[[[SUMMARY_START]]]

Rules for artificial intelligence are moving from broad principles to binding laws in more places.
The European Union has started phased obligations under its AI Act, while U.S. states keep passing their own measures as federal rules remain unsettled.
Global bodies are also building new governance frameworks, leaving businesses, public agencies and developers facing a fast-changing patchwork.

[[[SUMMARY_END]]]

Artificial intelligence regulation is no longer a future debate. It is becoming real law, with deadlines, compliance duties and enforcement plans arriving in quick succession. But across much of the world, many companies, regulators and public institutions still appear only partly prepared for what comes next.

The shift is most visible in Europe. The European Union’s AI Act, the first broad cross-sector legal framework for AI, is being rolled out in stages rather than all at once. Some provisions, including bans on certain prohibited practices and AI literacy duties, have applied since February 2, 2025. Rules on governance and obligations for providers of general-purpose AI models took effect on August 2, 2025. Much of the rest of the law is due to apply from August 2, 2026, with some product-related high-risk rules later still.

That phased schedule matters because it shows how fast AI governance is moving from principle to operation. Companies now have to think not only about model performance and product launches, but also about transparency, documentation, risk controls, human oversight and how to explain systems to users and regulators.

## Europe moves from lawmaking to enforcement

Europe’s challenge is no longer writing the rulebook. It is making the system work in practice. National authorities must be designated. Penalties and enforcement processes must be put into domestic systems. Regulatory sandboxes and technical guidance also have to be built.

Even inside the EU, the timetable has shown signs of strain. The European Commission has discussed changes linked to the availability of standards and support tools for high-risk AI compliance. That is a reminder that passing a law is often easier than building the testing methods, audit processes and institutional capacity needed to apply it fairly.

For businesses, the practical question is simple: what exactly counts as compliant use, compliant documentation and acceptable risk management for systems that are evolving every few months? Many firms, especially smaller ones, still do not have a clear answer.

## The United States is moving, but unevenly

In the United States, the story is different. There is still no single comprehensive federal AI law. Instead, the regulatory picture is being shaped by a mix of agency action, proposed federal frameworks and a growing number of state measures.

State lawmakers have been especially active. The National Conference of State Legislatures said that at least 45 states and Puerto Rico introduced about 550 AI bills during the 2025 legislative session. Those efforts cover issues such as deepfakes, automated decision-making, consumer transparency, elections, fraud and child safety.

At the same time, states and Washington are still arguing over who should lead. A major flashpoint has been whether federal law should block states from enforcing their own AI rules. That dispute captures a wider problem in AI policy: businesses want consistency, but lawmakers also want room to respond quickly to local harms.

Colorado offers one clear example of how readiness concerns can slow implementation. Changes approved there pushed back the effective date of the state’s AI law from February 1, 2026, to August 1, 2027. The delay suggests that even governments that want to regulate AI may need more time to settle definitions, obligations and compliance expectations.

## Global governance is expanding too

The rush is not limited to the EU and the United States. International bodies are also building new frameworks. UNESCO’s Recommendation on the Ethics of Artificial Intelligence remains an important global reference point. The United Nations has endorsed broad principles for safe, secure and trustworthy AI, and in 2025 the General Assembly established an international scientific panel and a global dialogue on AI governance.

Meanwhile, the OECD’s policy tracking shows the scale of activity. Its AI policy database now lists well over 2,000 policy initiatives from around the world. That does not mean all of them are hard law. But it does show that AI governance is spreading quickly across national, regional and sector-specific systems.

This creates a difficult environment for companies operating across borders. One product may face transparency duties in one place, election-content rules in another, sector oversight elsewhere and voluntary standards on top of all of that. Large firms may be able to build legal and technical teams around this. Smaller developers, local agencies and schools often cannot.

## Why preparedness is lagging

Part of the problem is speed. Generative AI tools reached mass use before most institutions had internal rules for procurement, testing, recordkeeping or staff training. Another problem is that the technology itself does not fit neatly into older legal categories. A chatbot can raise consumer, labor, education, privacy and safety questions at the same time.

Regulators also face a talent gap. Good enforcement needs people who understand model behavior, data governance, cybersecurity and sector law. Those skills are expensive and in short supply. Guidance is improving, including through risk-management work led by standards bodies, but the gap between policy ambition and day-to-day readiness remains wide.

The likely result is not a single global AI rulebook. It is a long period of overlapping systems, partial harmonization and frequent adjustment. For companies and public institutions, that means waiting is becoming a strategy with rising costs.

AI Perspective

The main lesson is that AI policy is entering a more practical phase. The hard part now is not writing high-level principles but turning them into workable systems that people can actually follow. The places that adapt fastest may be the ones that treat AI governance as an everyday operational task, not just a legal debate.