AI Regulation in 2025: What the USA, UK and EU Are Doing

The Global Race to Govern Artificial Intelligence

Artificial intelligence regulation has become one of the most urgent policy challenges of our time, with governments scrambling to balance innovation against real-world risks as AI systems grow more powerful by the month. In 2025 and into 2026, the USA, UK, and EU took dramatically different approaches — and understanding those differences matters whether you run a business, build software, or simply use AI tools every day.

The stakes are enormous. According to the OECD, AI is projected to contribute up to $15.7 trillion to the global economy by 2030, yet the same technology carries risks ranging from algorithmic bias and job displacement to deepfakes and autonomous weapons. Policymakers no longer have the luxury of waiting to see how things unfold. The regulatory frameworks being written today will shape AI development for the next decade.

This article breaks down exactly what each major jurisdiction is doing, how the rules compare, and what it means for businesses, developers, and everyday users in 2026.

The EU AI Act: The World’s First Comprehensive AI Law

The European Union moved fastest and most boldly. The EU AI Act entered into force in August 2024 and began applying in phases throughout 2025, making it the world’s first comprehensive legal framework specifically designed to regulate artificial intelligence. By 2026, most of its core provisions are fully operational — and businesses selling into European markets are already feeling the effects.

How the Risk-Based Framework Works

The EU AI Act sorts AI systems into four risk categories, each with different obligations:

• Unacceptable risk: AI applications that are outright banned. This includes real-time biometric surveillance in public spaces, social scoring systems by governments, and AI that manipulates human behavior through subliminal techniques.
• High risk: Systems used in critical infrastructure, education, employment, credit scoring, law enforcement, and border control. These must meet strict requirements for transparency, human oversight, data governance, and accuracy before they can be deployed.
• Limited risk: Systems like chatbots that must disclose they are AI, so users are never deceived about who they are talking to.
• Minimal risk: Most AI applications fall here — spam filters, AI in video games, recommendation engines — and face no specific obligations under the Act.

General-Purpose AI and Foundation Models

One of the most debated additions to the EU AI Act is the section on General-Purpose AI (GPAI) models — covering large language models like GPT-4 and its successors. Providers of these models must maintain detailed technical documentation, comply with EU copyright law, and publish summaries of training data. Models deemed to pose “systemic risk” — generally those trained using more than 10^25 floating point operations — face even stricter obligations including adversarial testing and incident reporting to the EU AI Office.

Penalties for non-compliance are significant: up to €35 million or 7% of global annual turnover for the most serious violations. These are not theoretical fines — the EU AI Office established in 2024 began active enforcement investigations in 2025, sending a clear message that the bloc is serious about implementation.

The United States Approach: Executive Action Over Legislation

The United States has taken a fundamentally different path. Rather than passing a single sweeping law, the US has relied on a patchwork of executive orders, agency guidance, voluntary commitments, and sector-specific rules. This reflects both the political gridlock in Congress and a deeper philosophical preference among American policymakers for innovation-friendly, light-touch regulation.

The Executive Order Legacy and 2025 Developments

President Biden’s landmark Executive Order on AI Safety, issued in October 2023, required developers of powerful AI systems to share safety test results with the federal government before public release. It directed agencies including NIST, the FTC, and the Department of Homeland Security to develop AI-specific guidelines across their domains. However, when the Trump administration returned to office in January 2025, that executive order was revoked and replaced with a new framework emphasizing American AI dominance and reduced regulatory friction.

The 2025 executive action directed federal agencies to remove barriers to AI development, prioritize AI leadership in national security, and pull back from what the administration characterized as overly cautious restrictions. The National Institute of Standards and Technology (NIST) AI Risk Management Framework, released in 2023, remained in place as a voluntary guidance tool — but the operative word is voluntary. American companies face no legal mandate to comply.

State-Level Regulation Fills the Federal Void

With federal legislation stalled, US states have moved aggressively. By mid-2026, more than 40 US states have introduced or passed AI-related legislation, covering areas including algorithmic discrimination, AI in hiring, deepfake disclosure, and automated decision-making in consumer contexts.

California has been the most active, passing bills requiring transparency in AI hiring tools, mandatory disclosure of AI-generated content, and restrictions on AI used in healthcare decisions. Colorado, Illinois, and Texas have each enacted their own AI legislation. This state-by-state patchwork creates significant compliance complexity for businesses operating nationally — a situation that itself is driving renewed calls for federal preemption legislation.

Sector-Specific Federal Rules

At the federal level, individual agencies have issued AI-specific guidance within their existing authority:

• The FDA has published frameworks for AI-enabled medical devices, requiring transparency about how algorithms make clinical recommendations.
• The FTC has clarified that existing consumer protection laws apply to deceptive AI practices, including fake reviews and misleading chatbots.
• The CFPB has warned that lenders using AI credit models must still comply with fair lending laws, regardless of algorithmic complexity.
• The EEOC has issued guidance stating that employers using AI hiring tools can be held liable for discriminatory outcomes even if the bias is introduced by a third-party vendor.

The United Kingdom: A Principles-Based Middle Ground

The UK has positioned itself between the EU’s legislative prescriptiveness and the US preference for minimal federal intervention. Following Brexit, the UK explicitly chose not to mirror the EU AI Act, instead pursuing what it calls a “pro-innovation” regulatory approach built on principles rather than hard rules.

The AI Regulation White Paper and Its Evolution

The UK’s AI regulation strategy, initially laid out in a 2023 White Paper, asked existing sector regulators — the FCA for financial services, the CQC for healthcare, the ICO for data protection — to apply AI oversight within their domains using five cross-sector principles: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.

By 2025, the new Labour government had shifted somewhat from the previous administration’s ultra-light-touch stance. The government announced plans to introduce targeted AI legislation focusing on frontier AI safety and high-risk applications, while maintaining flexibility in lower-risk sectors. The UK AI Safety Institute — now rebranded as the AI Security Institute — continued its work evaluating frontier models and publishing safety research that has been cited globally.

The UK’s Strategic Bet on Soft Power

Rather than hard law, the UK has invested heavily in international coordination and safety research. The Bletchley Declaration, signed by 28 countries including the US, EU members, and China at the AI Safety Summit in November 2023, committed signatories to international cooperation on frontier AI risks. Follow-up summits in Seoul and Paris maintained momentum, and the UK continues to punch above its weight in shaping global AI safety norms despite having less prescriptive domestic rules.

For businesses, the UK approach means more flexibility but also more uncertainty. Without clear statutory requirements, companies must interpret how general principles apply to their specific AI use cases — and that interpretation can vary depending on which regulator is watching.

Side-by-Side: How the Three Approaches Compare

Looking at these frameworks together reveals three genuinely different philosophies about how to govern transformative technology:

• The EU model is legislative, prescriptive, and enforcement-focused. It provides legal certainty but creates compliance costs and has been criticized by some for potentially disadvantaging European AI startups relative to US and Chinese competitors.
• The US model is fragmented, sector-specific, and currently tilted toward enabling AI deployment rather than constraining it at the federal level. It offers maximum flexibility but creates a confusing compliance landscape, especially with state laws proliferating.
• The UK model is principles-based and deliberately flexible, aiming to attract AI investment while maintaining safety standards. It works best when regulators are well-resourced and consistent — a significant challenge given the breadth of AI applications.

A 2025 Stanford HAI report found that regulatory uncertainty is now the top concern for AI investment decisions among enterprise technology buyers globally — ahead of technical capability and cost. That finding underscores why the divergence between these three frameworks creates real-world friction for multinational companies.

What This Means for Businesses, Developers, and Users

If you build, sell, or use AI tools, these regulatory developments have practical implications right now. Here is what actually matters:

For Businesses Operating Internationally

If you sell AI-powered products or services into the EU — even as a US or UK company — the EU AI Act applies to you. This is not optional. You need to classify your AI systems by risk level, implement conformity assessments for high-risk applications, and ensure your documentation, data practices, and human oversight mechanisms meet EU standards. The cost of non-compliance, in terms of fines and market access, is far higher than the cost of early preparation.

Practical steps to take now:

1. Audit every AI system your business uses or sells for EU AI Act risk classification.
2. Appoint or designate someone responsible for AI compliance — this role is increasingly common in mid-to-large organizations.
3. Review vendor contracts to understand who bears liability if a third-party AI tool is found to be non-compliant.
4. Subscribe to updates from the EU AI Office, the UK AI Security Institute, and NIST — regulatory guidance is still evolving rapidly.

For Developers and AI Practitioners

Technical practitioners are no longer exempt from regulatory thinking. If you build high-risk AI systems for EU deployment, you will need to produce technical documentation, conduct conformity assessments, and implement logging and monitoring. In the US, the FTC’s scrutiny of deceptive AI practices means that building transparent, explainable AI is not just good ethics — it is legal risk management.

For Everyday Users

Regulation translates into real protections. Under the EU AI Act, you have the right to know when a decision affecting you — a loan refusal, a job application screening, a healthcare recommendation — was made by an AI system. You have the right to a human review of high-stakes AI decisions. In the UK, similar protections exist under existing data protection law. In the US, your rights depend significantly on which state you live in.

Frequently Asked Questions

What is the EU AI Act and when does it apply?

The EU AI Act is the world’s first comprehensive AI regulation, which entered into force in August 2024. It applies in phases: the ban on unacceptable-risk AI systems applied from February 2025, rules for high-risk systems and general-purpose AI models applied from August 2025 onward, and full application for most remaining provisions continued through 2026. It applies to any company placing AI systems on the EU market, regardless of where that company is based.

Does US AI regulation apply to companies outside the United States?

Federal US AI rules are currently limited and largely voluntary at the national level. However, sector-specific rules — from the FDA, FTC, CFPB, and EEOC — apply to any company operating in those sectors within the US market. State laws, particularly California’s, also apply to companies doing business in those states, even if headquartered elsewhere. International companies selling AI tools to US businesses or consumers should monitor state-level developments closely.

How does the UK AI regulatory approach differ from the EU’s?

The UK has deliberately chosen not to replicate the EU AI Act. Instead of a single comprehensive law, the UK uses existing sectoral regulators applying five AI principles across their domains. The approach is more flexible and faster to adapt to new technology, but it also provides less legal certainty for businesses. In 2025 and 2026, the UK government signaled it would introduce targeted legislation for frontier AI and high-risk applications while keeping the principles-based approach for most other uses.

What AI applications are completely banned under current regulations?

Under the EU AI Act, banned applications include real-time remote biometric identification in public spaces (with narrow law enforcement exceptions), AI systems that manipulate behavior through subliminal techniques, social scoring systems operated by public authorities, and AI that exploits vulnerabilities of specific groups. The US and UK have no equivalent blanket bans, though certain applications face restrictions under existing laws covering discrimination, consumer protection, and data privacy.

What are GPAI models and why do they matter for regulation?

General-Purpose AI (GPAI) models are large-scale AI systems — like GPT-4, Gemini, Claude, and their successors — that can be applied across many different tasks rather than one specific use case. The EU AI Act imposes special obligations on GPAI providers, including technical documentation, copyright compliance, and training data transparency. Models above a compute threshold face additional requirements including adversarial testing and incident reporting. This matters because most businesses building AI products today are building on top of these foundation models, which makes the upstream providers’ compliance status critically important.

How should small businesses approach AI compliance in 2026?

Small businesses should start with an honest inventory of every AI tool they use — including third-party software with embedded AI features. For EU market exposure, classify each tool by the EU AI Act’s risk categories; most will fall into the minimal-risk bucket with no specific obligations. For high-risk applications, work with vendors to confirm their compliance documentation. In the US, focus on FTC guidance about deceptive practices and EEOC guidance if using AI in hiring. Document your AI use cases, the decisions they inform, and the human oversight processes you have in place. That documentation protects you in any regulatory inquiry.

Will global AI regulation become more unified over time?

There is genuine momentum toward international coordination. The Bletchley Declaration, the OECD AI Principles, the G7 Hiroshima AI Process, and ongoing work at the UN all point toward shared norms — particularly around frontier AI safety and transparency. However, full regulatory harmonization is unlikely in the near term. The philosophical differences between the EU’s rights-based approach, the US innovation-first stance, and the UK’s principles-based model reflect deep differences in governance culture. Businesses should plan for a multi-jurisdictional compliance landscape for at least the next five to seven years.

AI regulation in 2025 and 2026 is not a finished story — it is an evolving, fast-moving landscape where the rules written today will determine who benefits from AI and who bears its risks. The EU has moved decisively, the US is navigating a complex federal-state split, and the UK is betting that flexibility and safety research will prove more durable than rigid legislation. For anyone building with AI, investing in AI, or affected by AI-powered decisions, understanding these frameworks is no longer optional — it is fundamental to operating responsibly in a world where artificial intelligence is embedded in nearly every consequential system we rely on.

Disclaimer: This article is for informational purposes only. Regulatory frameworks change rapidly and vary significantly by jurisdiction, industry, and specific use case. Always verify technical and legal information with up-to-date official sources and consult qualified legal professionals for advice specific to your situation.