EU and U.S. state rules set different paths for AI oversight

The European Union’s AI Act applies generally from August 2, 2026, according to the European Commission, with extended deadlines for high-risk systems. Requirements for Annex III systems begin on December 2, 2027, followed by Annex I regulated products on August 2, 2028. Prohibited practices can draw maximum fines of EUR 35 million or 7% of worldwide annual turnover, whichever is higher. For SMEs, including start-ups, the lower figure applies.

Texas’s AI governance law takes effect January 1, 2026, with enforcement reserved exclusively for the attorney general and no private right of action. Before suing, the attorney general must provide notice and allow 60 days to cure a violation. Colorado’s law covers automated technology used in consequential decisions, including employment, housing, lending and health care. Deployers must provide notices, explain adverse outcomes and recognize access, correction and human-review rights. Developer documentation requirements begin January 1, 2027; enforcement rests with the attorney general.

Spain’s AESIA agency, headquartered in A Coruña, has supervision, advisory, awareness-raising and training responsibilities. Colombia’s national AI policy sets out more than 100 actions through 2030, although its implications for company obligations remain unverified.

Leadership teams should identify where their AI is offered or used, assess systems supporting consequential decisions and assign responsibility for monitoring regulatory changes. Applicable duties depend on geography and use case, making jurisdiction-specific reviews central to governance planning.