AI rules diverge as EU deadlines shift and US states act

The EU AI Act imposes risk-based obligations, with prohibited-practice bans, general-purpose model duties and transparency rules already enforceable. High-risk requirements have been delayed until 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products. Prohibited practices can attract fines of 35 million euros or 7% of worldwide annual turnover, whichever is higher.

The US has no comparable comprehensive federal law. Biden’s AI executive order was revoked on 20 January 2025, ending its reporting requirements. The administration now seeks a less burdensome national framework and challenges to state restrictions, but executive action alone cannot repeal state statutes. Federal agencies continue sector-specific enforcement, including action against deceptive AI claims.

State obligations differ substantially. California requires frontier-model safety disclosures and generative-content provenance marking, while Texas prohibits specified intentional practices. Illinois and New York City regulate employment-related AI. Colorado replaced its original law before it took effect, with narrower automated-decision requirements applying from 1 January 2027. China requires AI service registration, security assessments and compliance with content restrictions and data localization requirements.

Developers and businesses must identify applicable jurisdictions and classify systems before planning compliance. EU obligations can reach companies outside Europe when their systems enter its market or their outputs are used there. Documentation, bias testing, human oversight and production monitoring are central preparations, while tool users also need to assess vendor compliance and potential responsibility for discriminatory outcomes.