Who Regulates AI? A Field Guide

Ask “who regulates AI” and the honest answer is a jurisdiction-by-jurisdiction one, because the four largest regulatory powers have written four different theories of what the problem even is. This field guide sets out each regime as it stands in mid-2026 - not the press-release version, the docket version.

1. The European Union - one statute, risk-tiered The AI Act, Regulation (EU) 2024/1689, is the only comprehensive horizontal AI law among the majors: prohibited practices applied from February 2025, obligations on general-purpose model providers from 2 August 2025, the Article 50 transparency duties arrive 2 August 2026, and the high-risk regime phases in behind them - with the 2026 Digital Omnibus negotiation showing Brussels will trade dates, but not the architecture. Enforcement runs through the AI Office for general-purpose models and national market-surveillance authorities for the rest, with fines scaled to global turnover. The theory of the problem: AI is a product-safety and fundamental-rights issue, regulate the risk class.
2. The United States - a patchwork with a fight inside it There is still no comprehensive federal AI statute. What exists is targeted law - the TAKE IT DOWN Act of May 2025 on intimate deepfakes - plus agency action under existing powers (FTC on deception, FCC on AI robocalls) and, above all, the states. Colorado’s AI Act, the first broad state framework for high-risk systems, reached its enforcement date on 1 February 2026; Texas signed TRAIGA in June 2025; dozens of narrower state laws govern deepfakes, hiring tools and disclosures. The defining fight is federal preemption: a proposed ten-year moratorium on state AI regulation passed the House in 2025 and was stripped by the Senate 99-1 before the July 2025 budget signing, over objections from forty state attorneys general - and preemption riders have kept resurfacing since. The theory of the problem: contested, which is itself the American answer.
3. The United Kingdom - principles through existing regulators No AI act; a deliberate choice. Sector regulators - Ofcom, the ICO, the FCA, the CMA - apply five cross-cutting principles inside their existing remits, the AI Safety Institute was renamed the AI Security Institute in February 2025 with a sharpened national-security focus, and the Online Safety Act’s age-assurance duties (enforced from July 2025) show the pattern: regulate the harm where it lands, not the technology class. The theory of the problem: AI is an input to existing regulated activities.
4. China - service rules, licensed and layered The most operational regime of the four, built as successive administrative measures rather than one statute: algorithmic-recommendation rules, deep-synthesis rules requiring labels on synthetic media, and the 2023 generative-AI measures requiring security assessment and registration before public-facing services launch - with content obligations tied to existing speech law. Mandatory labelling of AI-generated content tightened further in 2025. The theory of the problem: AI is a content and social-stability question, license the service.

What the map leaves out

Two things this desk refuses to oversimplify. First, enforcement lag: every regime above is younger than the systems it governs, and the case law that gives statutes their real shape is only starting to arrive - a California political-deepfake law was partially struck down on First Amendment grounds in August 2025, a reminder that passed is not the same as settled. Second, the international layer - the Council of Europe AI convention, G7 code, standards bodies - which binds softly but shapes the text everyone else copies.