Most new regulation, in AI and elsewhere, applies prospectively - it governs conduct and systems going forward from a defined effective date. A meaningful subset of emerging AI rules depart from this norm by applying, in some form, to systems already deployed before the rule existed, creating a distinct and generally underappreciated compliance challenge.
Why retroactive application is unusual and contentious
Requiring compliance for a system built and deployed under a different regulatory environment raises real questions of fairness and practicality - a system designed without a requirement in mind may be technically difficult or expensive to retrofit into compliance, in ways a system designed with the requirement in mind from the start would not be.
Why this is coming up more in AI specifically
The pace of AI deployment has outrun regulatory development enough that by the time a rule is finalized, a substantial base of already-deployed systems exists that the rule's drafters have to decide whether to cover. Excluding existing systems entirely can leave a regulatory gap covering a meaningful share of real-world AI use; including them raises the retrofit problem directly.
How regulators have handled this tension
Some rules include grandfathering provisions exempting systems deployed before a certain date, others include extended compliance timelines specifically for existing systems, and others apply the same requirements uniformly regardless of deployment date, accepting the retrofit burden as a cost of closing the coverage gap.
What this means for compliance planning
Organizations with existing AI deployments should specifically check whether a new rule includes provisions addressing already-deployed systems, rather than assuming new regulation only affects future development - a reasonable assumption in most other regulatory contexts that doesn't reliably hold in AI.