---
title: "Who governs the machines? The state of AI law, mid-2026"
description: "Europe's landmark act slowed down, America's states sped up and got sued, and China quietly shipped the most binding rules of all. A field guide to what actually applies right now."
date: 2026-07-14
kind: explainer
tags: [genai, tech, policy]
canonical: https://mlzen.com/briefs/who-governs-the-machines
disclosure: "drafted with AI · awaiting human review"
sources:
  - { title: "European Commission: Regulatory framework for AI (AI Act timeline, Digital Omnibus)", url: "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai" }
  - { title: "Governor of California: Newsom signs SB 53", url: "https://www.gov.ca.gov/2025/09/29/governor-newsom-signs-sb-53-advancing-californias-world-leading-artificial-intelligence-industry/" }
  - { title: "Colorado General Assembly: SB24-205 Consumer Protections for Artificial Intelligence", url: "https://leg.colorado.gov/bills/sb24-205" }
  - { title: "Norton Rose Fulbright: Colorado enacts revised AI law (SB 26-189)", url: "https://www.nortonrosefulbright.com/en-us/knowledge/publications/18733d31/colorado-enacts-revised-ai-law" }
  - { title: "Akin: Colorado postpones implementation of the Colorado AI Act", url: "https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/colorado-postpones-implementation-of-colorado-ai-act-sb-24-205" }
  - { title: "Wikipedia: Regulation of artificial intelligence in the United States", url: "https://en.wikipedia.org/wiki/Regulation_of_artificial_intelligence_in_the_United_States" }
  - { title: "CAC (expert interpretation): Cybersecurity Law amendment and AI governance", url: "https://www.cac.gov.cn/2026-01/02/c_1769093523928606.htm" }
  - { title: "CAC/NDRC/MIIT: Implementation Opinions on intelligent agents", url: "https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm" }
  - { title: "CAC et al.: Interim Measures for anthropomorphic interactive AI services", url: "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm" }
  - { title: "CAC: Registered generative AI services through April 2026", url: "https://www.cac.gov.cn/2026-05/13/c_1780413225190669.htm" }
  - { title: "Euronews: Italy's privacy watchdog fines OpenAI €15 million", url: "https://www.euronews.com/next/2024/12/20/italys-privacy-watchdog-fines-openai-15-million-after-probe-into-chatgpt-data-collection" }
---

# Who governs the machines? The state of AI law, mid-2026

Ask whether AI is regulated and you'll get three confident answers: "no, it's the Wild West," "yes, Europe handled it," and "it's complicated." Only the third one survives contact with mid-2026. AI is governed — unevenly, contentiously, and by a map that has redrawn itself substantially in the past twelve months. Here's what actually applies, where, right now.

## Europe: the landmark law that slowed itself down

The EU **AI Act** — the world's first comprehensive AI statute — has been in force since August 2024, phasing in by risk tier. Two tiers are live today:

- **Bans** (since February 2025): eight practices are simply prohibited — social scoring, AI that manipulates people into harm, scraping faces off the internet to build recognition databases, real-time biometric identification in public spaces by police outside narrow exceptions.
- **General-purpose model duties** (since August 2025): makers of large models — the GPT and Claude class, which the law calls *general-purpose AI* — owe transparency about training data and copyright policy, with a heavier "systemic risk" tier for frontier models.

The heavy machinery, though, just got pushed back. The third tier — obligations for **high-risk systems** (AI making decisions in hiring, credit, education, migration, critical infrastructure) — was scheduled for August 2026. Under the **Digital Omnibus**, a simplification package the Commission proposed in November 2025 that reached political agreement in May 2026, those rules now land on **December 2, 2027**, with AI embedded in physical products following in August 2028. Brussels frames the delay as giving companies working standards before obligations bite; critics call it deregulation by another name. Both can be true. Penalties, when they do apply, remain the AI Act's teeth: up to €35 million or 7% of global turnover for prohibited practices.

## United States: no federal law, a brawl instead

There is still no comprehensive federal AI statute, and Washington spent the year fighting about who gets to fill the gap. In July 2025, the Senate voted **99–1** to strip a proposed ten-year freeze on state AI laws out of the federal budget bill — states' rights, by landslide. In December 2025, the White House answered with an executive order seeking to **preempt state AI regulation** anyway, and the fight moved to the courts and to Congress, where it remains.

The states, meanwhile, kept legislating — with mixed fates:

- **Colorado** is the cautionary tale. Its 2024 AI Act — the first comprehensive state law, aimed at algorithmic discrimination in high-stakes decisions — never actually applied. Delayed to June 2026, challenged in court by xAI, its enforcement stayed in April 2026, it was finally **replaced in May 2026** by a narrower disclosure-focused law taking effect January 2027. First mover, first unwound.
- **California** went narrower and made it stick: **SB 53**, signed September 2025, requires *frontier* developers (the handful of labs training the biggest models) to publish safety frameworks, report critical incidents, and protect whistleblowers.
- **Texas** has had TRAIGA in effect since **January 1, 2026** — a prohibited-uses law (no AI built to incite violence or unlawfully discriminate, limits on government social scoring and biometrics) rather than a compliance regime.
- **New York**'s RAISE Act, signed December 2025, puts transparency and safety-reporting duties on frontier developers starting 2027.

The pattern: broad EU-style laws are being litigated and rewritten; narrow transparency-and-disclosure laws are surviving. If you want to know what US AI regulation converges toward, watch the survivors.

## China: the quiet front-runner in binding rules

While the West argued, China shipped. Its 2023 generative-AI measures and September 2025 **content-labeling rules** (all AI-generated media must be marked, visibly and in metadata) were the baseline. Since then:

- The **Cybersecurity Law was amended** — effective January 2026 — to fold AI oversight into China's foundational internet statute, the first time AI appears in primary law rather than agency rules.
- In May 2026, regulators issued the world's first dedicated national policy for **AI agents** — autonomous systems that act, not just chat — requiring filing, testing, and recall mechanisms for agents in healthcare, transport, media, and public safety.
- Rules for **companion AI** — chatbots that simulate personality and emotional bonds — take effect **July 15, 2026**: no "virtual intimate relationships" for minors, parental consent under 14, mandatory time limits.
- Underneath it all runs a registration regime with real numbers: **868 generative AI services** filed with the national regulator by the end of April 2026.

China's rules bind more tightly than anyone's — and serve a system where "safety" includes political control of information. Both halves of that sentence matter.

## Has anyone actually been fined?

Under the new AI laws: barely — the enforcement clocks are only now starting. The real money so far has come from *old* laws applied to new machines. The largest single example remains Italy's privacy regulator fining OpenAI **€15 million** in December 2024 over ChatGPT's training-data practices — a GDPR case, not an AI Act one. That's the practical lesson of the enforcement landscape: privacy, consumer-protection, and discrimination law never stopped applying to AI, and for now they bite harder than anything written specifically for it.

## What this means if you deploy AI

Strip away the jurisdictional noise and the compliance surface converges on a short list: **label** what's AI-generated; **disclose** when people are talking to a machine; **document** what your high-stakes systems do and test them for discriminatory outcomes; **report** serious incidents; and keep a human answerable for consequential decisions. Every serious regime on three continents is some weighting of those five verbs. Companies waiting for the rules to "settle" are missing the settled part.

The zen reading: the machines aren't ungoverned — they're governed the way rivers are, by many hands building levees at different speeds, arguing about the blueprints while the water moves. The water doesn't wait. Neither should your labeling policy.

## Sources

1. [European Commission: Regulatory framework for AI (AI Act timeline, Digital Omnibus)](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
2. [Governor of California: Newsom signs SB 53](https://www.gov.ca.gov/2025/09/29/governor-newsom-signs-sb-53-advancing-californias-world-leading-artificial-intelligence-industry/)
3. [Colorado General Assembly: SB24-205 Consumer Protections for Artificial Intelligence](https://leg.colorado.gov/bills/sb24-205)
4. [Norton Rose Fulbright: Colorado enacts revised AI law (SB 26-189)](https://www.nortonrosefulbright.com/en-us/knowledge/publications/18733d31/colorado-enacts-revised-ai-law)
5. [Akin: Colorado postpones implementation of the Colorado AI Act](https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/colorado-postpones-implementation-of-colorado-ai-act-sb-24-205)
6. [Wikipedia: Regulation of artificial intelligence in the United States](https://en.wikipedia.org/wiki/Regulation_of_artificial_intelligence_in_the_United_States)
7. [CAC (expert interpretation): Cybersecurity Law amendment and AI governance](https://www.cac.gov.cn/2026-01/02/c_1769093523928606.htm)
8. [CAC/NDRC/MIIT: Implementation Opinions on intelligent agents](https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm)
9. [CAC et al.: Interim Measures for anthropomorphic interactive AI services](https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm)
10. [CAC: Registered generative AI services through April 2026](https://www.cac.gov.cn/2026-05/13/c_1780413225190669.htm)
11. [Euronews: Italy's privacy watchdog fines OpenAI €15 million](https://www.euronews.com/next/2024/12/20/italys-privacy-watchdog-fines-openai-15-million-after-probe-into-chatgpt-data-collection)