Artificial intelligence regulation is developing quickly across jurisdictions. There is no single global AI law, and the rules that apply depend on where an organization operates, what type of AI system it develops or deploys, and how that system is used.
Last reviewed: October 7, 2026. This beginner overview focuses on the European Union and United States, with selected U.S. state examples. It is not a worldwide survey or a complete fifty-state compliance guide.
This page provides general information, not legal advice. Requirements, enforcement positions, and implementation dates can change. Check the applicable legal text and current official guidance, and seek qualified counsel for specific compliance decisions.
Why AI Regulation Is Growing
Governments are responding to risks involving:
- Discrimination and unfair automated decisions.
- Privacy and data protection.
- Deceptive or synthetic content.
- Safety and reliability.
- Critical infrastructure and national security.
- Consumer protection.
- Employment and education decisions.
- Biometric systems.
- Accountability for automated actions.
Different jurisdictions address these issues through different combinations of AI-specific laws, sector rules, privacy law, consumer law, civil-rights law, and regulatory guidance. For a broader view of where AI is used across industries, see Real-World Applications of AI.
Binding Rules, Policy, and Voluntary Guidance
Before treating an announcement as a compliance requirement, identify what kind of instrument it is:
- Enacted laws and regulations can create binding duties, subject to their scope, exceptions, and application dates.
- Executive orders and government policy direct executive-branch action within legal authority. Read the specific provisions to understand whom they affect.
- Proposals and legislative recommendations describe changes being sought; an announcement alone does not enact them.
- Agency guidance explains an authority’s interpretation or approach. Check its legal status and the underlying law.
- Voluntary frameworks and codes can help organize risk management or demonstrate compliance where a legal framework permits, but their status depends on the instrument.
- Internal governance is how an organization assigns responsibility and manages its AI systems.
The examples below label these categories so that a voluntary practice is not mistaken for a universal legal duty.
The European Union AI Act
The EU AI Act is binding legislation with a risk-based structure. It addresses prohibited practices, high-risk systems, certain transparency duties, and general-purpose AI models.
Its reach is broader than the location of a company’s headquarters: it can cover providers placing AI on the EU market, deployers in the EU, and certain providers or deployers outside the EU when their system’s output is used there. Scope and exclusions must be checked against Article 2.
The phased implementation timeline
The AI Omnibus, Regulation (EU) 2026/1744, entered into force on July 27, 2026. Its amendments are enacted law, including revised high-risk dates. See the Commission announcement and Official Journal text.
- February 2, 2025: Chapters I and II began applying, subject to later dates for the new prohibitions added by the Omnibus. Article 113
- August 2, 2025: General-purpose AI model rules began applying, with a separate transition for older models. Article 113
- August 2, 2026: The general application date, including Article 50 transparency obligations and relevant enforcement powers. Commission enforcement FAQ
- December 2, 2026: The Article 50(2) provider marking/detection transition ends for systems placed on the market before August 2, 2026. The Omnibus’s new prohibitions concerning non-consensual intimate material and child sexual abuse material also apply from this date. Commission enforcement FAQ
- December 2, 2027: Core high-risk requirements in Chapter III, Sections 1–3, apply to systems classified under Article 6(2) and Annex III, except Article 6(5). Amended Article 113
- August 2, 2028: The corresponding core high-risk date for Article 6(1)/Annex I systems, subject to the Act’s product-specific scope. Amended Article 113
Entry into force, application, and enforcement are different milestones. These headline dates do not replace the legacy-system provisions explained below.
Transparency Rules for AI-Generated Content
Article 50 separates duties by role and use:
- Providers of interactive systems must design them to tell people they are interacting with AI, unless that is obvious to a reasonably informed and attentive person in context.
- Providers of synthetic-content systems must make covered audio, images, video, and text machine-readably marked and detectable as AI-generated or manipulated, subject to the provision’s technical limits and exceptions.
- Deployers of emotion-recognition or biometric-categorization systems must inform people exposed to them.
- Deployers publishing deepfakes must disclose their artificial origin. Evidently artistic, creative, satirical, fictional, or similar works have a tailored disclosure requirement.
- Deployers publishing AI-generated or manipulated public-interest text must disclose its artificial origin unless an exception applies. The editorial exception requires human review or editorial control and a person or organization holding editorial responsibility for publication.
The required information must be clear, distinguishable, accessible, and provided by the first interaction or exposure. Article 50 contains additional exceptions, including specified lawful law-enforcement uses.
Machine-readable provider markings and audience-facing deployer disclosures serve different purposes. An editorial exception for public-interest text does not automatically remove a provider’s marking duty. See the Commission’s transparency FAQ.
Timing matters: Article 50 generally applies from August 2, 2026. The December 2, 2026 transition is limited to Article 50(2) marking/detection duties for providers of systems marketed before August 2; it does not postpone all transparency requirements. Commission enforcement FAQ
General-Purpose AI
Providers of general-purpose AI models have obligations separate from the duties for particular AI systems and their users.
These include technical documentation, information for downstream system providers, a policy for complying with EU copyright law, and a public summary of training content. Certain open-source models have limited documentation exceptions, rather than a blanket exemption. Article 53
Models classified as presenting systemic risk face additional requirements such as evaluation, risk assessment and mitigation, incident reporting, and cybersecurity protection. Article 55
The model rules began applying on August 2, 2025. Providers of models placed on the market before August 2, 2025 have until August 2, 2027 to comply under the legacy-model transition. Article 113; Article 111(3)
A provider’s GPAI model obligations and Article 50 duties for systems built on that model must be assessed separately.
High-Risk AI Systems
High-risk classification can cover specified uses in employment, education, critical infrastructure, essential services, law enforcement, migration, and other consequential settings. A separate route covers certain products or safety components subject to third-party conformity assessment. The actual tests, exceptions, and intended use matter; simply working in a named sector does not settle classification. Article 6
High-risk obligations can include requirements around risk management, data governance, documentation, logging, human oversight, accuracy, robustness, and cybersecurity.
The revised headline dates are December 2, 2027 for Annex III systems and August 2, 2028 for qualifying Annex I product systems. These dates govern the relevant core high-risk provisions, not every AI Act rule. AI Omnibus legislative text, Article 1(40)
Legacy systems need a separate check. For most high-risk systems placed on the market or put into service before the relevant Chapter III application date, the transition depends on whether their design undergoes significant changes from that date. Providers and deployers of high-risk systems intended for public-authority use must in any event take the required compliance steps by August 2, 2030. Certain Annex X large-scale IT systems follow a separate December 31, 2030 deadline. These transitions do not displace the prohibited-practice rules. Article 111(1)–(2)
United States AI Regulation in 2026
U.S. AI compliance combines federal and state law, sector requirements, agency action, and executive-branch policy. There is no single checklist that applies to every AI use. The Congressional Research Service overview explains this multi-layered approach.
Important examples have different legal status:
- Legislative recommendations: On March 20, 2026, the White House published a national AI legislative framework and asked Congress to turn it into legislation. The framework itself is a policy proposal; its recommendations do not by themselves create an enacted federal AI code or displace state requirements. White House framework announcement
- Executive policy: The June 2, 2026 executive order, EO 14409, directs federal work on advanced AI innovation, cybersecurity, and security. It calls for a voluntary framework for covered frontier-model developers to engage with the government and provide early access for review. The order expressly does not authorize mandatory government licensing or preclearance of new models. Executive order, Section 3
- Voluntary risk-management guidance: The NIST AI Risk Management Framework is intended for voluntary use. It can support governance and evaluation, but using it does not establish compliance with every applicable law. NIST states that AI RMF 1.0 is under revision. NIST AI RMF
For a real deployment, check the laws and agency rules relevant to the activity, location, and organization. An executive announcement, proposed statute, voluntary framework, and enforceable legal requirement should not be treated as interchangeable.
State-Level AI Rules
The following are representative examples, not a full state-law survey:
- Texas, enacted law already effective: HB 149, the Texas Responsible Artificial Intelligence Governance Act, took effect on January 1, 2026. It includes prohibited uses, disclosure duties for specified actors such as government agencies and health-care providers, attorney-general enforcement, and a regulatory sandbox. Applicability and exceptions depend on the provision. Texas Legislature’s enrolled-bill summary
- Colorado, enacted replacement framework: SB26-189 repealed and reenacted the earlier SB24-205 provisions, shifting to rules for automated decision-making technology used to materially influence consequential decisions. Developer documentation requirements begin January 1, 2027. Covered decisions include specified employment, education, housing, lending, insurance, health-care, and essential-government-service decisions. Colorado General Assembly’s enacted summary
- California, newly signed legislation: On September 30, 2026, the governor announced additional signed AI-related laws concerning workplace protections, health-care decisions, transparency, and other issues. A signing date does not establish when each duty becomes operative; check the relevant chaptered bill and provision before relying on a deadline. Governor’s signing announcement and bill list
State requirements differ materially. Verify current text, coverage, operative dates, and any relevant legal challenges for the specific use case.
Existing Laws Still Apply to AI
AI-specific laws are only one part of the compliance picture.
An AI system can also be subject to existing rules involving:
- Data protection and privacy.
- Employment discrimination.
- Consumer protection.
- Product safety.
- Medical devices.
- Financial services.
- Intellectual property.
- Cybersecurity.
Using AI does not remove obligations that would already apply to the underlying activity. For example, AI used in health care, financial services, education, or business may remain subject to rules governing that underlying activity.
AI Regulation vs AI Governance
Regulation is external legal or regulatory obligation.
Governance is the internal system an organization uses to manage AI responsibly.
Good governance can include:
- System inventory.
- Risk classification.
- Approval and authorization controls.
- Data governance.
- Evaluation and testing.
- Human oversight.
- Monitoring and incident response.
- Documentation and audit trails.
A governance program should be designed to satisfy the organization’s actual risk profile and applicable legal obligations rather than merely copying a generic checklist.
Read AI and Ethical Considerations and AI in Governance.
Regulatory Risk for Generative AI
Generative AI can raise regulatory issues involving:
- Copyright and training data.
- Privacy and personal data.
- Deceptive synthetic media, including issues discussed in AI in Social Media.
- Disclosure and provenance.
- Consumer harm.
- Security and misuse.
The applicable obligations depend on jurisdiction and how the model or application is used.
Read What Is Generative AI?.
Regulatory Risk for AI in Employment and High-Stakes Decisions
AI used for hiring, lending, insurance, education, healthcare, or access to essential services can create elevated legal and operational risk. For sector examples, see AI in Education, AI in Healthcare, AI in Finance, and AI in Business.
Organizations should pay particular attention to:
- Disparate impact.
- Data quality.
- Explainability requirements where applicable.
- Human review.
- Notice and appeal rights.
- Auditability.
- Vendor accountability.
How Organizations Can Prepare
A practical compliance approach is:
- Inventory AI systems and use cases.
- Identify the jurisdictions and sectors involved.
- Determine the organization’s role: provider, deployer, importer, distributor, employer, regulated entity, or other category.
- Classify system risk and applicable obligations.
- Establish documentation, testing, logging, and human-control requirements.
- Monitor regulatory updates and implementation deadlines.
- Reassess when models, vendors, data, or use cases change. For current adoption patterns, see AI in Business and Real-World Applications of AI.
Frequently Asked Questions
Is there one global AI law?
No. AI regulation differs by jurisdiction and sector.
Did the entire EU AI Act take effect on August 2, 2026?
No. Article 50 generally applied from August 2, 2026, while the revised core high-risk dates are December 2, 2027 for Annex III and August 2, 2028 for qualifying Annex I systems. Older systems and models have specific transitions. See the timeline above and amended Article 113.
Does the United States have a federal AI Act?
U.S. obligations must be checked across federal, state, and sector-specific measures. The March 20, 2026 White House legislative framework is a set of recommendations to Congress, not itself an enacted equivalent of the EU AI Act. Official framework announcement
Does existing law still apply to AI?
Yes. Privacy, employment, consumer-protection, healthcare, financial, cybersecurity, and other laws can apply even without an AI-specific statute.
Is this page legal advice?
No. It is a general informational overview and should be paired with current official sources and qualified legal advice for specific compliance decisions.
Review Cadence
Because AI regulation changes quickly, this page should be reviewed at least quarterly and whenever a major law, enforcement milestone, or implementation deadline changes. For broader context on emerging developments, see The Future of AI.
Last reviewed: October 7, 2026
Next Lesson
Continue with AI in Governance to connect external requirements with internal responsibility, oversight, and day-to-day controls.