Skip to main content

Major AI Regulations Explained

info

This content was developed with AI assistance and is regularly reviewed for accuracy. It is not legal advice; confirm deadlines against official sources before relying on them.

Snapshot: October 2026. Model names, prices, and product features change monthly; What's New in AI is the maintained chronology. Regulatory dates marked "reported" come from secondary legal commentary.

AI systems now help decide who gets a loan, a job interview, or a medical follow-up, and governments have concluded that "move fast and break things" is not acceptable when the things are people's lives. This page goes law by law through the frameworks that matter most in October 2026: what each requires, who it covers, and when it applies. It ends with what those rules mean in practice, depending on whether you use AI, deploy it, or build it.

What you'll get here:

  • The EU AI Act's risk tiers, general-purpose model rules, and the revised 2027-2028 timeline
  • The US executive orders and the state laws that bind in 2026 and 2027
  • Short summaries for China, the UK, and Canada
  • Practical implications for individuals, organizations, and developers

If you want the comparative overview first, start with The Global AI Regulatory Landscape, which also explains the three-tier way of sorting rules used below.

The EU AI Act​

The EU AI Act entered into force in August 2024. It applies to any organization that offers AI systems to people in the EU or whose AI affects them, wherever the organization is based. Its defining choice is to regulate by risk rather than by technology.

Banned practices (in force since February 2025)​

Prohibited uses include government social scoring, AI that exploits vulnerabilities to manipulate behavior, predictive policing based on profiling, untargeted scraping of facial images, emotion recognition in workplaces and schools (outside narrow medical and safety exceptions), and most real-time remote biometric identification in public by law enforcement. Fines for prohibited practices reach 35 million euros or 7% of global annual turnover, whichever is higher. The same date brought the Article 4 duty for providers and deployers to ensure sufficient AI literacy among their staff.

High-risk systems (delayed to 2027 and 2028)​

High-risk uses include AI in critical infrastructure, education (admissions, grading), employment (CV screening, performance monitoring, termination), essential services (credit scoring, insurance), law enforcement, migration, and the administration of justice, plus AI that is a safety component of regulated products such as medical devices. Providers must run conformity assessments, keep technical documentation, register in an EU database, build in human oversight, and meet accuracy, robustness, and cybersecurity requirements; deployers carry their own duties for oversight and monitoring.

These obligations were due on August 2, 2026. Under the Digital Omnibus on AI (political agreement May 7, 2026), stand-alone high-risk systems are now reported to apply from December 2, 2027 and AI embedded in regulated products from August 2, 2028. The amending act is cited in one commentary as Regulation (EU) 2026/1744 (not independently verified). The obligations themselves did not change; only the dates did.

Transparency (limited risk)​

People must be told when they are interacting with an AI system, and deepfakes and certain AI-generated content must be labeled. These obligations are reported to apply from August 2, 2026, with machine-readable marking moved to February 2027 for systems already on the market.

General-purpose AI models (in force since August 2025)​

Providers of general-purpose models (the large models behind ChatGPT, Claude, Gemini, and others) must publish technical documentation, provide information to downstream developers, respect EU copyright law, and summarize their training content. Models above a compute threshold that signals "systemic risk" face more: adversarial testing, incident reporting, and cybersecurity duties. A voluntary Code of Practice offers a way to show compliance. The Commission's enforcement powers over these providers are reported to begin in August 2026 (not re-verified for this snapshot).

United States: federal action​

Executive orders, 2023 to 2026​

Executive Order 14110 (October 2023) required developers of powerful models to share safety test results with the government and directed agencies to write sector guidance. The Trump administration revoked it in January 2025, replaced it with an order focused on removing barriers to "American AI leadership," and published an AI Action Plan in July 2025. Two later orders set the 2026 posture (both reported):

  • December 11, 2025, "Ensuring a National Policy Framework for Artificial Intelligence." Directs the Attorney General to create an AI Litigation Task Force to challenge state AI laws that conflict with national policy; directs Commerce to evaluate state AI laws and issue funding guidance; conditions certain federal funds; and asks for a federal framework that would preempt state AI laws, with carve-outs including child safety, data-center infrastructure, and states' own use of AI. It names Colorado's AI Act as an example of burdensome regulation.
  • June 2, 2026, "Promoting Advanced Artificial Intelligence Innovation and Security." Establishes cybersecurity mandates and a voluntary framework for secure deployment of frontier models, building on the December order.

Executive orders are not statutes. They direct agencies and shape funding and procurement, and the next administration can reverse them.

Federal statutes and agencies​

Congress has passed little AI-specific law. The TAKE IT DOWN Act (signed May 2025) criminalizes publishing non-consensual intimate imagery, including AI-generated imagery, and required platforms to have takedown processes in place by May 2026. Most other proposals, such as algorithmic accountability bills, have not advanced.

Agencies apply existing law. The FTC continues to pursue deceptive claims about AI capabilities ("AI washing"). The EEOC withdrew its 2023 technical guidance on AI and Title VII in January 2025, but Title VII, the ADA, and the ADEA still govern AI hiring tools. The CFPB rescinded much of its earlier guidance in 2025 and is reported to have narrowed disparate-impact liability under the Equal Credit Opportunity Act in 2026, while fair-housing and state disparate-impact rules remain.

United States: state laws​

California SB 53, Transparency in Frontier AI Act (in force since January 1, 2026). Applies to developers of the largest frontier models. They must publish a safety framework and transparency reports, and report critical safety incidents within 15 days, or within 24 hours where there is an imminent risk of death or serious injury. It also protects whistleblowers. California's earlier and broader SB 1047 was vetoed in 2024.

New York RAISE Act (effective January 1, 2027, per most sources). Signed in December 2025 and narrowed by an amendment in March 2026 to mirror SB 53. It requires 72-hour incident reporting, with penalties reduced to up to $1 million for a first violation and $3 million for later ones (reported).

Texas TRAIGA (in force since January 1, 2026). Prohibits certain intentional harmful uses, sets duties for state agencies, creates a regulatory sandbox, and gives the attorney general exclusive enforcement with a 60-day cure period and no private right of action (reported).

Colorado SB 26-189 (effective January 1, 2027). Colorado's 2024 AI Act would have required risk-management programs and impact assessments for high-risk AI decisions. It was delayed twice and then repealed and replaced in May 2026 by a lighter, transparency-oriented law on automated decision-making technology. Reported duties include telling people when they interact with AI, disclosing adverse automated decisions, and offering human review on request. It is a case study in how hard AI-specific duties are to operationalize once affected industries push back.

Local and sector rules. New York City requires annual bias audits and candidate notice for automated employment decision tools. California's companion-chatbot law (SB 243) has applied since January 2026, and other states have passed laws on AI "therapy" bots and chatbots for minors (reported; counts vary).

Other jurisdictions in brief​

China regulates by application: recommendation algorithms (2022), deep synthesis and deepfakes (2023), and public generative AI services (2023), with registration, security assessments, lawful training data, content labeling, and content controls. The UK relies on sector regulators applying shared principles, and its AI Security Institute evaluates frontier models for security risks. Canada's AIDA died in January 2025; a 2026 privacy bill is reported to add rules on automated decision-making, and Quebec's Law 25 already imposes transparency duties on automated decisions.

What it means for you​

If you use AI as an individual​

Most rules are written to protect you. Expect to be told when you are talking to a bot, to receive notice when an automated system makes a consequential decision about you in a growing number of places, and in some jurisdictions to be able to ask for a human review. Privacy law still governs your data inside AI tools. The practical habit: when a decision about you seems automated, ask whether AI was involved and how to request a person.

If your organization deploys AI​

Using a vendor's tool does not transfer your responsibility. Five steps cover most of the ground:

  1. Inventory the AI in use, including features embedded in HR, CRM, and support platforms.
  2. Flag uses that touch high-risk categories: hiring and worker management, credit and insurance, health, education, and essential services.
  3. Read vendor contracts for who carries which obligation, how data is retained, and whether it trains models.
  4. Document each use case, the decisions it informs, and the human oversight in place.
  5. Assign an owner who tracks AI rules the way someone already tracks privacy.

Customer-facing AI needs disclosure and an easy route to a human. Hiring AI needs bias testing and notice. And the EU's December 2027 date is close enough to plan for now. Govern: Frameworks, Policy, and Compliance and How to Write an AI Policy (Template) turn this into a program.

If you build AI products​

Documentation is not optional for high-risk systems: purpose, training data, performance, and known limitations. Systems that inform consequential decisions need explanations a non-technical person can follow, bias testing before launch and in production, and human override that actually works. If you build on a third-party model, you still own how you deploy it and what guardrails you add. And if you develop frontier models, California's incident clocks already apply to you, with New York's following in January 2027.

Key takeaways​

  • The EU AI Act's bans, literacy duty, and general-purpose model rules apply now; high-risk obligations moved to December 2027 and August 2028 (reported)
  • US federal policy runs on executive orders that seek to preempt state laws; statutes remain few
  • State laws in California and Texas are in force, and New York and Colorado follow in January 2027, with Colorado's now much narrower than its 2024 original
  • Existing anti-discrimination, consumer-protection, and privacy law already governs AI use everywhere
  • Individuals gain notice and review rights; deployers need an inventory, documentation, and an owner; builders need documentation, testing, and real human oversight

Next steps​

SponsoredYour product hereReach people actively learning AI — flat monthly rates, no ad networks