Last updated: 27 September 2026
Short answer: in 2026, the EU has the only comprehensive AI law, and it is phasing in. Bans on certain AI practices apply already, rules for general-purpose AI models apply since August 2025, transparency and labelling duties apply from August 2026, and the heavier rules for high-risk systems were pushed back to December 2027 and August 2028. The US has no federal AI law; instead there is a patchwork of state laws, and a federal effort to override them. For most builders, the practical priorities are the same everywhere: know your use case's risk level, be transparent when users interact with AI or see AI-generated content, keep records, and keep a human in charge of consequential decisions. This is a summary, not legal advice.
Where do the main AI rules stand in 2026?
| Jurisdiction | Rule | Status in 2026 |
|---|---|---|
| European Union | AI Act | In force since August 2024; phasing in to 2028 |
| United States (federal) | No comprehensive AI law | December 2025 executive order seeks a national framework and pre-emption of state laws |
| California | Transparency in Frontier AI Act (SB 53) | Signed September 2025; applies from January 2026 to developers of the largest models |
| Texas | Responsible AI Governance Act (TRAIGA) | In effect since 1 January 2026 |
| Colorado | Replacement AI law on automated decisions | Signed May 2026; takes effect 1 January 2027 |
How does the EU AI Act work?
The EU AI Act sorts AI systems by risk and scales the obligations to match:
- Unacceptable risk: banned outright, such as social scoring and certain manipulative or exploitative uses. These prohibitions have applied since 2 February 2025.
- High risk: systems used in areas like hiring, credit, education, critical infrastructure, and AI built into products already covered by EU safety law. These face requirements for risk management, data quality, documentation, human oversight and conformity assessment.
- Limited risk: transparency duties, such as telling people they are talking to an AI or labelling AI-generated content.
- Minimal risk: most AI, such as spam filters or recommendation features, with no specific new obligations.
Separate rules apply to providers of general-purpose AI models, the large models behind chatbots and many other tools. Those have applied since August 2025.
The penalties are serious. The highest tier, for prohibited practices, reaches up to €35 million or 7 percent of worldwide annual turnover, whichever is higher.
What changed with the EU's 2026 delay?
In July 2026 the EU adopted the Digital Omnibus on AI, which entered into force on 27 July 2026. It pushed back the high-risk rules because standards and national enforcement bodies were not ready:
- Standalone high-risk systems (the Annex III list, such as hiring and credit): from 2 August 2026 to 2 December 2027.
- AI embedded in products covered by EU product-safety law (Annex I, such as machinery and medical devices): to 2 August 2028.
Several obligations were not delayed. The bans, the general-purpose model rules, and the Article 50 transparency and labelling duties kept their original dates, with the labelling duties applying from 2 August 2026. "Delayed" is not "cancelled"; it is extra time to prepare.
For engineers who build machinery or other regulated products, the Annex I route matters most. AI inside such products will be assessed through the existing product-safety process, much as CE marking works today, so AI requirements will become part of the technical file rather than a separate exercise.
What is happening in the United States?
There is no comprehensive federal AI law. On 11 December 2025, the President signed an executive order, Ensuring a National Policy Framework for Artificial Intelligence, which aims for a "minimally burdensome" national standard and directs agencies to identify and challenge state AI laws seen as inconsistent with it. The White House followed with legislative recommendations in March 2026 asking Congress to pre-empt burdensome state laws.
Executive orders cannot by themselves cancel state laws, and Congress had not passed a pre-emption law as of September 2026. So the state laws below still apply, and their future depends on Congress and the courts.
Which state laws matter most?
- California SB 53, the Transparency in Frontier Artificial Intelligence Act, was signed on 29 September 2025 and applies from January 2026. It targets developers of the largest "frontier" models, requiring published safety frameworks and incident reporting. Most smaller builders are not directly covered, but their model providers may be.
- Texas TRAIGA took effect on 1 January 2026. It prohibits certain intentional harmful uses of AI, is enforced only by the Texas attorney general, and allows penalties of up to $200,000 per violation, with a 60-day period to fix problems.
- Colorado passed the first broad state AI act in 2024, delayed it, and then in May 2026 repealed and replaced it with a narrower law focused on automated decisions in areas such as employment and lending. The new law takes effect on 1 January 2027 and centres on transparency when an automated system contributes to an adverse decision about a consumer.
What should builders do now?
Whether you ship software, hardware or internal tools, the same steps cover most of the ground:
- Classify each AI use case. Is it minimal risk, a transparency case, or something that touches hiring, credit, safety or other high-risk areas? Most business tools are low risk; a few are not.
- Be transparent. Tell users when they are dealing with an AI system, and label AI-generated images, audio and video where rules or platforms require it. This is one of the EU duties applying from August 2026.
- Keep a human in charge of consequential decisions. Laws in the EU and several US states focus on automated decisions that affect people's jobs, money or access to services.
- Document your choices. Which model, which data, what testing, what limits. If you ever need to demonstrate compliance, records made at the time are what count.
- Read your AI vendors' terms. Your obligations often depend on what your model provider does and promises.
- Track change. EU dates have already moved once, and US rules could shift quickly depending on Congress.
Management standards help here too. I described ISO/IEC 42001, the certifiable AI management system standard, in how AI is changing engineering documentation and quality work. AI rules also overlap with data protection, covered in what engineers should know about data privacy laws in 2026, and they matter most for systems that act on their own, which I explained in what "agentic AI" really means.
FAQ
Does the EU AI Act apply to companies outside the EU?
Yes, when their AI systems are placed on the EU market or their output is used in the EU. A US or Indian company selling an AI product to EU customers can fall within scope.
When do the EU AI Act's high-risk rules apply?
After the 2026 amendment, from 2 December 2027 for standalone high-risk systems and 2 August 2028 for AI embedded in products covered by EU product-safety law. Bans and general-purpose model rules already apply.
Is there a federal AI law in the United States?
No. As of September 2026, AI is governed by existing laws, executive orders and state AI laws. The federal government has asked Congress to pass a national framework that would pre-empt many state rules.
Do I need to label AI-generated content?
In the EU, transparency duties for certain AI-generated or manipulated content apply from 2 August 2026, and platforms such as YouTube have their own disclosure rules. Labelling realistic AI-generated media is becoming the norm, so it is sensible to build it in.
