top of page

AI Regulation in 2026: What Actually Passed and What It Means

S. West
Jul 20, 2025
5 min read

Updated: 3 days ago

AI regulation has moved from theoretical debate to practical reality. But the landscape is fragmented, inconsistent, and often confusing. Some jurisdictions have passed binding legislation. Others have issued executive orders that carry varying degrees of enforceability. If you build, deploy, or use AI systems, you need to understand what actually applies to you — not the headlines, but the substance.


The EU AI Act: The Most Comprehensive Framework


The European Union's AI Act is the most ambitious piece of AI legislation in the world. Adopted in 2024 and in force since 1 August 2024, it applies in phases and establishes a risk-based classification system for AI applications.


How It Works


The Act divides AI systems into four risk categories:


Unacceptable Risk — Banned outright. This includes social scoring systems by governments, real-time biometric surveillance in public spaces (with narrow exceptions for law enforcement), and AI that manipulates behavior in ways that cause harm. These prohibitions took effect on 2 February 2025.


High Risk — Subject to strict requirements. This includes AI used in employment decisions, credit scoring, education, law enforcement, and critical infrastructure. High-risk systems must undergo conformity assessments, maintain detailed documentation, implement human oversight mechanisms, and register in an EU database. These requirements apply from 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products, after the 2026 Digital Omnibus on AI pushed them back from August 2026.


Limited Risk — Transparency obligations only. Chatbots must disclose that users are interacting with AI. Deepfakes must be labeled. Emotion recognition systems must inform users.


Minimal Risk — No specific requirements. Most AI applications fall here. Spam filters, recommendation engines, video game AI — these are largely unregulated.


What It Means in Practice


If you deploy AI in the EU or serve EU customers, classification matters. A recruitment screening tool is high-risk. A customer service chatbot is limited-risk. The compliance burden is dramatically different.


For high-risk systems, the requirements are substantial: technical documentation, quality management systems, post-market monitoring, incident reporting, and conformity assessments. Small companies can use simplified procedures, but they still must comply.


The Act also introduces requirements for general-purpose AI models (like GPT-4 or Claude). Providers of these foundation models must publish summaries of training data, comply with copyright law, and — for models with systemic risk — conduct adversarial testing and report incidents to the European AI Office.


Enforcement


The EU AI Office handles enforcement at the European level, while member states establish national authorities. Fines for prohibited practices can reach 35 million euros or 7% of worldwide annual turnover, whichever is higher (Article 99); most other breaches carry up to 15 million euros or 3%. Whether enforcement will be aggressive or permissive remains to be seen — the GDPR's early years suggest a slow ramp-up followed by increasingly serious actions.


The United States: Executive Orders and State-Level Action


The US approach to AI regulation is characteristically fragmented. There is no federal AI law comparable to the EU AI Act. Instead, regulation is happening through executive orders, agency actions, and state legislation.


Federal Executive Orders


President Biden's October 2023 Executive Order on AI established reporting requirements for companies developing frontier models. Companies training models above certain compute thresholds must notify the government and share safety test results. The order also directed agencies to develop AI guidelines for their respective domains.


The practical impact has been modest. Executive orders can be modified or rescinded by subsequent administrations. Agency guidelines vary in specificity and enforceability.


State Legislation


States have been more active. Colorado passed an AI discrimination law targeting high-risk systems used in consequential decisions. California has debated more sweeping legislation. Illinois, New York City, and several other jurisdictions have enacted rules around AI in hiring.


The result is a patchwork. A company operating nationally must navigate different rules in different states, with no federal preemption to simplify compliance.


Agency Actions


The FTC has been the most active federal agency, taking enforcement actions against companies making deceptive AI claims. The EEOC has issued guidance on AI in employment. The FDA is developing frameworks for AI in healthcare. But these are sector-specific actions, not comprehensive AI regulation.


China: Control and Competition


China has enacted several AI-specific regulations: rules on recommendation algorithms (2022), deepfake regulations (2023), and generative AI service regulations (2023). These require companies to register AI services with authorities, conduct security assessments, and ensure AI-generated content aligns with state-approved values.


For international companies, operating AI services in China requires compliance with content restrictions, data localization requirements, and government registration.


What Is Actually Enforceable vs. Aspirational


Enforceable now:


  • EU AI Act unacceptable-risk prohibitions

  • EU transparency requirements for chatbots and deepfakes

  • State-level AI hiring laws (Colorado, Illinois, NYC)

  • China's generative AI registration requirements

  • FTC enforcement against deceptive AI practices


Phasing in:


  • EU high-risk AI compliance requirements (December 2027 and August 2028)

  • EU foundation model requirements

  • Various state-level laws taking effect


Aspirational or uncertain:


  • US executive order provisions (subject to political change)

  • Voluntary industry commitments (no enforcement mechanism)

  • International AI safety agreements (no binding authority)


Impact on Developers and Companies


If You Are Building AI Products


Start with classification. Under the EU AI Act, determine whether your system is high-risk. If it is, begin compliance work now — conformity assessments, documentation, and monitoring are not things you can bolt on at the last minute.


For US companies serving EU customers: the EU AI Act applies to you if your AI system is placed on the EU market or its output is used in the EU.


If You Are Using AI Tools


Understand what your vendors are doing about compliance. If you use an AI hiring tool, you may be jointly responsible for ensuring it does not discriminate. If you deploy a chatbot, you may need to add disclosure language.


If You Are a Startup


The compliance burden is real but manageable. The EU AI Act includes provisions for regulatory sandboxes and simplified procedures for SMEs. Start with documentation — if you can clearly describe what your system does, what data it uses, and what risks it presents, you are ahead of most companies.


What Is Coming Next


The regulatory trajectory is toward more regulation, not less. The most important thing you can do right now is build compliance into your development process rather than treating it as an afterthought. Document your training data. Test for bias. Implement human oversight for high-stakes decisions. Monitor your systems in production. These are not just regulatory requirements — they are good engineering practices that happen to also keep you on the right side of the law.


To check whether your own pipeline enforces this, the AI Governance in the Pipeline checklist covers model documentation, evaluation gates, production monitoring and who owns each.


Sources

Related reading



Keep learning. This article is part of the AI Governance & Responsible AI path in the ShiftQuality Learning Center. Ship AI you can stand behind — fair, transparent, and accountable.

bottom of page