 to $200,000 per violation for restricted high-risk uses in areas like hiring, healthcare, and government services. California's Transparency in Frontier Artificial Intelligence Act took effect the same day, imposing separate disclosure and governance obligations specifically on developers of the most capable models.

Colorado's story got more complicated, not less. The original algorithmic discrimination law was blocked by a federal court in April after a constitutional challenge, before its already-delayed effective date arrived. The legislature responded with a replacement, signed in May and taking effect January 2027, that drops the original impact-assessment and anti-discrimination duties entirely in favor of a narrower, notice-based approach: developers give deployers technical documentation, deployers notify consumers when AI makes a consequential decision in areas like employment or healthcare, and after an adverse outcome, deployers owe an explanation and human review. That's a meaningfully weaker standard than the one Colorado originally tried to pass, and it happened because a court intervened, not because consensus formed. Meanwhile, a federal executive order from December proposing a uniform national framework to preempt conflicting state laws has no legal effect yet. The administration's own evaluation of "unduly burdensome" state laws was due in March, and the page tracking this fight expects the underlying conflict could take years, possibly reaching the Supreme Court, before it resolves. In the meantime, state attorneys general retain full enforcement authority, and some states, South Carolina among them, are moving toward adding a private right of action that would let individuals sue directly.

China's approach, enforceable since mid-July, is structurally different from both of the above, and it's the one this series should pay closest attention to, because it regulates the exact thing "The Next Maturity Level" and "The Single Point of Accountability" have been arguing organizations need to manage internally: how much independent authority an agent has. The framework sorts agent decisions into three tiers. Routine, low-consequence actions proceed autonomously. Significant but reversible decisions require human approval before the agent can execute them. High-stakes, hard-to-reverse decisions are prohibited from automation entirely and must escalate to a human regardless of how capable the underlying model is. Agents operating in healthcare, transportation, media, and public safety face mandatory filing, compliance testing before release, and recall obligations if they prove defective, while lower-risk uses rely on platform self-assessment and credit-based enforcement.

The enforcement teeth come from China's amended Cybersecurity Law, which raised the general fine cap from RMB 1 million to RMB 10 million and set data-leakage penalties between RMB 500,000 and RMB 10 million, with reach that extends to overseas conduct the government deems to endanger China's cybersecurity. What's notable isn't just the enforcement mechanism. It's that China arrived, independently and through a completely different regulatory tradition, at something close to the tiered-autonomy structure this series has been building from the inside out. A government regulating agent authority as a legal category, rather than regulating content or disclosure, validates the core premise of this whole series: autonomy level is the variable that matters, and sooner or later, someone is going to require organizations to account for it formally.

This isn't theoretical. Two of the world's largest technology companies have already chosen not to deploy specific AI capabilities in the EU rather than try to satisfy all three regimes at once. Meta told Axios in July that it would release an upcoming multimodal Llama model everywhere except the EU, citing "the unpredictable nature of the European regulatory environment," with a UK release planned instead because, in Meta's view, UK regulators were moving more predictably. Separately, Ireland's Data Protection Commission ordered Meta to pause the rollout of its AI assistant in the EU entirely over how the company trains models on user data.

Apple's case is sharper still. At its June developer conference, Apple announced that the standalone Siri app, its Visual Intelligence experience, system-wide Writing Tools, and Siri Mode in Camera would not ship on EU iPhones and iPads alongside their global release, pointing to Digital Markets Act interoperability requirements that Apple says would force it to give rival AI assistants broad access to messages, emails, files, and cross-app activity. Apple's proposed compromise, a restricted "Trusted System Agent," was rejected by EU regulators, who characterized Apple's position as seeking an exemption rather than a compliant design. Apple's own spokesperson put the choice plainly: "the decision not to roll out Siri AI in the EU is Apple's and Apple's only." No timeline has been given for when, or whether, EU users get these features at all. These aren't hypothetical compliance exercises. They're two of the best-resourced AI organizations on earth concluding that building one agent for three rulebooks costs more than building two products for two markets and simply not serving the third.

"The Industry Adoption Gap" documented how healthcare and government lag far behind banking and insurance in production deployment, tracing the gap to regulatory friction and legacy constraints within a single jurisdiction. Overlay the divergence this issue describes and the gap gets harder to close, not easier. Healthcare and public-sector agents are exactly the categories facing the strictest treatment in all three regimes simultaneously: high-risk classification eventually under the EU's delayed timeline, explicit state-level restriction under Texas's TRAIGA, and mandatory filing and recall obligations under China's rules. An organization operating only in the U.S. already has to track a state-by-state patchwork. One operating globally has to track three structurally different legal questions about the same agent, in the exact sectors where the underlying business case for automation is already weakest.

It also adds a dimension this series' earlier issues hadn't fully accounted for. "The Single Point of Accountability" argued for naming one owner across an agent's full lifecycle. That owner now also has to know which jurisdiction's rules apply to a given action the moment it happens, not as an afterthought during a quarterly compliance review, but as a live input the continuous monitoring described in "The Continuous Audit" has to carry alongside everything else it tracks.

The practical response looks less like a single compliance checklist and more like what Apple and Meta have already done: treating jurisdiction as a first-class attribute of an agent's permission scope, not a downstream legal review. That means mapping, in advance, which specific capabilities trigger the EU's eventual high-risk classification, which trigger Texas's restricted-use categories or another state's equivalent, and which would fall into China's Level 2 or Level 3 authority tiers if the agent operated there. It means building region-specific configurations into the agent's deployment architecture itself, the same way Apple is now shipping iOS 27 with features present everywhere except the EU, rather than trying to find one global configuration that satisfies the strictest reading of all three regimes simultaneously, which increasingly isn't possible without disabling capability everywhere.

None of this is a reason to wait. Gartner's 35%-by-2027 sovereignty forecast suggests the fragmentation is accelerating, not stabilizing, and organizations that build jurisdiction-aware deployment now will have a real head start over those still planning for a single global ruleset that three major regimes have already made clear isn't coming.

The EU delayed its toughest rules. Texas and California are already enforcing theirs. Colorado got overruled by a federal court and came back weaker. China built an entirely different kind of rule, regulating autonomy itself rather than content or disclosure, and started enforcing it in July. None of these four stories point toward convergence, and two of the world's best-resourced technology companies have already responded by declining to ship full capability in at least one major market rather than try to satisfy all three at once.

For an agent governance program built around continuous monitoring and a single accountable owner, the work this series has argued for from its first two issues, jurisdiction now has to be treated as a live variable in that system, not a one-time legal review completed before launch. The organizations that build that awareness into their deployment architecture now, the way Apple and Meta already have out of necessity, will be the ones who can still say yes when a customer in a fourth market asks whether the agent works there too.

Mapping your agent portfolio against three diverging regulatory regimes is exactly the kind of cross-functional work that's easy to underestimate until a launch gets blocked in a major market. The Complete Agentic AI Readiness Assessment includes a framework for assessing your current deployment footprint against US, EU, and China requirements, so you can identify where capability gaps or compliance gaps will force a decision before a regulator or a market forces it for you. Get your copy on Amazon or learn more at yourdigitalworkforce.com. For organizations building or expanding agent deployment across multiple jurisdictions, our AI Blueprint consulting helps design the jurisdiction-aware permission architecture and governance documentation that make operating across diverging regimes possible without disabling capability everywhere just to stay safe anywhere.