AI Regulation 2026: Global AI Laws, EU AI Act & US Rules

Last reviewed October 21, 2026

Key Takeaways

• There is no single global AI law. Businesses deal with a mix of statutes, executive orders, guidance and pending bills, and the mix changes by country, sector and use case.
• EU AI Act, already applying: prohibited practices since February 2, 2025, GPAI obligations since August 2, 2025, and the AI Office’s enforcement powers and Article 50 transparency duties since August 2, 2026.
• EU AI Act, easy to miss: December 2, 2026 brings machine-readable marking for generative AI systems that were already on the market before August 2, 2026, plus two new bans.
• EU high-risk rules were delayed. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026. Annex III systems now have until December 2, 2027, and AI embedded in regulated products (Annex I) until August 2, 2028.
• The US has no federal AI statute. Executive Order 14365 directs agencies to challenge state laws, but an executive order is not an act of Congress and no preemption law has passed. State laws stay in force unless a court says otherwise.
• State laws are the nearest US risk. They cover automated employment decisions, frontier models, chatbots and more, and they differ from state to state.
• Your obligations depend on your role (provider, deployer or another actor) and on where each system is used.
• Start with an inventory of every AI system in use, then map the rules to each one.

Latest AI Regulation Developments

October 1, 2026: first Connecticut provisions take effect. Connecticut’s S.B. 5 (Public Act 26-15) began to phase in. The first change with real bite is that using an automated employment tool is no defense to a discrimination complaint. The notice and disclosure duties for those tools apply to tools deployed from October 1, 2027, and the chatbot rules start January 1, 2027. Summaries of the act disagree on some developer-side dates, so read the Public Act text before you fix a timeline.

September 30, 2026: California enacts the No Robo Bosses Act (S.B. 947). It takes effect July 1, 2027. Employers can’t rely solely on an automated decision system to discipline or fire an employee, and where they rely on one primarily, a person has to check the output against the underlying facts. It covers employees, not job applicants, and it doesn’t replace duties under the CCPA.

September 29, 2026: voluntary AI accord. President Trump said he and leaders of major AI companies signed a voluntary accord built around four steps, including internal and external reviews. It is not law, it creates no enforceable duty for your company, and it leaves room for later regulation.

September 1–2, 2026: G20 ministers adopt the Carolina Principles. The framework is non-binding and favors light-touch AI policy. Leaders are expected to take it up in December. More on this below.

September 1, 2026: EU Commission sends information requests to 30+ AI companies. These are preliminary inquiries, not formal investigations, but the Commission’s AI Act enforcement powers are now live and requests like these can lead to proceedings.

August 2, 2026: EU enforcement powers and Article 50 begin. Disclosure rules for chatbots, AI-generated content and deepfakes apply whether or not a system counts as high-risk.

July 24–27, 2026: Digital Omnibus on AI enters into force. Regulation (EU) 2026/1744 was signed on July 8, published in the Official Journal on July 24 and applies from July 27. It moved the high-risk dates, but it also added new bans and left Article 50 and the GPAI rules where they were.

What Is AI Regulation in 2026?

“AI regulation” sounds like one law. In practice it is a stack of instruments with very different legal weight. There are enacted statutes with binding force, such as the EU AI Act and South Korea’s AI Basic Act. There are executive orders, which direct agencies but generally can’t override a statute or, on their own, preempt state law. There is regulatory guidance on how existing rules apply to AI, and sector rules in finance, healthcare, employment and credit that predate AI but now cover it. In the US, state laws have become one of the busiest sources of new obligations. Voluntary frameworks and accords sit outside the law, though they increasingly act as a baseline. Enforcement actions then show how regulators really apply all of it.

Treating a proposal, an accord or an executive order as if it were enacted legislation is one of the more common and expensive mistakes in enterprise AI compliance planning. A program built around “the AI law” doesn’t work anymore. You need to know which instruments apply to your use case in each place where the system is built, deployed or used.

Why Is AI Regulation Fragmenting?

Governments agree that AI needs some oversight. They disagree on what kind, aimed at which risks, and enforced by whom.

The EU tiers obligations by risk. The US treats regulatory friction as a risk in itself, and pushed that view at the G20 this year. Consumer protection and privacy concerns drive rules on profiling, automated decisions and disclosure, often through authorities that already exist. National security and sovereignty shape export controls, compute restrictions and hosting rules. Copyright and competition questions are producing new rules and lawsuits over training data. Labor concerns are behind a wave of US state rules on AI in hiring and monitoring.

It’s worth resisting the shorthand that “the EU regulates AI and the US doesn’t.” The US has an executive order on AI policy, a Justice Department task force aimed at state AI laws, FTC and sector enforcement, and dozens of state laws. The real difference is structure. The EU has one comprehensive statute, while the US has federal policy layered over uneven state and sector law.

EU AI Act in 2026: What Applies Now and What Was Delayed

The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and phases in over several years. The Digital Omnibus changed parts of that timeline, so older summaries are often wrong.

Already applying

Prohibited practices and AI literacy, since February 2, 2025. The bans cover social scoring, manipulative or exploitative AI and certain biometric uses. The penalty provisions became enforceable on August 2, 2025. The AI literacy duty in Article 4 still exists, but the Omnibus reworded it: providers and deployers must take measures to support AI literacy among their staff, and no specific level of literacy has to be guaranteed. It is a lighter duty than the original text.

GPAI model obligations, since August 2, 2025. Providers of general-purpose models must meet transparency, technical documentation and copyright-related requirements. Models already on the market before that date have until August 2, 2027. These duties sit with the model providers, not with a company that simply calls a model through an API.

AI Office enforcement over GPAI, since August 2, 2026. The Commission can request information, demand access to a model, order mitigations or require a recall.

Article 50 transparency, since August 2, 2026. Providers must make sure people know when they are dealing with an AI system, and must mark synthetic output in a machine-readable way. For generative systems already on the market before August 2, 2026, that marking duty has until December 2, 2026. Deployers must tell people when emotion recognition or biometric categorization is used on them, and must disclose deepfakes and AI-generated text published to inform the public on matters of public interest (with an exception where a human has editorially reviewed it). National market surveillance authorities oversee these rules.

What was delayed

High-risk obligations were due on August 2, 2026 for Annex III systems and August 2, 2027 for Annex I products. The Commission proposed the Digital Omnibus on AI in November 2025 because the harmonized standards providers need for conformity assessment weren’t ready. After a provisional deal in May 2026, Council approval on June 29 and signature on July 8, the Omnibus was published on July 24 and entered into force on July 27, about a week before the original deadline. It is enacted law, not a proposal.

Standalone high-risk systems under Annex III, covering areas such as employment, credit, education and critical infrastructure, now have until December 2, 2027. High-risk AI embedded in products regulated under Annex I has until August 2, 2028. The delay does not touch the bans, the GPAI rules or Article 50. The Omnibus also added two new bans from December 2, 2026 (AI systems that generate non-consensual intimate imagery or child sexual abuse material), pushed national regulatory sandboxes to August 2, 2027 and widened relief for smaller companies.

Treat the extra time as planning room, not a pause. Standards are still being finished, so documentation expectations for high-risk systems may keep shifting.

Who has which obligations

Not every company that uses AI has the same duties. Under the Act, a provider develops a system or has one developed and puts it on the market under its own name. A deployer uses a system in a professional setting. Importers and distributors have their own, mostly high-risk-related, duties. Most of the heavy requirements fall on providers. A business that buys a chatbot and runs it for customers is usually a deployer, with Article 50 disclosure duties. A business that builds a product on someone else’s model and sells it under its own name can end up a provider.

Penalties

Prohibited-practice violations carry fines up to €35 million or 7% of global annual turnover, whichever is higher. Most other breaches, including GPAI duties, Article 50 and high-risk non-compliance once it applies, carry up to €15 million or 3%. Supplying incorrect information to authorities can bring up to €7.5 million or 1%. For smaller companies the lower of the two figures applies.

In practice: a company running a customer chatbot has transparency duties today. A company deploying a hiring or credit-scoring tool has until December 2027 for the high-risk rules, but classifying that tool now is still sensible. And if you run a generative AI product that launched before August 2026, put December 2, 2026 in the calendar.

US AI Regulation: Federal Policy

The US has no comprehensive federal AI statute. That doesn’t make AI unregulated. It is governed through federal policy, existing laws applied to AI, agency enforcement and state legislation.

Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence” (signed December 11, 2025), directs agencies to identify and challenge state AI laws seen as conflicting with a “minimally burdensome” national approach. It led to a Justice Department AI Litigation Task Force (set up in January 2026), asked Commerce to review “onerous” state laws, and called for legislative recommendations that would preempt conflicting state law while leaving room for areas such as child safety.

A White House legislative framework released in March 2026 asks Congress for broad preemption. It is a request, not a law.

The voluntary industry accord announced on September 29, 2026 is described above. It is not law.

Existing-law enforcement continues. The FTC and sector regulators apply consumer protection, deception and civil rights law to AI without needing an AI-specific statute.

An executive order directs agencies. It generally can’t preempt state law the way an act of Congress can. As of October 2026, no preemption statute has passed, and Congress has so far declined to adopt a moratorium on state AI laws.

US State AI Laws: Named Laws and Key Dates

For companies operating across states, state law is usually the more immediate concern, because it is enacted and, with one notable exception, enforceable. The laws don’t line up: a notice that satisfies one state may not satisfy another for the same use case.

California. The Transparency in Frontier Artificial Intelligence Act (S.B. 53) has applied since January 1, 2026 and requires safety and transparency disclosures from frontier model developers. The CCPA’s ADMT regulations require notice, opt-out or access rights and risk assessments for automated tools used in significant decisions, including employment, with compliance due by January 1, 2027. The Civil Rights Council’s automated decision system regulations have covered discriminatory use in employment since October 1, 2025. S.B. 947 follows on July 1, 2027.

Colorado. S.B. 26-189 (the ADMT Act) was signed on May 14, 2026. It repealed and replaced the original Colorado AI Act (S.B. 24-205), which never took effect. The new law covers automated tools used in consequential decisions, with notice, adverse-decision explanation, correction and human review rights, and applies from January 1, 2027. Enforcement is on hold. In xAI v. Weiser, the Attorney General agreed to a stay on April 27, 2026, and the order says he won’t enforce until 14 days after the court rules on xAI’s planned preliminary injunction motion. He has also said he won’t enforce until rulemaking is finished. This is a pause by agreement, not a ruling that the law is invalid, so the law is still on the books and the Attorney General’s rulemaking is still running. Check his office’s site for current comment deadlines.

Texas. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, H.B. 149) has applied since January 1, 2026. It prohibits developing or deploying AI with intent to unlawfully discriminate, among other things, and takes a lighter approach with a cure period.

Illinois. H.B. 3773 (Public Act 103-0804) amended the Illinois Human Rights Act. Since January 1, 2026 it has been a civil rights violation to use AI in employment in a way that discriminates, and to use it in covered employment decisions without notice. The state’s Department of Human Rights proposed implementing rules on May 15, 2026 and withdrew them on June 2 without a new timeline. The statute remains in effect, but what a compliant notice looks like is unsettled.

New York. The RAISE Act, in its final form after a chapter amendment signed on March 27, 2026, takes effect January 1, 2027. It applies to frontier model developers, with the heaviest duties on those with more than $500 million in annual revenue, and sets a 72-hour deadline for reporting critical safety incidents. New York City’s Local Law 144 has required bias audits and notice for automated employment decision tools since 2023.

Connecticut. S.B. 5 (Public Act 26-15) covers automated employment tools, companion chatbots, frontier model whistleblowers and AI-generated content provenance. Dates run from October 1, 2026 through 2027, as described in the developments above.

This is a starting point, not a full list. Other states have enacted chatbot, deepfake, healthcare and privacy-adjacent AI rules. Confirm current status against official sources before you rely on any entry. For multi-state operators, the practical unit of compliance is each state where a system is used or affects residents.

Federal vs. State AI Regulation: What Has and Hasn’t Happened

So far there is an executive order directing federal challenges to state laws, a Justice Department task force, a Commerce review, a White House framework asking Congress for preemption and a voluntary industry accord. There is no federal statute that actually preempts state AI law. Commentators also note that preemption theories built on executive action rather than legislation face real uncertainty in court.

The Colorado case shows how litigation can change the picture for one statute without changing it for the rest. For enterprises, treat the issue as live and contested, and keep complying with state laws that are in effect.

Global AI Regulation by Country

The useful question isn’t whether a country is strict or relaxed. It is what kind of rule you’re dealing with.

Comprehensive statutes. The EU has a risk-based act, covered above. South Korea’s AI Basic Act has been in force since January 22, 2026. It sets transparency duties for generative AI, obligations for high-impact AI and safety duties for very large models, and applies to foreign providers above certain thresholds (the draft decree used global revenue above KRW 1 trillion, domestic AI revenue above KRW 10 billion or more than one million daily users) that must appoint a local representative. Administrative fines are capped at KRW 30 million, and the ministry has said it will hold off on fines for at least a year. That grace period is an enforcement policy, not something written into the statute. The US International Trade Administration’s guide is a good starting point.

Binding AI-specific rules without a single AI law. China has no comprehensive AI statute but has layered binding rules: the Interim Measures for Generative AI Services (in force since August 15, 2023, with filing and content duties), the Measures for Labeling AI-Generated Content (September 1, 2025), a Cybersecurity Law amendment with an AI clause (January 1, 2026) and Measures on Anthropomorphic AI Interaction Services (July 15, 2026). India has no standalone AI law either. Its AI Governance Guidelines (November 2025) are non-binding. The binding AI-specific rule today is the IT Rules amendment in force since February 20, 2026, which brings synthetic audio and visual content under intermediary due-diligence duties, including labeling. India’s Digital Personal Data Protection Act is on the way, but its core obligations don’t start until May 2027, so the IT Act and its privacy rules govern personal data until then.

Existing laws and sector regulators. The UK has no AI statute. Sector regulators apply principles through their existing powers, and the Data (Use and Access) Act 2025 reworked the UK GDPR’s automated decision-making rules. A dedicated AI bill didn’t appear in the May 2026 King’s Speech, and a private member’s bill on advanced AI, set for second reading on November 13, 2026, has no government backing. Canada’s proposed AI act died with Parliament’s prorogation in January 2025 and has not been replaced. Bill C-36, a privacy bill introduced in June 2026 that would add duties around automated decisions, has only passed first reading. Australia has no standalone AI act and relies on existing consumer, privacy and sector law. Japan has a promotion-oriented AI law without direct penalties, and Singapore leans on voluntary frameworks such as AI Verify.

Pending proposals. Brazil’s AI bill (PL 2338/2023) passed the Senate in December 2024 and is waiting for a committee report in the Chamber of Deputies. Nothing in it has legal effect yet.

What this means across borders: one HR screening tool can be a future high-risk system in the EU, trigger a notice duty in Illinois today, fall under ADMT rules in California and Colorado from 2027, need a bias audit in New York City, and be handled through equality and data protection law in the UK. Classifying the tool once, globally, doesn’t work. Classify it per market.

The G20 and the Carolina Principles

On September 1–2, 2026, the US hosted a G20 Innovation Ministerial in Chapel Hill, North Carolina. Ministers reached consensus on the Carolina Principles for Emerging Technologies, a non-binding framework that calls for investment in foundational research, faster routes to commercialization and trusted adoption, and that favors reserving new AI rules for genuinely novel issues. The US Commerce Department’s announcement has the official summary. G20 leaders are expected to take it up when they meet in December.

The principles are not law anywhere and they don’t replace obligations where you operate. They do show how far apart the major economies are: the US is arguing for less dedicated AI regulation while the EU enforces the framework it built.

What Is Sovereign AI Regulation?

“Sovereign AI” covers several different worries. Data sovereignty is about keeping certain data inside national borders. Infrastructure sovereignty is about where compute physically sits. Model sovereignty asks whether a country can build or access models without depending on a foreign provider. National capability is the industrial and security policy behind all of it.

These concerns show up in export controls, procurement rules that favor domestic hosting and data localization laws. For AI procurement they turn into plain questions: where is the vendor’s model hosted, where is your data processed, and does that create exposure under residency or export-control rules?

AI Regulation and Privacy Law

AI-specific rules sit alongside privacy law, not in place of it. An AI system that processes personal data in the EU can fall under both the AI Act and the GDPR. They ask different questions: the AI Act looks at the system’s risk profile, and the GDPR looks at lawful basis, purpose limitation and individual rights. See our guide to dual AI Act and GDPR compliance.

The same layering shows up elsewhere. In the US, one automated decision tool may need to satisfy a state AI rule and a general privacy law at once, as with California’s CCPA ADMT regulations. In India, personal data in AI workflows will fall under the DPDP Act once its core duties begin in 2027. Data flow mapping, access controls, minimization and documentation support all of these workstreams, and reducing how much sensitive data an AI system sees lowers exposure under each.

What Should Businesses Do About AI Regulation Now?

Waiting for one global rulebook isn’t a strategy, and the direction of travel is more variation, not less. A practical sequence:

Inventory every AI system, including features built into vendor products and tools employees adopted on their own. Ask IT, procurement and business teams, then check SaaS admin consoles and expense reports for anything nobody approved.

Record your role for each system. Under the EU Act that means provider, deployer, importer or distributor. Under US state laws it usually means developer or deployer. Putting your name on a system built on someone else’s model can change your role.

Map each system to places and activities: which countries and US states it is used in, whose decisions it influences and what it is used for.

Check for regulated categories such as employment, credit, education, health, essential services, biometrics, chatbots and synthetic content. Next to each, note whether the rule is in force, scheduled, proposed or only guidance.

Find the data going in: personal, confidential and regulated data entering AI workflows, and what leaves your environment.

Review vendors on data retention, training on your data, subprocessors, processing locations, documentation, audit rights and incident notification.

Keep evidence: a description of each use case, the reasoning behind its classification, testing and bias results, oversight procedures, notices given, and decision logs where relevant.

Name an owner for each system and one for regulatory monitoring. Review on a set schedule, and keep a separate calendar for future deadlines so they aren’t mistaken for duties you already have.

Most of these steps are good governance practice rather than legal requirements for every organization. Items 1 to 3 are the quickest way to find out whether a legal duty exists at all. Duties depend on your role, the system and the place, so take advice from counsel in the relevant jurisdiction where the answer isn’t clear.

None of this guarantees compliance everywhere, which isn’t realistic in a fragmented environment. It does put you in a position to answer specific regulatory questions quickly. Questa AI focuses on privacy-first enterprise AI, helping organizations find and reduce sensitive data exposure before it reaches AI models, through AI data discovery, anonymization and redaction. That supports the data-handling layer of an AI governance program. It isn’t a substitute for legal analysis or a guarantee of compliance with any specific law. For the wider governance picture, see our AI governance glossary entry and our guide to enterprise AI legal risk.

Frequently Asked Questions

Conclusion

The rules differ a great deal from one jurisdiction to the next, but the questions regulators ask are surprisingly similar. What AI are you running? What data does it touch? Who is accountable for it? Whether the question comes from a risk-based statute in Brussels, a disclosure law in a US state or a data residency concern, a company that can answer those three questions quickly is in a much better position than one that can’t.

That’s why the first job is unglamorous: an inventory, a clear view of your role, and a calendar that keeps today’s duties apart from next year’s. Dates will keep moving, as the EU’s high-risk delay and the pause on Colorado’s law both show, so build the habit of checking official sources rather than relying on last quarter’s summary. And remember that this guide is a starting point for your own analysis. For decisions that carry legal weight, work with counsel who knows the jurisdictions involved.