How AI is regulated depends heavily on where you are standing. The European Union has a single, detailed law that sorts AI systems by risk. The United States has no comparable federal statute and relies on existing laws, agency actions, executive orders and a growing patchwork of state rules. China regulates specific kinds of AI service one at a time, and the United Kingdom has so far leaned on its existing regulators. This article lays out what each approach does, what has changed recently, and what it means in practice for someone who simply uses AI tools. It is a general explainer, not legal advice.

What is the EU AI Act?

Formally Regulation (EU) 2024/1689, the AI Act is the first broad, horizontal law on AI from a major jurisdiction. The European Commission proposed it in April 2021. The Council and Parliament reached a provisional agreement in December 2023, Parliament adopted the final text in March 2024, and the regulation entered into force on 1 August 2024.

It does not regulate “AI” as a single thing. It regulates by what a system is used for and how much harm that use could cause. The rules bind companies that put AI systems on the EU market or whose systems’ outputs are used there, which gives them reach beyond Europe’s borders, much as the EU’s data protection law did.

How does the risk-based approach work?

The Act sorts systems into tiers.

  • Unacceptable risk: banned outright. Examples include social scoring, manipulative systems that exploit vulnerabilities, and emotion recognition in workplaces and schools. The European Commission’s current summary lists nine prohibited practices.
  • High risk: allowed but strictly controlled. This covers AI used in areas such as critical infrastructure, education scoring, recruitment, credit scoring, law enforcement and border control. Providers must meet requirements on data quality, documentation, logging, human oversight and accuracy.
  • Transparency risk: disclosure duties. People must be told when they are dealing with a machine such as a chatbot, and AI-generated content such as deepfakes must be identifiable.
  • Minimal risk: no specific obligations. The Commission says this covers most AI in use today, such as spam filters and video game AI.

The tiers explain why the same underlying technology can face very different rules. A text generator writing marketing copy is in a different position from the same kind of model used to rank job applicants.

What about chatbots and general-purpose models?

Large general-purpose models were not a central focus of the original 2021 proposal, and the rules for them were added during negotiations. Under the final Act, all providers of general-purpose AI models must publish a summary of their training data, have a copyright compliance policy, and give technical documentation to those who build on their models. Models trained with more than 10^25 floating-point operations are presumed to pose systemic risk and face extra duties such as evaluation, adversarial testing, incident reporting and cybersecurity measures. Openly released models get lighter treatment unless they cross that threshold.

These obligations began applying on 2 August 2025. In July 2025 the Commission published a voluntary General-Purpose AI Code of Practice covering transparency, copyright, and safety and security. Not everyone welcomed it: in August 2025 a group of 38 creators’ organizations issued a joint statement criticizing the code and the training-data template as insufficient on intellectual property protection and transparency.

When do the rules actually apply?

In phases, and the schedule has moved. According to the Commission’s own page, the bans on prohibited practices and the AI literacy obligations applied from 2 February 2025, and governance rules plus general-purpose model obligations from 2 August 2025. The Act becomes generally applicable on 2 August 2026, with transparency rules arriving at that time.

The biggest change came through what the Commission calls the AI Omnibus, a simplification package. Per the Commission, it was proposed in November 2025, reached political agreement in May 2026 and entered into force on 27 July 2026. It pushed back the high-risk deadlines: obligations for the listed high-risk use cases such as biometrics, education and employment now apply from 2 December 2027, and those for AI embedded in regulated products such as toys or lifts from 2 August 2028. It also added a ban on apps that generate non-consensual intimate imagery, strengthened the AI Office’s powers over systems built on general-purpose models, and extended simplified requirements to small mid-sized companies.

I found these omnibus details on a single official page, and other summaries I read give slightly different dates for the high-risk phases, so check the Commission’s current text before relying on a specific deadline.

What are the penalties?

They are large, and tied to company turnover. Breaking the ban on prohibited practices can bring fines of up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Most other breaches of operator obligations carry up to 15 million euros or 3 percent. Supplying incorrect or misleading information to authorities can cost up to 7.5 million euros or 1 percent. For small and medium businesses and start-ups, the lower of the two amounts applies.

Fines on paper are one thing and enforcement is another. The AI Office and national authorities are still building capacity, so how rigorously and how consistently the penalties get applied is not yet known.

How does the United States approach AI?

By contrast, the US has no single federal AI law. Policy has moved by executive action, agency enforcement and state legislation, and it has shifted with administrations.

In October 2023, President Biden issued Executive Order 14110 on safe, secure and trustworthy AI. In January 2025, President Trump revoked it and issued an order calling for an AI action plan, signalling a more market-driven, less restrictive stance. Federal agencies meanwhile use existing law: the Federal Trade Commission launched an enforcement sweep in April 2024 aimed at deceptive AI claims, applying ordinary consumer-protection rules. In 2025 the Commerce Department created a Center for AI Standards and Innovation within the National Institute of Standards and Technology.

The big fight is over states. In May 2025 House Republicans added a 10-year ban on state AI laws to a spending bill, and the Senate voted 99 to 1 to strip it out. In December 2025 President Trump signed an executive order that seeks to preempt state AI regulation. Whether an order can override state law is itself contested, and I did not find a court ruling on it.

What are US states doing?

Quite a lot. According to one summary, nearly 700 AI-related bills were introduced across 45 states in 2024, up from 191 the year before. Notable examples:

  • Utah passed an AI disclosure law in 2024.
  • Colorado signed a broad AI Act in 2024 aimed at high-risk systems. One source says it was later delayed, then repealed and replaced in May 2026 by a narrower disclosure-focused law. I have only seen that in one place, so treat it as needing confirmation.
  • California’s SB 53, covering frontier model developers, took effect on 1 January 2026, after the governor vetoed the stricter SB 1047 in 2024.
  • Texas’s TRAIGA took effect on 1 January 2026.
  • New York signed the RAISE Act in December 2025, expected to take effect in 2027.

For someone using AI, the result is that your protections can depend on your state, and for businesses it means a patchwork of obligations, one reason both industry groups and some officials have pushed for a single national standard.

How do China and the UK compare?

China regulates by technology type. Rules on recommendation algorithms took effect in March 2022, on deepfake-style synthesis in January 2023, and its Interim Measures for the Management of Generative AI Services on 15 August 2023. Labeling measures for AI-generated content were issued in 2025.

The UK set out a different path in a March 2023 white paper titled “A pro-innovation approach to AI regulation,” leaving AI oversight to existing sectoral regulators, not a new law. It created an AI Safety Institute around the November 2023 summit. Both the UK and the US declined to sign the declaration at the Paris AI Action Summit in 2025.

What does it mean for ordinary users?

Less than the headlines imply, and more over time. If you use a chatbot in the EU, you should be told it is a machine, and synthetic images and video should carry labels. Banned practices like social scoring should not be offered to you. If an AI system helps decide something high-stakes about you, such as a job application or credit, the high-risk rules are meant to bring documentation, human oversight and the ability to complain, though those arrive later than first planned. The Commission also runs a complaints tool for AI Act issues.

In the US, you are more likely to meet protections through existing law than through AI-specific rules: consumer protection, anti-discrimination law, privacy statutes and any applicable state rule.

Common questions

Is the EU AI Act already in force?

Yes, since 1 August 2024, but it applies in stages. Some bans and literacy duties have applied since February 2025, the general-purpose model rules since August 2025, and other parts later. The high-risk deadlines were pushed back by the 2026 omnibus.

Does the AI Act apply to companies outside the EU?

Yes, when they place AI systems on the EU market or when their systems’ outputs are used in the EU. That is similar in spirit to how the EU’s data protection law works.

Is there a federal AI law in the United States?

Not a comprehensive one. There are executive orders, agency actions and standards work, plus state laws. The White House asked Congress in March 2026 to pass a national framework, according to one summary I read, but I did not find a statute.

Are chatbots allowed to pretend to be human?

In the EU, systems that interact with people must disclose that they are AI. In the US the answer depends on state law and on whether a deceptive practice triggers consumer protection rules.

Will regulation stop AI progress?

That is an argument about policy, not a settled fact. Supporters say clear rules build trust, while critics argue compliance costs slow innovation, and the omnibus delay shows lawmakers weighing exactly that tradeoff.

What to remember

There is no global rulebook. The EU has a risk-based law with real penalties and a phased timetable that has already been adjusted once. The US relies on a mix of executive action, agency enforcement and state laws, with an unresolved fight about who gets to decide. China and the UK each took their own routes.

Dates and details in this area change quickly. For anything that matters to a business or a legal decision, read the current official text or ask a qualified professional.

Sources