03. Current State
EU AI Act (Regulation EU 2024/1689)
The AI Act entered into force on August 1, 2024. It uses a risk-tiered structure:
Unacceptable risk (prohibited):
These practices are banned entirely. Key examples include AI-powered social scoring by governments, real-time remote biometric identification in public spaces (with narrow law enforcement exceptions), subliminal manipulation techniques that bypass conscious decision-making, and exploitation of vulnerabilities of specific groups (children, people with disabilities). As of May 2026, the EU agreed to expand prohibitions to include "nudification" apps. The prohibition provisions applied from February 2, 2025.
High risk:
AI systems in critical infrastructure, education, employment, essential services (credit, insurance), law enforcement, migration, and justice. These require conformity assessments, bias testing, human oversight mechanisms, technical documentation, and registration in an EU database before deployment. High-risk obligations apply to new systems from August 2, 2026, and to existing systems deployed before that date from August 2, 2027. As of late 2025 and early 2026, these dates may slip: the Commission's proposed "Digital Omnibus" package would defer the high-risk obligations (provisionally to around December 2027 for the underlying framework and August 2028 for application), pending formal adoption by the co-legislators. The statutory dates above remain in force unless and until that change is adopted.
Limited risk:
Chatbots and AI-generated content require transparency disclosures. Users must be informed they are interacting with AI. Providers of systems that generate synthetic content must mark it detectably. These transparency obligations applied from August 2, 2026.
Minimal risk:
AI for spam filters, video games, and similar applications faces no mandatory requirements under the Act.
General purpose AI (GPAI) and foundation models:
This tier covers models like GPT-4, Gemini, and Claude that can be applied to many tasks. All GPAI providers must provide technical documentation and cooperate with authorities. Providers of models trained with more than 10^25 FLOPs (a rough proxy for frontier-scale models) face additional requirements: systemic risk assessments, adversarial testing (red-teaming), incident reporting, and cybersecurity measures. These GPAI obligations applied from August 2, 2025. As of June 2026, the Commission was consulting on draft guidelines for GPAI classification.
The European AI Office, created within the Commission, oversees GPAI model compliance and coordinates enforcement across member states. In June 2026, the Commission announced independent expert support for AI Act enforcement.
An "AI Pact" launched alongside the Act invited companies to voluntarily adopt key obligations ahead of the legal deadlines. Many large providers signed.
US approach
The US has no comprehensive federal AI law as of June 2026.
The Biden administration's Executive Order 14110 (October 2023) required safety testing and disclosure for frontier AI models, directing NIST to develop standards. President Trump revoked EO 14110 on January 20, 2025, and signed a new executive order removing "barriers to American leadership in artificial intelligence," emphasizing competitiveness and deregulation.
The primary federal instrument is now the NIST AI Risk Management Framework (AI RMF 1.0), published January 2023. It is voluntary and provides a structured approach organized around four functions: Govern, Map, Measure, and Manage. NIST has a nonregulatory mission; it develops guidance that organizations may adopt. The White House "Winning the Race: America's AI Action Plan" released July 2025 named NIST in numerous recommended actions.
Sector regulators are filling the gap: the FTC applies consumer protection law to deceptive AI, the CFPB applies fair lending rules to credit algorithms, the EEOC has issued guidance on AI in hiring, and the FDA regulates AI-based medical devices. Some states are more active. Colorado enacted a comprehensive AI liability law. California has passed various AI bills including requirements on training data disclosures and automated decision systems. Illinois requires employers to notify job applicants when AI is used in screening.
China
China has enacted several targeted rules:
Algorithmic Recommendation Regulation (effective March 2022): Requires transparency in recommendation algorithms, prohibits targeting users with addictive content based on personal characteristics, and mandates opt-out options.
Deep Synthesis Regulation (effective January 2023): Governs deepfakes and synthetic media. Requires watermarking of AI-generated content and prohibits use to spread disinformation.
Generative AI Regulation (effective August 2023): Requires security assessments before deployment, content filtering to align with "socialist core values," clear labeling of AI-generated content, and data provenance records. Applies to services offered to the Chinese public.
China's approach is sector-specific and enforced by the Cyberspace Administration of China (CAC). It prioritizes content control and social stability alongside safety.
International frameworks
OECD AI Principles (2019, updated):
The first intergovernmental standard on AI. Forty-six countries have adhered, including all G7 members. Five principles: inclusive growth, human-centred values, transparency, robustness/security/safety, and accountability. G20 members including China endorsed these principles at the 2019 Osaka summit.
Council of Europe AI Treaty (2024):
The first binding international treaty on AI, adopted in May 2024 and opened for signature on 5 September 2024. Focuses on human rights, democracy, and rule of law. Signatories include EU member states, the US, UK, and others.
Hiroshima AI Process:
G7-initiated in 2023. Produced voluntary guiding principles and a code of conduct for advanced AI developers. In May 2026, OECD launched a streamlined reporting framework to help SMEs participate.