No single law governs artificial intelligence worldwide. The European Union bans some uses outright and licenses others by risk, the United States has no general federal AI statute and instead mixes federal guidance with a fast-moving patchwork of state laws, and China governs generative AI through administrative measures that set content and labelling duties for services offered to the public. If you build or buy AI that crosses borders, you do not comply with “AI regulation” in the abstract; you comply with several regimes at once, and the strictest one that reaches you usually sets your floor.
AI regulation is the set of laws, binding measures, and official frameworks that decide which AI systems may be built, sold, or used, what their makers and users must document and disclose, and who is punished when they cause harm.
Checked 5 November 2026. AI rules are changing quickly — the EU has already amended its own timetable, Colorado has repealed and replaced its first AI act, and California added a new layer of AI statutes in September 2026 — so treat the dates and duties below as current at that date and re-check the official text before you act on a detail that matters to your business. This guide is general information, not legal advice.
1. The short answer: three models, one market
It helps to see the three big approaches as answers to three different questions. The EU asked: how do we make AI safe enough to sell across a single market? Its answer is a product-safety law that sorts systems by risk and attaches duties to the risk level. The United States asked, at federal level: how do we stay ahead in AI without slowing it down? Its answer, especially since 2025, has been policy and guidance rather than a statute, with the real binding rules emerging state by state. China asked: how do we keep generative AI services aligned with national security, social stability, and content controls? Its answer is a set of measures from the cyberspace regulator that govern what a public-facing service may generate, what it must label, and what it must file.
None of these models is a copy of another, and none of them stops at its own border. The EU AI Act reaches companies outside Europe that place AI on the EU market or whose systems’ outputs are used there. China’s measures reach any provider offering generative AI services to the public inside mainland China, regardless of where the provider is based. A California transparency duty reaches a provider whose system is publicly available to Californians. In practice, a company selling one AI product globally ends up designing for the most demanding regime in each category — EU risk management, Chinese content controls, Californian provenance labelling — and then switching features on or off by market.
That is why this guide is organised the way it is. First, what each regime actually requires, in its own terms, with dates. Then a side-by-side comparison, then the practical sequence a company can follow. Where a rule is still moving — and several are — the guide says so plainly rather than picking the tidiest version of the story.
<img src="
” alt=”Three distinct roads diverging from a single junction across an abstract map, illustrating three different regulatory models”>
2. What “AI regulation” actually covers (and what it does not)
People use “AI regulation” to mean at least four different things, and confusing them is the most common source of bad compliance advice. First, there are rules about AI systems themselves: what a system may do, how it must be tested, and what must be documented before it ships. The EU AI Act is the clearest example. Second, there are rules about specific uses: hiring tools, credit scoring, medical devices, and chatbots each attract their own duties, sometimes inside a general AI law and sometimes inside older sector law. Third, there are rules about content: labelling AI-generated images and video, watermarking, and provenance disclosures, which is where China and California have moved fastest. Fourth, there are rules about data: privacy law, copyright, and data-security law that already governed the training data and personal data behind AI long before anyone wrote an “AI act.”
It also matters who the law talks to. Most regimes split the world into makers and users, though they use different words. The EU distinguishes providers (who build or place a system on the market) from deployers (who use it under their own authority). Colorado’s original act used developers and deployers in a similar split. China talks about providers of generative AI services and, separately, about platforms that distribute generated content. The duties follow the role: the maker documents and tests, the user oversees, monitors, and answers to the person affected. A company that both builds a model and runs it as a service can wear both hats at once, and should assume both sets of duties apply until a lawyer tells it otherwise.
Finally, not everything called “regulation” is law. The NIST AI Risk Management Framework in the US is voluntary guidance, and the UK’s five principles are not themselves legally binding on businesses. Voluntary does not mean irrelevant: voluntary frameworks get written into contracts, procurement requirements, and state laws by reference, and they shape what a court or regulator considers reasonable care. But it is a mistake to treat a framework as a statute, just as it is a mistake to treat a policy document like America’s AI Action Plan as a law. This guide labels each instrument for what it is. For the technical foundations underneath all of this — what these systems actually are and how they produce outputs — see How Does AI Work.
3. The EU AI Act: the risk ladder, from banned to minimal
The EU AI Act, Regulation (EU) 2024/1689, is the world’s first comprehensive, horizontal AI law: one statute that covers AI across sectors rather than one sector at a time. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024, and it applies in phases rather than all at once. Its core idea is simple to state and demanding to apply: the higher the risk a system poses to health, safety, or fundamental rights, the stricter the rules.
At the top of the ladder are prohibited practices under Article 5, which have applied since 2 February 2025. These include AI that uses subliminal or manipulative techniques to distort behaviour in ways that cause harm, systems that exploit the vulnerabilities of a person or group, social scoring by public authorities, untargeted scraping of facial images from the internet or CCTV to build a face-recognition database, emotion recognition in workplaces and schools, and real-time remote biometric identification in public spaces by law enforcement, subject to narrow exceptions. A later amendment added prohibitions on generating or manipulating non-consensual intimate material and child sexual abuse material. If your system falls here, the compliance strategy is not a checklist; it is not to build it.
Below that sit high-risk systems, the bulk of the Act. A system is high-risk in two ways: it is a safety component of a product already covered by EU product-safety law (machinery, medical devices, toys, lifts, and similar), or it falls into one of the eight use-case domains in Annex III — biometrics, critical infrastructure, education and vocational training, employment and self-employment, access to essential public and private services (including credit scoring and insurance pricing), law enforcement, migration and border control, and the administration of justice and democratic processes. A recruitment-screening tool, a university admissions system, and a credit-scoring model are the classic examples. Most AI systems sit below this line: the Act’s transparency tier covers chatbots and synthetic content, and everything else is minimal risk with no new duties beyond voluntary codes of conduct.
The Act also has a separate layer for general-purpose AI models — the foundation models that power many downstream systems. A chatbot built on a licensed model is an AI system with its own tier and duties, while the model underneath carries its own Chapter V duties that belong to whoever provides it. That split is one of the Act’s most consequential design choices, and it is covered in the next section. For the transparency end of the ladder, Europe’s work on deepfake safeguards is already visible in practice, as our report on Europe’s new deepfake rules shows.
4. The EU in practice: what providers and deployers must do
For high-risk systems, the provider carries the heavy load. Before placing a system on the market, the provider must run a risk-management system, govern the data used to train and test it, keep technical documentation, keep automatic logs, design for transparency, build in human oversight, and demonstrate accuracy, robustness, and cybersecurity. A quality-management system sits behind all of that, and certain systems must be registered in the EU database before they can be deployed. After the sale, the provider must monitor the system, report serious incidents, and take corrective action where needed. Conformity assessment — self-assessment for most Annex III systems, third-party assessment for product-embedded ones — is the gate before market entry.
Deployers, the organisations that actually use a high-risk system, have lighter but real duties: use the system as instructed, keep the logs it generates, monitor its operation, make sure input data is relevant to its purpose, and inform affected people when a high-risk system is used in ways the Act specifies, including telling workers and their representatives when a workplace system is in use. The deployer also owns the fundamental-rights impact assessment for certain public-sector and financial-services uses: a written assessment, done before first use, of what the system could do to the people it affects.
General-purpose AI model providers have their own list under Article 53: draw up and maintain technical documentation for the model, give downstream providers the information they need to meet their own duties, put in place a policy for complying with EU copyright law, and publish a summary of the content used for training. Models with systemic risk — presumed when the computing power used for training exceeds 10^25 floating-point operations, or when the Commission designates a model — owe four more under Article 55: model evaluation including adversarial testing, assessment and mitigation of systemic risks at EU level, tracking and reporting of serious incidents, and an adequate level of cybersecurity. The voluntary GPAI Code of Practice, whose final text the Commission received on 10 July 2025 and approved through an adequacy assessment on 1 August 2025, is the practical route to showing compliance: a provider that adheres to an approved code is presumed to comply with the corresponding duties. Reported signatories include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, and OpenAI, alongside smaller specialist firms.
The transparency tier is the one most ordinary companies will meet first. From the relevant application date, a provider of an AI system that interacts with people must make clear that the user is dealing with AI, unless that is obvious from the context. Providers of systems that generate synthetic audio, image, video, or text content must mark that content in a machine-readable way so it can be detected as artificially generated or manipulated, and deployers of deepfakes must disclose that the content was artificially generated. None of this requires a company to stop using AI; it requires the company to stop passing AI output off as human.
5. The EU timeline: what applies now, what moved, and who enforces it
The EU timetable is where careful readers need to slow down, because the Act’s own schedule has been amended since publication. The dates that are not in dispute: the Act entered into force on 1 August 2024; the prohibited practices and the AI literacy duty applied from 2 February 2025; the general-purpose AI model duties, the governance arrangements, and the penalties framework applied from 2 August 2025; and the transparency duties under Article 50 were scheduled for 2 August 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to conform to the GPAI duties, while fines for GPAI providers began to be available from 2 August 2026.
The moving part is the high-risk timetable. The original text put most high-risk obligations — the Annex III use cases — at 2 August 2026, and high-risk AI embedded in already-regulated products at 2 August 2027. A later amendment, reported as Regulation (EU) 2026/1744 under the “AI Omnibus” simplification package, changed those application dates: Annex III high-risk systems are now reported as facing December 2027, and product-embedded high-risk systems August 2028, alongside new prohibited practices on non-consensual intimate material and child sexual abuse material, simplifications for smaller firms, and stronger enforcement powers for the AI Office. Secondary summaries agree on the direction — a delay of roughly sixteen months for Annex III — but differ in detail, and the EUR-Lex summary confirms the amendment exists without spelling out the new dates in its short text. If a high-risk deadline matters to your product plan, check the current consolidated text on EUR-Lex rather than relying on any single summary, including this one.
Enforcement is split. The European AI Office, inside the Commission, enforces the GPAI layer. National market-surveillance authorities and sector regulators enforce the rest, with the AI Board coordinating them. The penalties are the headline numbers everyone quotes, and they are real: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches, whichever figure is higher. But the more immediate enforcement risk for most companies is not a maximum fine; it is a market-surveillance authority asking for documentation you do not have, or a customer in procurement asking for it first. The Act’s duties are increasingly becoming contract terms before they become enforcement actions.
6. The United States at federal level: a policy swing, not a statute
The United States has no single, generally applicable federal AI statute. That sentence surprises people who follow AI news, because federal AI policy has been loud for years. But executive orders are not statutes, and guidance is not law, and the last three years show how much can change when the White House changes hands. In October 2023, Executive Order 14110 set out a safety-focused federal AI programme, directing agencies to adopt risk-management practices and commissioning work from NIST. In January 2025, Executive Order 14148 revoked it, and Executive Order 14179 directed the creation of a new AI action plan and a review of prior actions that might conflict with the new policy.
The resulting plan, America’s AI Action Plan, published by the White House in July 2025, is a policy document, not a law. Its thrust is deregulatory and competitiveness-focused: remove barriers to AI development, accelerate infrastructure, and push back on state rules seen as burdensome. One of its recommended actions is that NIST revise its AI Risk Management Framework to remove references to misinformation, diversity, equity and inclusion, and climate change. In December 2025, Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence,” went further: it directed the Department of Commerce to evaluate state AI laws and established an AI Litigation Task Force to challenge some of them, explicitly naming Colorado’s AI law as an example of excessive state regulation. The federal government is therefore not merely absent from AI regulation; it is actively contesting parts of the state-level rules that do exist.
That does not mean AI is unregulated at federal level. It means the regulation arrives through older, general laws applied to new tools: civil-rights law applied to a discriminatory hiring model, consumer-protection law applied to a deceptive AI claim, sector rules applied to AI in finance, health care, and transport. The Federal Trade Commission has warned for years that existing law against unfair and deceptive practices applies to AI claims with full force, and employment and housing discrimination law does not stop applying because a model made the decision. A company that waits for a federal AI act before building AI governance is waiting for a train that may never arrive, while the laws that already exist are already being enforced against AI systems. The practical consequence for users is that AI controls — the ability to see, limit, and audit what AI does on your behalf — matter as much as the rules for builders, a theme our guide to turning off AI on Google Search explores from the user’s side.
7. The NIST framework: voluntary guidance that became the shared language
If the US has a centre of gravity for AI governance, it is a voluntary document. The NIST AI Risk Management Framework 1.0 (NIST AI 100-1), published in January 2023 by the National Institute of Standards and Technology, part of the Department of Commerce, is designed for voluntary use by organisations of any size. It organises AI risk management into four functions: Govern (set the culture, roles, and accountability for AI), Map (understand the context, the people affected, and the risks), Measure (analyse and evaluate those risks with metrics and testing), and Manage (respond to risks, monitor them, and adjust). Around those functions sit trustworthiness characteristics — validity, safety, security, accountability, explainability, privacy, and fairness — that give teams a shared vocabulary for arguing about what “good” looks like.
The framework’s influence comes from adoption, not compulsion. Colorado’s original AI act pointed deployers toward the NIST framework as an appropriate guide for a risk-management programme. Federal procurement and contract language increasingly references it. NIST’s companion document, the Generative AI Profile (NIST AI 600-1, published 26 July 2024), extends the framework to generative AI specifically, naming twelve risks that are unique to or worsened by generative systems and mapping suggested actions to each. The Profile was written under the now-revoked Executive Order 14110, but NIST still publishes it as a current document, which is a useful reminder that guidance can outlive the policy that commissioned it.
Two honest caveats belong here. First, using the framework does not by itself prove legal compliance with any statute; it is a management system, not a safe harbour, and no version of it certifies a company as compliant with the EU AI Act, Colorado’s law, or California’s statutes. Second, the framework itself is being revised under the AI Action Plan, and as of the reporting available in October 2026 no new version had been published — AI RMF 1.0 remains the current version. Teams building governance now should build on 1.0 and watch for 1.1, not wait for it. The framework’s real value is prosaic: it gives a cross-functional team — engineering, legal, product, and procurement — one structure for the same conversation, instead of four separate ones.
8. The US states: Colorado’s rewrite and California’s targeted statutes
With no federal AI act, the binding US rules are being written state by state, and the two states that matter most illustrate two opposite strategies. Colorado tried the comprehensive route first. Its AI Act, SB 24-205, signed on 17 May 2024, was the first comprehensive US state law for high-risk AI: a duty of reasonable care against algorithmic discrimination, distinct duties for developers and deployers, deployer risk-management programmes, and impact assessments before deployment, annually, and within 90 days of any substantial modification, enforced by the Attorney General as a deceptive trade practice.
That law’s history since is a cautionary tale about building on moving ground. Its duties were originally set for 1 February 2026. A special session in August 2025 produced only a date change — SB 25B-004, signed 28 August 2025, moving the operative date to 30 June 2026. Then, in 2026, the legislature repealed SB 24-205 outright and re-enacted the law as SB 26-189, signed 14 May 2026, a narrower notice-and-rights regime: notice to affected people, an explanation after an adverse outcome, correction, human review, and three years of records, enforced only by the Attorney General, effective 1 January 2027. Litigation over the original law — a federal suit arguing vagueness, with the Department of Justice intervening — and a court stay were reported alongside the rewrite, and the replacement’s own status has been described as uncertain. The lesson is not that Colorado gave up; it is that a company that built its programme around the 2024 text’s impact assessments would have built the wrong programme for the 2026 text’s notice duties. Track the current statute, not the headlines from two years ago.
California took the opposite approach: many targeted statutes instead of one comprehensive act. The Transparency in Frontier Artificial Intelligence Act (SB 53) took effect on 1 January 2026 and reaches developers training above 10^26 operations, with heavier duties above $500 million in annual revenue: publish a frontier AI framework, publish a transparency report at deployment, report critical safety incidents, and protect whistleblowers, with Attorney General enforcement up to $1 million per violation. The generative-AI training-data transparency law (AB 2013) also took effect on 1 January 2026, requiring developers to post documentation of their training datasets. The California AI Transparency Act (SB 942) became operative on 2 August 2026, requiring covered providers of publicly accessible generative AI systems to run a free AI-detection tool and to include manifest and latent provenance disclosures in generated image, video, and audio content, at $5,000 per violation; a 2026 amendment removed its one-million-user threshold, so it now reaches every public generative AI system. The California Privacy Protection Agency’s automated-decisionmaking rules apply from 1 January 2027, giving consumers pre-use notice, a right to opt out in many cases, and a right to access information about how the technology was used. And in September 2026 the governor signed a further package, including SB 947, the “No Robo Bosses” act, effective 1 July 2027, which bars employers from relying solely on an automated decision system to discipline or terminate a worker.
The pattern across other states is similar in shape: targeted rules for hiring tools, deepfakes in elections, chatbots and companion apps, and content labelling, rather than one omnibus act. New York City’s hiring-tool audit rule is the best-known local example. The practical effect is a compliance map that looks less like one law and more like fifty overlapping ones, with the strictest applicable rule setting the design constraint for any feature shipped nationally.
9. China: measures, not a single statute
China does not regulate generative AI through one comprehensive statute. It regulates through administrative measures issued by the cyberspace regulator and other agencies, sitting on top of the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law. That distinction matters: a measure is easier to issue and amend than a statute, and it is enforced through existing law rather than through a penalty schedule of its own.
The central document is the Interim Measures for the Management of Generative AI Services, issued on 10 July 2023 by seven agencies — the Cyberspace Administration of China (CAC), the National Development and Reform Commission, the Ministry of Education, the Ministry of Science and Technology, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Radio and Television Administration — and in force from 15 August 2023. Its scope is services offered to the public inside mainland China that use generative AI to produce text, images, audio, or video; internal research and development that is not offered as a public service is carved out. Article 4 sets the content rules: generated content must uphold core socialist values and must not subvert state power, endanger national security, promote separatism, terrorism, or extremism, promote ethnic hatred or discrimination, or contain violent, obscene, pornographic, or false and harmful information, and providers must act against content that discriminates on ethnicity, belief, nationality, region, sex, age, occupation, or health. Article 7 requires training data that is high-quality, accurate, diverse, and lawfully sourced without infringing intellectual property. Article 9 makes providers the producers of online content and processors of personal data, with service agreements defining rights and obligations. Article 12 requires labelling of generated images and video, cross-referring to the earlier deep synthesis rules. Article 17 requires a security assessment and algorithm filing for services with public-opinion attributes or social-mobilisation capacity — the trigger is the nature of the service, not a user count.
The labelling regime then got its own, more operational instrument. The Measures for the Labelling of AI-Generated Synthetic Content, issued on 7 March 2025 and in force from 1 September 2025, require both a visible label and an embedded metadata label on generated text, images, audio, video, and virtual scenes, and require distribution platforms to check metadata and flag AI-origin content. Alongside it sit the deep synthesis provisions in force since January 2023, which the Interim Measures cross-reference. The direction of travel is clear: China moved first on content and labelling, where the EU moved first on risk tiers and the US states moved first on discrimination and transparency. A company publishing AI-generated content for users in China needs a labelling pipeline that survives re-uploads and platform checks, not just a visible watermark on first publication. Our news coverage of Beijing’s full-lifecycle AI rules tracks how this framework keeps expanding.
10. The UK and the rest: principles, sector regulators, and soft law
The United Kingdom has no AI Act, and that is a deliberate choice rather than an oversight. The March 2023 white paper, “A pro-innovation approach to AI regulation,” set out five cross-sector principles for existing regulators to apply within their existing powers: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. The government confirmed the approach in its February 2024 consultation response and asked key regulators to publish how they were applying the principles. The principles themselves create no duties for businesses; the duties come from the statutes regulators already enforce — data protection, equality, consumer protection, financial services, product safety, and online safety law — and the principles shape how regulators read those statutes for AI.
In practice, that means the regulator you hear from depends on what your system does. The Information Commissioner’s Office covers personal data, which almost every AI system processes. Ofcom covers user-to-user and search services under the Online Safety Act 2023. The Financial Conduct Authority and the Prudential Regulation Authority cover conduct and model risk at regulated firms. The Competition and Markets Authority covers competition and consumer protection. The Equality and Human Rights Commission enforces the Equality Act 2010, which applies to a discriminatory model exactly as it applies to any other decision process. The four largest regulators coordinate through the Digital Regulation Cooperation Forum. Alongside them sits the AI Security Institute — set up as the AI Safety Institute around the November 2023 Bletchley Park summit and renamed on 14 February 2025 with a narrower security focus — which evaluates frontier models and publishes research but is not a regulator and cannot fine a company or block a release. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, reformed the automated-decision rules, with those reforms in force from 5 February 2026. As of the reporting available in October 2026, no dedicated AI bill had been introduced.
Beyond these four centres of gravity, the rest of the world is mostly in the soft-law and sectoral stage: the OECD AI Principles, first adopted in 2019 and updated in 2024, provide the shared vocabulary that national frameworks borrow from; the Council of Europe’s Framework Convention on AI (2024) is the first binding international treaty on AI, though its practical force depends on ratification and national implementation; and countries from Brazil to India to Canada have bills and frameworks at various stages that this guide does not pretend to summarise, because summarising a bill as if it were law is one of the easiest ways to mislead a reader. The pattern to watch is convergence on a few ideas — transparency for synthetic content, accountability for consequential decisions, safety testing for the most capable models — even as the legal instruments carrying those ideas stay stubbornly different. For the broader shift these rules are responding to — answers replacing link lists — see What Is GEO?
11. Side by side: the comparison table
The table below compresses the guide into one view. It is a map, not a substitute for the sections above: where a cell says “phased” or “targeted,” the detail and the caveats live in the section for that jurisdiction.
| Dimension | European Union | United States (federal) | United States (states) | China | United Kingdom |
|---|---|---|---|---|---|
| Legal form | Binding regulation (Reg. (EU) 2024/1689) | No general AI statute; executive orders + guidance | State statutes (comprehensive in Colorado’s original act; targeted elsewhere) | Administrative measures (CAC + agencies) | No AI statute; principles + existing law |
| Core logic | Risk tiers: banned, high-risk, transparency, minimal | Competitiveness + sector law applied to AI | Discrimination, transparency, labelling (varies by state) | Content control + labelling for public services | Five principles applied by sector regulators |
| Who is covered | Providers, deployers, GPAI model providers, importers, distributors | Federal agencies directly; private sector via sector law and procurement | Developers/deployers (Colorado); covered providers (California) | Providers of public generative-AI services; distribution platforms | Any firm under existing regulators’ remits |
| Key duties | Risk management, documentation, human oversight, registration, GPAI transparency | NIST framework (voluntary); agency AI governance | Impact assessments (original Colorado); notice, explanation, human review (revised Colorado); provenance labelling (California) | Content compliance, training-data governance, labelling, security assessment + algorithm filing | Comply with data, equality, consumer, safety law as regulators interpret it for AI |
| Enforcement | AI Office (GPAI) + national authorities; fines up to €35m/7% or €15m/3% | Sector regulators (e.g. FTC); federal litigation task force on state laws | State attorneys general; California penalties incl. $5,000/violation (Transparency Act) and $1m/violation (SB 53) | Through existing law; no self-contained penalty schedule in the measures | Sector regulators (ICO, FCA, CMA, Ofcom, EHRC); no AI-specific fines |
| Status at 5 Nov 2026 | In force, phased; high-risk dates amended (see §5) | Policy swing; framework under revision | Colorado rewritten (effective 1 Jan 2027); California layering new statutes into 2027 | Interim Measures (2023) + labelling measures (2025) in force | Principles model; no AI bill introduced |
12. How the approaches differ — and where they converge
The differences are philosophical before they are technical. The EU regulates the system by its risk, before it is sold. The US states mostly regulate the decision after it affects someone, through discrimination and transparency duties. China regulates the content a service produces and the public’s ability to tell it apart from human content. The UK regulates the firm through regulators it already has. Those are four different theories of what the problem is: unsafe products, unfair decisions, untrustworthy content, and unaccountable firms. A company that treats them as four versions of one rule will miss the point of each.
And yet the regimes converge on a surprising amount of practice. Every one of them, in its own language, ends up requiring four things: know what AI you run, document what it does, tell affected people something meaningful, and keep a human in a position to intervene. The EU calls it risk management, documentation, transparency, and human oversight. Colorado’s original act called it a risk-management programme, impact assessments, notices, and human review. California calls it frameworks, transparency reports, disclosures, and a ban on AI-only firing. China calls it data governance, labelling, and filing. The vocabulary differs; the operational work — an inventory, a record, a disclosure, a review step — is recognisably the same. That is good news for compliance teams: one well-built governance spine can serve several regimes, with jurisdiction-specific modules bolted on.
The second convergence is on synthetic content. The EU, China, and California have all, independently, landed on labelling AI-generated content as a core duty, and Europe’s standardisation work on deepfake safeguards is pushing the same idea into technical specifications. The third convergence is on the most capable models: the EU’s systemic-risk tier, California’s frontier-model transparency duties, and the UK’s security-focused institute all single out the largest models for extra scrutiny, even though they disagree about what that scrutiny should be. Where the regimes genuinely diverge — and will keep diverging — is on content controls and on the role of the state: China’s content rules have no counterpart in the EU or US, and the US federal government’s current challenge to state AI laws has no counterpart anywhere else. For publishers, the practical side of this convergence is visibility: as AI answers become the surface where content is found, the same transparency and documentation habits that satisfy regulators also make content citable, which our guide to GEO Explained sets out in detail.
13. What companies must do: a practical sequence
Start with an inventory. List every AI system and model your organisation builds, buys, or uses, who provides it, who deploys it, and what decisions or content it touches. Most companies discover shadow AI at this step — tools adopted by individual teams that nobody in legal or engineering has ever reviewed — and that discovery alone justifies the exercise. Classify each item: is it banned anywhere you operate, high-risk or consequential anywhere, a general-purpose model, a public-facing generative service, or a chatbot that must disclose itself? The classification decides everything downstream, and it is the step most often skipped in favour of buying a tool first.
Next, build the documentation spine once and reuse it everywhere: a model and system record (purpose, data, testing, limitations, known risks), a risk assessment that is updated when the system changes materially, logs that are actually retained, and a human-oversight step for consequential decisions that is real rather than ceremonial — a person who can see the basis of the decision, override it, and be reached by the person affected. Then add the jurisdiction modules: EU conformity and registration work for high-risk systems and GPAI documentation for models; Colorado’s notice, explanation, correction, and human-review duties for the 2027 regime; California’s provenance labelling and detection tooling for generated image, video, and audio content; China’s content controls and labelling pipeline, with metadata that survives redistribution, for services offered to the public in China; and UK regulator expectations for your sector, checked against the ICO, FCA, or Ofcom guidance that actually covers you.
Then make transparency a product feature, not a legal footnote. Disclose AI interaction where the law requires it, label synthetic content in both visible and machine-readable form, and give affected people a route to challenge a decision that does not dead-end in a chatbot. Finally, set a monitoring habit: re-check the EU consolidated text when the high-risk dates move again, watch Colorado’s rulemaking and litigation, calendar California’s January 2027 cluster, and review your AI inventory quarterly, because the fastest-moving risk in AI regulation is not a fine — it is building on last year’s version of a law. Measurement belongs in the same habit: the same discipline that tracks how your content appears in AI answers — our walkthrough of Search Console’s generative AI reports and our guide to how brands track visibility inside AI answers cover the tools — also tells you whether your disclosures and documentation are actually being seen.
14. FAQ: the questions readers actually ask
How do the EU, US, and China approaches differ, in one paragraph each? The EU sorts AI by risk and attaches the heaviest duties to high-risk systems and systemic-risk models, with fines tied to global turnover. The US has no general federal AI law: federal policy swings with the administration and works through guidance like the NIST framework, while binding duties come from the states — Colorado’s rewritten notice-and-rights regime and California’s targeted transparency and labelling statutes. China governs public generative-AI services through administrative measures that set content rules, training-data duties, labelling, and security assessments, enforced through existing law. The UK, for completeness, uses principles applied by existing sector regulators rather than a dedicated statute.
Does the EU AI Act apply to a company outside Europe? Yes, in the cases that matter most: if you place an AI system on the EU market, put it into service there, or are a provider or deployer whose system’s output is used in the EU, the Act reaches you. The same extraterritorial logic applies in China for services offered to the public inside mainland China, and in California for systems publicly available to Californians. “We are not based there” is not a compliance strategy in any of the three regimes.
What is a high-risk AI system, and is my chatbot one? Under the EU Act, a high-risk system is a safety component of a regulated product or a system used in one of the eight Annex III domains — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice. An ordinary customer-service chatbot is not high-risk; it sits in the transparency tier and must disclose that users are dealing with AI. A chatbot used to screen job applicants, however, is being used in the employment domain, and the use — not the technology — is what makes it high-risk.
Is the NIST AI Risk Management Framework mandatory? No. It is voluntary guidance from NIST, and using it does not by itself prove compliance with any statute. Its value is that it is the shared language: state laws, procurement requirements, and contracts increasingly reference it, so a programme built on Govern, Map, Measure, and Manage translates across jurisdictions even though no law mandates the framework itself.
What changed in Colorado, and what should I prepare for now? Colorado’s original comprehensive act (SB 24-205) was repealed and replaced by SB 26-189, a narrower notice-and-rights law effective 1 January 2027, with notice, post-adverse-outcome explanation, correction, human review, and three years of records, enforced only by the Attorney General. If you built impact-assessment machinery for the 2024 text, keep the underlying records — they are still good governance — but re-tool your compliance plan around notice and rights, and watch the litigation and rulemaking, which could still move the dates.
What does China actually require of a generative AI service? For a service offered to the public in mainland China: lawful, high-quality training data; content that complies with Article 4’s rules; labelling of generated images and video (and, since September 2025, visible plus metadata labels on generated text, images, audio, video, and virtual scenes); protection of user privacy and personal data; and, for services with public-opinion attributes or social-mobilisation capacity, a security assessment and algorithm filing. Internal research tools not offered to the public are carved out.
Which regime should a small company prioritise? The one that reaches your customers first. If you sell into Europe, the EU AI Act’s transparency duties and, where relevant, high-risk duties come first. If you serve Californians with generated media, the Transparency Act’s labelling duties come first. If you offer a public generative service in China, the Interim Measures come first. In all cases, build the inventory and documentation spine first, because it is the one investment every regime rewards.
What should I watch next? The EU’s consolidated high-risk timetable and the AI Office’s enforcement practice; Colorado’s rulemaking and the fate of its court stay; California’s January 2027 cluster of effective dates, including the privacy agency’s automated-decisionmaking rules; China’s continuing expansion of labelling and filing duties; and whether the UK introduces an AI bill or the US Congress passes a federal framework. Any one of those could change a section of this guide, which is why it is dated and why you should re-check the official text before relying on a detail.
0 Comments