AI regulation

This page is an overview of how AI is regulated in the most important jurisdictions. It explains the ideas behind each approach and the main dates, as of October 2026. Rules in this area change often, and this page is not legal advice; check the official sources before making compliance decisions.

Why AI is hard to regulate

AI is a general-purpose technology. The same model can write a poem, screen job applicants, or help plan a cyberattack. Laws therefore have to choose what to regulate: the technology itself, the models above a certain size, the uses, or the harms. Lawmakers also try to protect people without slowing down innovation or pushing companies to other countries, and the technology changes faster than legislation.

Existing laws apply to AI as well. Data protection, consumer protection, anti-discrimination, product liability, and copyright law do not stop at software that uses a model. Much AI enforcement so far has happened under these older laws.

The European Union: the AI Act

The EU AI Act is the first comprehensive AI law. It entered into force on 1 August 2024 and applies in stages. It regulates AI by the risk of its use:

Separate rules apply to general-purpose AI models, the foundation models behind chat assistants. Their providers must document the model, publish a summary of the training data, and have a policy to respect copyright, including opt-outs by rights holders. Models trained with very large amounts of compute are presumed to carry systemic risk and must also be evaluated, have their risks reduced, report serious incidents, and be protected against cyberattacks. A voluntary Code of Practice, published in 2025, describes how providers can meet these duties.

The timeline, including the changes made by a 2026 amendment known as the AI Omnibus:

Fines for the most serious violations reach 35 million euros or 7 percent of global annual turnover. The law applies to any company that offers AI in the EU, wherever it is based.

The United States: no federal AI law

The United States has no comprehensive federal AI law. Federal policy runs through executive orders, which have changed direction with the administration. A 2023 order focused on safety testing and reporting was revoked in January 2025. The current administration’s AI Action Plan of July 2025 emphasizes innovation, infrastructure, and exports. An executive order of December 2025 directs federal agencies to challenge state AI laws considered too burdensome. An executive order cannot override state law on its own, and as of October 2026 Congress has not passed a law that does.

The states have been more active:

• California passed SB 53, in force since January 2026. Developers of the largest frontier models must publish safety frameworks, report critical safety incidents, and protect whistleblowers. California has many more targeted AI laws, for example on chatbots, automated decisions, and AI-generated content.
• Colorado passed a broad law against algorithmic discrimination in 2024, then replaced it in 2026 with a narrower law based on notice and individual rights, due to take effect in January 2027.
• Many other states regulate specific uses, such as deepfakes in elections, AI in hiring, or chatbots for minors.

At the federal level, the TAKE IT DOWN Act of 2025 requires platforms to remove non-consensual intimate images, including AI-generated ones, within 48 hours of a request. Federal agencies such as the Federal Trade Commission also act against deceptive AI claims under existing consumer protection law.

China: rules for specific services

China regulates AI through a series of targeted rules rather than one law. Recommendation algorithms and “deep synthesis” services such as deepfakes must be registered with the authorities. Interim measures for generative AI services, in force since 2023, require providers that serve the public to ensure lawful training data, label generated content, and keep content in line with state rules, including security assessments before launch. Rules in force since September 2025 require visible and hidden labels on AI-generated text, images, audio, and video.

The United Kingdom and international efforts

The United Kingdom has no general AI law. It asks existing regulators, such as those for data protection, finance, and competition, to apply common principles in their sectors. Its AI Security Institute, founded in 2023 as the AI Safety Institute, tests frontier models.

International agreements are mostly voluntary:

• The OECD AI Principles of 2019 were the first intergovernmental standard and shaped many later laws.
• The Bletchley Declaration of 2023, from the first AI Safety Summit, was signed by countries including the United States, China, and EU members. Follow-up summits took place in Seoul and Paris.
• The Council of Europe Framework Convention on AI, opened for signature in 2024, is the first binding international treaty on AI, focused on human rights, democracy, and the rule of law.

What it means in practice

For companies that build or use AI, a few steps cover most regimes:

1. Keep an inventory of where AI is used in the organization, with which models and data.
2. Classify each use by risk. Hiring, credit, health, education, and safety-critical uses get the strictest rules almost everywhere.
3. Be transparent. Tell people when they interact with AI, and label generated content.
4. Keep humans responsible for decisions that significantly affect people.
5. Document the system’s purpose, data, testing, and known limits.
6. Check data protection and copyright for training data and inputs.
7. Check contracts with model providers, who carry many obligations for the models themselves.