Ask whether AI is regulated and you’ll get three confident answers: “no, it’s the Wild West,” “yes, Europe handled it,” and “it’s complicated.” Only the third one survives contact with mid-2026. AI is governed — unevenly, contentiously, and by a map that has redrawn itself substantially in the past twelve months. Here’s what actually applies, where, right now.
Europe: the landmark law that slowed itself down
The EU AI Act — the world’s first comprehensive AI statute — has been in force since August 2024, phasing in by risk tier. Two tiers are live today:
- Bans (since February 2025): eight practices are simply prohibited — social scoring, AI that manipulates people into harm, scraping faces off the internet to build recognition databases, real-time biometric identification in public spaces by police outside narrow exceptions.
- General-purpose model duties (since August 2025): makers of large models — the GPT and Claude class, which the law calls general-purpose AI — owe transparency about training data and copyright policy, with a heavier “systemic risk” tier for frontier models.
The heavy machinery, though, just got pushed back. The third tier — obligations for high-risk systems (AI making decisions in hiring, credit, education, migration, critical infrastructure) — was scheduled for August 2026. Under the Digital Omnibus, a simplification package the Commission proposed in November 2025 that reached political agreement in May 2026, those rules now land on December 2, 2027, with AI embedded in physical products following in August 2028. Brussels frames the delay as giving companies working standards before obligations bite; critics call it deregulation by another name. Both can be true. Penalties, when they do apply, remain the AI Act’s teeth: up to €35 million or 7% of global turnover for prohibited practices.
United States: no federal law, a brawl instead
There is still no comprehensive federal AI statute, and Washington spent the year fighting about who gets to fill the gap. In July 2025, the Senate voted 99–1 to strip a proposed ten-year freeze on state AI laws out of the federal budget bill — states’ rights, by landslide. In December 2025, the White House answered with an executive order seeking to preempt state AI regulation anyway, and the fight moved to the courts and to Congress, where it remains.
The states, meanwhile, kept legislating — with mixed fates:
- Colorado is the cautionary tale. Its 2024 AI Act — the first comprehensive state law, aimed at algorithmic discrimination in high-stakes decisions — never actually applied. Delayed to June 2026, challenged in court by xAI, its enforcement stayed in April 2026, it was finally replaced in May 2026 by a narrower disclosure-focused law taking effect January 2027. First mover, first unwound.
- California went narrower and made it stick: SB 53, signed September 2025, requires frontier developers (the handful of labs training the biggest models) to publish safety frameworks, report critical incidents, and protect whistleblowers.
- Texas has had TRAIGA in effect since January 1, 2026 — a prohibited-uses law (no AI built to incite violence or unlawfully discriminate, limits on government social scoring and biometrics) rather than a compliance regime.
- New York’s RAISE Act, signed December 2025, puts transparency and safety-reporting duties on frontier developers starting 2027.
The pattern: broad EU-style laws are being litigated and rewritten; narrow transparency-and-disclosure laws are surviving. If you want to know what US AI regulation converges toward, watch the survivors.
China: the quiet front-runner in binding rules
While the West argued, China shipped. Its 2023 generative-AI measures and September 2025 content-labeling rules (all AI-generated media must be marked, visibly and in metadata) were the baseline. Since then:
- The Cybersecurity Law was amended — effective January 2026 — to fold AI oversight into China’s foundational internet statute, the first time AI appears in primary law rather than agency rules.
- In May 2026, regulators issued the world’s first dedicated national policy for AI agents — autonomous systems that act, not just chat — requiring filing, testing, and recall mechanisms for agents in healthcare, transport, media, and public safety.
- Rules for companion AI — chatbots that simulate personality and emotional bonds — take effect July 15, 2026: no “virtual intimate relationships” for minors, parental consent under 14, mandatory time limits.
- Underneath it all runs a registration regime with real numbers: 868 generative AI services filed with the national regulator by the end of April 2026.
China’s rules bind more tightly than anyone’s — and serve a system where “safety” includes political control of information. Both halves of that sentence matter.
Has anyone actually been fined?
Under the new AI laws: barely — the enforcement clocks are only now starting. The real money so far has come from old laws applied to new machines. The largest single example remains Italy’s privacy regulator fining OpenAI €15 million in December 2024 over ChatGPT’s training-data practices — a GDPR case, not an AI Act one. That’s the practical lesson of the enforcement landscape: privacy, consumer-protection, and discrimination law never stopped applying to AI, and for now they bite harder than anything written specifically for it.
What this means if you deploy AI
Strip away the jurisdictional noise and the compliance surface converges on a short list: label what’s AI-generated; disclose when people are talking to a machine; document what your high-stakes systems do and test them for discriminatory outcomes; report serious incidents; and keep a human answerable for consequential decisions. Every serious regime on three continents is some weighting of those five verbs. Companies waiting for the rules to “settle” are missing the settled part.
The zen reading: the machines aren’t ungoverned — they’re governed the way rivers are, by many hands building levees at different speeds, arguing about the blueprints while the water moves. The water doesn’t wait. Neither should your labeling policy.