Beyond Copy-Paste Regulation: Innovation-Weighted Risk Classification for AI Governance in Emerging Economies

Abstract

The EU AI Act will begin full enforcement for high-risk applications in August 2026. For emerging economies, this presents a tough choice: adopt a regulatory framework mainly aimed at large firms with strong compliance resources, or delay action, leaving citizens vulnerable to unregulated algorithmic decision-making. Our team decided to explore whether a third option might exist. Over ten months, researchers from computer engineering, software engineering, law, medicine, and international trade examined how AI governance works in seven sectors: Fintech, healthcare, education, energy, media, logistics, and AI literacy and compared their findings with six national regulatory approaches: the EU, US, UK, Singapore, South Korea, and Japan. We found a structural mismatch in how risk categories are applied. The EU AI Act places the oversight of an autonomous nuclear plant on the same level as predicting energy production in a wind farm, despite the very different consequences of failure. This means that a small energy startup working on weather prediction models faces the same compliance requirements as a vendor of nuclear safety systems. In the six jurisdictions we reviewed, we did not find a way to adjust regulatory obligations based on the actual innovation value of a technology or its domestic origin. The US model seemed more promising at first because it operates on a sector-by-sector basis. However, its dependence on voluntary commitments allows companies to mostly avoid compliance, which defeats the purpose for economies wanting enforceable baseline protections. We took a different route by creating a weighted risk scoring system. In this model, innovation potential and domestic development capacity serve as negative weight parameters, lessening the regulatory burden for applications that provide clear value. At the same time, we established a strict safety floor. Any system that scores at maximum impact severity will receive the most stringent oversight, regardless of other factors. The guiding principle was clear: no matter how innovative an AI system is, if it controls a nuclear reactor, it must be regulated accordingly. For the financial sector, we introduced what we call a "Too big to fail AI" parameter. This accounts for the risk that a single algorithmic system's failure can have a ripple effect through interconnected institutions. To our knowledge, no current framework tries to measure this systemic aspect. Instead of using a single sandbox model across all sectors, we created sector-specific mechanisms. Healthcare follows a three-stage process: simulation, controlled clinical deployment, and limited market release. Energy systems must complete 10,000 hours of digital twin validation before linking to the live grid. Fintech employs a graduated scaling approach from micro-pilots to nationwide rollout. Each design came from the risk characteristics specific to its sector. One unexpected finding was the extent to which policymakers believed the EU framework could be adopted with minimal adjustments. Few assessed whether their domestic market structures, often led by SMEs with limited compliance capacity, could realistically manage the costs involved. Our graduated obligation model was designed specifically to tackle this issue, differentiating requirements across enterprise tiers based on organizational capacity.