AI regulation is evolving rapidly across jurisdictions. Organizations developing or deploying AI globally must navigate an increasingly complex patchwork of laws, frameworks, and standards. This overview maps the landscape as of September 2026.

European Union

The EU has the most comprehensive AI regulatory framework globally.

EU AI Act (Regulation (EU) 2024/1689) - The world’s first comprehensive AI law, establishing a risk-based classification system. Prohibitions on unacceptable-risk AI practices and the AI literacy duty applied from 2 February 2025. GPAI model obligations applied from 2 August 2025, and the Commission’s enforcement powers over GPAI providers, the Article 50 transparency duties, and the penalty regime applied from 2 August 2026. The Digital Omnibus (Regulation (EU) 2026/1744, published 24 July 2026) deferred the high-risk obligations: stand-alone Annex III systems now apply from 2 December 2027 and high-risk AI in regulated products (Annex I) from 2 August 2028 (see EU AI Act enforcement begins ). Enforced by national market surveillance authorities and the EU AI Office.

GDPR remains the primary constraint on AI systems processing personal data. NIS2 covers cybersecurity of AI systems in critical sectors. DORA adds resilience requirements for financial AI. Cyber Resilience Act covers AI products with digital elements, with most obligations applying from December 2027.

United States

The US relies on a sectoral approach with no single comprehensive AI law.

Executive Order 14110 (October 2023) directed federal agencies to manage AI risks; it was rescinded on 20 January 2025 and replaced by Executive Order 14179, and the administration has since pushed for a single federal standard that would preempt state AI laws (see US AI policy and preemption ). NIST AI RMF remains the primary voluntary framework. Sector regulators apply existing authority: FDA oversees AI in medical devices, SEC monitors AI in financial markets, FTC enforces against deceptive AI practices, and EEOC addresses AI in employment decisions.

State legislation is accelerating. Colorado enacted the first comprehensive state AI law, then repealed and rewrote it via SB26-189 (signed 14 May 2026) into a lighter disclosure model effective 1 January 2027. Texas’s Responsible AI Governance Act has been in force since 1 January 2026. California, Illinois, and others have enacted targeted AI legislation covering areas like deepfakes , employment decisions, and consumer protection.

China

China has moved quickly with binding, technology-specific regulations.

Algorithmic Recommendation Regulation (2022) governs recommendation algorithms. Deep Synthesis Regulation (2023) covers deepfakes and synthetic content. Generative AI Regulation (2023) governs generative AI services offered to the public. Measures for Labeling AI-Generated Synthetic Content (in force since 1 September 2025) require explicit and implicit labels on AI-generated content. AI Safety Governance Framework provides broader guidance. China’s approach is notable for its speed and specificity, regulating individual AI technologies as they emerge.

United Kingdom

The UK initially adopted a principles-based, sector-led approach without a single AI law, relying on existing regulators (FCA, ICO, CMA, Ofcom) to apply AI principles within their domains. The AI Safety Institute established in 2023 was renamed the AI Security Institute in February 2025 and runs pre-deployment model evaluations. As of September 2026 no comprehensive UK AI law had been enacted.

Other Key Jurisdictions

Canada - The Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died when Parliament was prorogued in January 2025; Canada has no federal AI statute. Brazil - The AI regulatory framework (PL 2338/2023), a risk-based approach similar to the EU, passed the Senate in December 2024 and moved to the Chamber of Deputies. Japan - The AI Promotion Act (Act No. 53 of 2025), fully in force since 1 September 2025, is promotion-first with no penalties, complemented by voluntary guidelines aligned with G7 Hiroshima AI Process principles. South Korea - The AI Basic Act took full effect on 22 January 2026, with heavier obligations for high-impact AI (see Asia AI laws 2026 ). India - No comprehensive AI legislation yet, but sectoral regulators are issuing guidance, particularly SEBI for financial AI.

International Coordination

G7 Hiroshima AI Process established international guiding principles and a code of conduct for advanced AI systems. OECD AI Principles provide a foundational framework adopted by over 40 countries. The UN followed its AI Advisory Body’s 2024 report by establishing the Independent International Scientific Panel on AI (members appointed February 2026) and a Global Dialogue on AI Governance. The Council of Europe Framework Convention on AI is the first legally binding international treaty on AI, focused on human rights and democracy; the EU ratified it on 15 May 2026, but it was not yet in force as of mid-2026 (see Global AI governance 2026 ).

Strategic Implications

Organizations should adopt a compliance strategy that builds to the strictest applicable standard (typically the EU AI Act for global deployments), implement modular compliance architectures that can adapt to new requirements, monitor regulatory developments in all markets where they operate, and engage with standards bodies and industry groups to influence emerging regulations.

Sources

  1. Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  2. Executive Order 14179, “Removing Barriers to American Leadership in Artificial Intelligence,” Federal Register (31 January 2025): https://www.federalregister.gov/documents/2025/01/31/2025-02172/removing-barriers-to-american-leadership-in-artificial-intelligence
  3. UK Government, “Tackling AI security risks to unleash growth and deliver Plan for Change” (AI Security Institute rename, 14 February 2025): https://www.gov.uk/government/news/tackling-ai-security-risks-to-unleash-growth-and-deliver-plan-for-change
  4. Parliament of Canada, LEGISinfo, Bill C-27 (44th Parliament, 1st Session): https://www.parl.ca/legisinfo/en/bill/44-1/c-27